# US 8,789,190 B2 · System and method for scanning for computer vulnerabilities in a network environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,190 B2 - Document ID: US8789190B2 - Status: Granted - Kind: B2 - Application number: 13/336,891 - Filed: 2011-12-23 - Published: 2013-06-27 - Granted: 2014-07-22 - Earliest claimed: 2011-12-23 - Assignees: McAfee, Inc. - Applicants: Braden Russell; Charles Mallabarapu; James M. Hugard, IV - Inventors: Braden Russell; Charles Mallabarapu; James M. Hugard, IV - Web page: https://patentgrep.com/patent/US8789190B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1433: {Vulnerability analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method in one embodiment includes identifying a set of known vulnerabilities and a set of new vulnerabilities in an asset, selecting one or more scripts that include checks for vulnerabilities in a union of the set of known vulnerabilities and the set of new vulnerabilities, and using the selected scripts to scan the asset. Known vulnerabilities and new vulnerabilities may be identified by accessing results of previous scans on the asset. The method may also include identifying a plurality of assets to scan in a network, identifying a plurality of sets of known vulnerabilities and a plurality of sets of new vulnerabilities in substantially all assets in the plurality of assets, and inserting checks for vulnerabilities included in a union of the plurality of sets of known vulnerabilities and the plurality of sets of new vulnerabilities into the selected scripts. ## Claims ### Claim 1 A method comprising: identifying, using at least one data processing apparatus, a plurality of assets to scan in a network; identifying, using at least one data processing apparatus, a plurality of sets of known vulnerabilities in the plurality of assets, wherein identifying the plurality of sets of known vulnerabilities comprises identifying, for two or more of the plurality of assets, a respective set of known vulnerabilities previously detected as being present on the asset; identifying, using at least one data processing apparatus, a plurality of sets of new vulnerabilities in the plurality of assets, wherein identifying the plurality of sets of new vulnerabilities comprises identifying, for two or more of the plurality of assets, a respective set of new vulnerabilities for which the asset has not yet been scanned; selecting, using at least one data processing apparatus, a set of scripts comprising checks for particular vulnerabilities included in a union of the plurality of sets of known vulnerabilities and the plurality of sets of new vulnerabilities; and using the selected scripts to scan the plurality of assets for vulnerabilities. ### Claim 2 (depends on 1) The method of claim 1, wherein vulnerabilities that have been previously tested and known not to exist in the asset are not included in the selected scripts. ### Claim 3 (depends on 1) The method of claim 1, wherein identifying the set of known vulnerabilities comprises: accessing results of previous scans on the asset, wherein the results indicate the known vulnerabilities. ### Claim 4 (depends on 1) The method of claim 1, wherein identifying the set of new vulnerabilities comprises: accessing results of previous scans on the asset, wherein the results indicate a set of scanned vulnerabilities; and determining vulnerabilities included in a universal set of vulnerabilities in a computer system that are not in the set of scanned vulnerabilities. ### Claim 5 (depends on 1) The method of claim 1, further comprising: storing results of the scan in a results database. ### Claim 6 (depends on 1) The method of claim 1, further comprising: using the selected scripts to scan substantially all assets in the plurality of assets. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of assets is identified by a range of Internet Protocol (IP) addresses. ### Claim 8 (depends on 1) The method of claim 1, wherein each vulnerability comprises a respective asset attribute that potentially enables at least one of a security breach and a policy violation. ### Claim 9 An apparatus comprising: a memory element configured to store data; and a processor operable to execute instructions associated with the data, wherein the apparatus is configured for: identifying a plurality of assets to scan in a network; identifying a plurality of sets of known vulnerabilities in the plurality of assets, wherein identifying the plurality of sets of known vulnerabilities comprises identifying, for two or more of the plurality of assets, a respective set of known vulnerabilities previously detected as being present on the asset; identifying a plurality of sets of new vulnerabilities in the plurality of assets, wherein identifying the plurality of sets of new vulnerabilities comprises identifying, for two or more of the plurality of assets, a respective set of new vulnerabilities for which the asset has not yet been scanned; selecting a set of scripts comprising checks for particular vulnerabilities included in a union of the plurality of sets of known vulnerabilities and the plurality of sets of new vulnerabilities; and using the selected scripts to scan the plurality of assets. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein identifying the set of known vulnerabilities comprises: accessing results of previous scans on the asset, wherein the results indicate the known vulnerabilities. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein identifying the set of new vulnerabilities comprises: accessing results of previous scans on the asset, wherein the results indicate a set of scanned vulnerabilities; and determining vulnerabilities included in a universal set of vulnerabilities in a computer system that are not in the set of scanned vulnerabilities. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the apparatus is further configured for: storing results of the scan in a results database. ### Claim 13 (depends on 9) The apparatus of claim 9, further comprising: using the selected scripts to scan substantially all assets in the plurality of assets. ### Claim 14 At least one non-transitory, machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: identify a plurality of assets to scan in a network; identify a plurality of sets of known vulnerabilities in the plurality of assets, wherein the instructions when executed, cause the machine to identify, for two or more of the plurality of assets, a respective set of known vulnerabilities previously detected as being present on an asset; identify a plurality of sets of new vulnerabilities in the plurality of assets, wherein the instructions when executed, cause the machine to identify, for two or more of the plurality of assets, a respective set of new vulnerabilities for which the asset has not yet been scanned; select a set of scripts comprising checks for vulnerabilities included in a union of the plurality of sets of known vulnerabilities and the plurality of sets of new vulnerabilities; and use the selected scripts to scan the plurality of assets. ### Claim 15 (depends on 14) The storage medium of claim 14, wherein identifying the set of known vulnerabilities comprises: accessing results of previous scans on the asset, wherein the results indicate the known vulnerabilities. ### Claim 16 (depends on 14) The storage medium of claim 14, wherein identifying the set of new vulnerabilities comprises: accessing results of previous scans on the asset, wherein the results indicate a set of scanned vulnerabilities; and determining vulnerabilities included in a universal set of vulnerabilities in a computer system that are not in the set of scanned vulnerabilities. ### Claim 17 (depends on 14) The storage medium of claim 14, wherein the instructions, when executed, further cause the machine to: store results of the scan in a results database. ### Claim 18 (depends on 14) The storage medium of claim 14, wherein the instructions, when executed, further cause the machine to: use the selected scripts to scan substantially all assets in the plurality of assets.