# US 8,789,193 B2 · Method and apparatus for detecting events pertaining to potential change in vulnerability status > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,193 B2 - Document ID: US8789193B2 - Status: Granted - Kind: B2 - Application number: 13/732,453 - Filed: 2013-01-02 - Published: 2013-06-27 - Granted: 2014-07-22 - Earliest claimed: 2003-04-11 - Assignees: Zeno Security Corporation - Applicants: Zeno Security Corporation - Inventors: Samir Gurunath Kelekar - Web page: https://patentgrep.com/patent/US8789193B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Method and apparatus for Vulnerability Assessment techniques is disclosed. A method comprises detecting an event on a target in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, and an API. The event comprises a change in status of at least one of a network interface, a server network service, a client network service, and a port. An apparatus comprises a target having at least one of a deployed server network service, and a deployed client network service; and an agent deployed on the target, to detect an event on the target in real time or at periodic intervals. At least one of the agent and the VA server detect the event comprising a change in the status of at least one of a network interface, the server network service, the client network service, and a port. ## Claims ### Claim 1 A method comprising: detecting an event on a target, in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, or an API, the event comprising a change in status of at least one of a network interface, a server network service, a client network service, or a port; and conducting a test from at least one of a vulnerability assessment (VA) scanner, or a port scanner on the target based on the detecting, wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed. ### Claim 2 (depends on 1) The method of claim 1 further comprising allocating an IP address to the network interface on the network interface becoming active, the IP address allocated using at least one of a DHCP protocol or via a DHCP agent. ### Claim 3 (depends on 1) The method of claim 1, wherein the test from the VA scanner comprises at least one of a test run from the VA scanner to identify the service running on a particular port on the target, a test run from the VA scanner to find a vulnerability in the service running on a particular port on the target, a test run from the VA scanner to identify a particular non-port based service running on the target, a test run from the VA scanner to find a vulnerability in a particular non port based service running on the target, a test run from the VA scanner to identify target characteristics comprising at least one of an operating system running on a target, a target name, a target IP address, a target DNS name, a target fully qualified domain name, or Common platform enumeration names matched on the target, a test run from the port scanner used by or a part of the VA scanner, or a test enabled from the VA scanner and run locally on the target. ### Claim 4 (depends on 1) The method of claim 1, wherein a test from the port scanner comprises at least one of a test run from the port scanner to determine the status of a port, a test run from the port scanner to identify the service running on a particular port on the target, or a test run from the port scanner to identify target characteristics comprising at least one of an operating system running on the target, a target name, a target IP address, a target DNS name, a target fully qualified domain name, or Common platform enumeration names matched on the target. ### Claim 5 (depends on 1) The method of claim 1, wherein the VA scanner is a network-based VA scanner. ### Claim 6 (depends on 1) The method of claim 1, wherein the server network service listens on an open port, or the server network service does not listen on a closed port. ### Claim 7 (depends on 1) The method of claim 1 further comprising determining that a potential change in the vulnerability status of the target has occurred based on detecting the occurrence of the event. ### Claim 8 (depends on 1) The method of claim 1, wherein target is at least one of an enterprise computer, an enterprise mobile device, a consumer computer, or a consumer mobile device. ### Claim 9 (depends on 1) The method of claim 1, wherein the target platform runs an operating system comprising at least one of a desktop operating system, a mobile operating system, or an embedded systems operating system. ### Claim 10 An apparatus comprising: a target having at least one of a deployed server network service, or a deployed client network service; and an agent, deployed on the target, to detect an event on the target in real time or at periodic intervals, wherein at least one of the agent or a vulnerability assessment (VA) server detect the event comprising a change in the status of at least one of a network interface, the server network service, the client network service, or a port, wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed, and wherein the VA server comprises at least one of a vulnerability assessment (VA) scanner or a port scanner, the VA server operably coupled with the target. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the agent allocates an IP address to the network interface on the network interface becoming active, the IP address allocated using at least one of a DHCP protocol or via a DHCP agent. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein in response to the detection, the VA server conducts a test on the target from at least one of the vulnerability assessment (VA) scanner, or the port scanner. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the test from the VA scanner comprises at least one of a test run from the VA scanner to identify the service running on a particular port on the target, a test run from the VA scanner to find a vulnerability in the service running on a particular port on the target, a test run from the VA scanner to identify a particular non-port based service running on the target, a test run from the VA scanner to find a vulnerability in a particular non port based service running on the target, a test run from the VA scanner to identify target characteristics comprising at least one of an operating system running on a target, a target name, a target DNS name, a target fully qualified domain name, common platform enumeration names matched on the target, or a target IP address, a test run from the port scanner used by or a part of the VA scanner, or a test enabled from the VA scanner and run locally on the target. ### Claim 14 (depends on 12) The apparatus of claim 12, wherein the test from the port scanner comprises at least one of a test run from the port scanner to determine the status of a port, a test run from the port scanner to identify the service running on a particular port on the target, or a test run from the port scanner to identify target characteristics comprising at least one of an operating system running on the target, a target name, a target DNS name, a target fully qualified domain name, common platform enumeration names matched on the target, or a target IP address. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the VA scanner is a network-based VA scanner. ### Claim 16 (depends on 10) The apparatus of claim 10, wherein the server network service listens on an open port, or the server network service does not listen on a closed port. ### Claim 17 (depends on 10) The apparatus of claim 10, wherein the target platform runs an operating system comprising at least one of a desktop operating system, a mobile operating system, or an embedded systems operating system. ### Claim 18 (depends on 10) The apparatus of claim 10, wherein target is at least one of an enterprise computer, an enterprise mobile device, a consumer computer, or a consumer mobile device. ### Claim 19 (depends on 10) The apparatus of claim 10, wherein upon detecting the event, at least one of the agent or the VA server determine that a potential change in the vulnerability status of the target has occurred. ### Claim 20 (depends on 10) The apparatus of claim 10, wherein the agent detects the status, and the VA server detects the change in status. ### Claim 21 (depends on 10) The apparatus of claim 10, wherein the VA server is deployed on the target. ### Claim 22 A non-transitory computer readable storage medium for storing computer instructions that, when executed by at least one processor cause the at least one processor to perform a method comprising: detecting an event on a target, in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, or an API, the event comprising a change in status of at least one of a network interface, a server network service, a client network service, or a port; and conducting a test from at least one of a vulnerability assessment (VA) scanner, or a port scanner on the target based on the detecting, wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed.