# US 8,789,140 B2 · System and method for interfacing with heterogeneous network data gathering tools > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,140 B2 - Document ID: US8789140B2 - Status: Granted - Kind: B2 - Application number: 13/312,963 - Filed: 2011-12-06 - Published: 2012-03-29 - Granted: 2014-07-22 - Earliest claimed: 2003-02-14 - Assignees: Preventsys, Inc. - Applicants: John Leslie Williams; Brian Costello; John Patrick Ravenel; Thomas Paul Walpole - Inventors: John Leslie Williams; Brian Costello; John Patrick Ravenel; Thomas Paul Walpole - Web page: https://patentgrep.com/patent/US8789140B2 ## CPC - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 41/0856: {by backing up or archiving configuration information} - H04L 41/0859: by keeping history of different configuration generations or by rolling back to previous configuration versions - H04L 43/00: Arrangements for monitoring or testing data switching networks - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 43/045: for graphical visualisation of monitoring data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A prevention-based network auditing system includes a plurality of heterogeneous information sources gathering information about the network. An audit server invokes the heterogeneous information sources via a uniform communications interface to gather information about the network, and converts the information gathered by the information sources into a normalized data format such as, for example, into XML (Extensible Markup Language). The converted information is then stored in an audit repository for security and regulatory policy assessment, network vulnerability analysis, report generation, and security improvement recommendations. ## Claims ### Claim 1 A method, comprising: receiving network scan results from information sources in heterogeneous formats; converting the network scan results into structurally normalized scan results using a plurality of first tags and a second tag nested in the first tags, the first tags indicating a test, the second tag indicating a result of the test; identifying semantically equivalent network scan results in the structurally normalized scan results; and comparing at least a portion of the semantically equivalent network scan results with a network policy to determine a compliance with the network policy. ### Claim 2 (depends on 1) The method of claim 1, wherein the network scan results include a list of wireless access point devices and associated parameters for accessing one or more wireless networks, and a location for each of the wireless access points is determined. ### Claim 3 (depends on 1) The method of claim 1, further comprising generating a remediation task for a violation of the network policy. ### Claim 4 (depends on 1) The method of claim 1, further comprising generating a remediation task for a violation of the network policy, wherein the remediation task identifies the violation by a severity and an address of a host associated with the violation. ### Claim 5 (depends on 1) The method of claim 1, wherein the identifying the semantically equivalent network scan results comprises associating a symbolic reference with at least two of the information sources in a reference map. ### Claim 6 (depends on 5) The method of claim 5, wherein the symbolic reference is mapped to corresponding test identifiers produced by the information sources. ### Claim 7 Logic encoded in one or more non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising: receiving network scan results from information sources in heterogeneous formats; converting the network scan results into structurally normalized scan results using a plurality of first tags and a second tag nested in the first tags, the first tags indicating a test, the second tag indicating a result of the test; identifying semantically equivalent network scan results in the structurally normalized scan results; and comparing at least a portion of the semantically equivalent network scan results with a network policy to determine a compliance with the network policy. ### Claim 8 (depends on 7) The encoded logic of claim 7, wherein the network scan results include a list of wireless access point devices and associated parameters for accessing one or more wireless networks, and a location for each of the wireless access points is determined. ### Claim 9 (depends on 7) The encoded logic of claim 7, wherein the operations further comprise generating a remediation task for a violation of the network policy. ### Claim 10 (depends on 7) The encoded logic of claim 7, wherein the operations further comprise generating a remediation task for a violation of the network policy, wherein the remediation task identifies the violation by a severity and an address of a host associated with the violation. ### Claim 11 (depends on 7) The encoded logic of claim 7, wherein the identifying the semantically equivalent network scan results comprises associating a symbolic reference with at least two of the information sources in a reference map. ### Claim 12 (depends on 11) The encoded logic of claim 11, wherein the symbolic reference is mapped to corresponding test identifiers produced by the information sources. ### Claim 13 A system, comprising: one or more processors operable to execute instructions stored on a memory such that the one or more processors receive network scan results from information sources in heterogeneous formats; convert the network scan results into structurally normalized scan results using a plurality of first tags and a second tag nested in the first tags, the first tags indicating a test, the second tag indicating a result of the test; identify semantically equivalent network scan results in the structurally normalized scan results; and compare at least a portion of the semantically equivalent network scan results with a network policy to determine a compliance with the network policy. ### Claim 14 (depends on 13) The system of claim 13, wherein the network scan results include a list of wireless access point devices and associated parameters for accessing one or more wireless networks, and a location for each of the wireless access points is determined. ### Claim 15 (depends on 13) The system of claim 13, wherein the one or more processors are operable to generate a remediation task for a violation of the network policy. ### Claim 16 (depends on 13) The system of claim 13, wherein the one or more processors are operable to generate a remediation task for a violation of the network policy, and the remediation task identifies the violation by a severity and an address of a host associated with the violation. ### Claim 17 (depends on 13) The system of claim 13, wherein the one or more processors identify the semantically equivalent network scan results by associating a symbolic reference with at least two of the information sources in a reference map. ### Claim 18 (depends on 1) The method of claim 1, wherein the information sources are associated with a plurality of scanners for which meta-information is provided, the meta-information relates to capabilities for each of the scanners and how each of the scanners maps to scanners that can perform similar testing operations, and the converting comprises utilizing a conversion table that maps fields of the heterogeneous formats into fields in the normalized scan results. ### Claim 19 (depends on 7) The encoded logic of claim 7, wherein the information sources are associated with a plurality of scanners for which meta-information is provided, the meta-information relates to capabilities for each of the scanners and how each of the scanners maps to scanners that can perform similar testing operations, and the converting comprises utilizing a conversion table that maps fields of the heterogeneous formats into fields in the normalized scan results. ### Claim 20 (depends on 13) The system of claim 13, wherein the information sources are associated with a plurality of scanners for which meta-information is provided, the meta-information relates to capabilities for each of the scanners and how each of the scanners maps to scanners that can perform similar testing operations, and the one or more processors are operable to utilize a conversion table that maps fields of the heterogeneous formats into fields in the normalized scan results.