Active Scanning System Using Side-Channel Data for Availability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Control systems face challenges in performing exhaustive active scans due to concerns about system stability and availability, as traditional methods do not consider the impact on the target machine's behavior. Additionally, manual schemes for identifying scan ranges are time-consuming and labor-intensive.
Innovation Solution
An information collection system that automatically generates or updates allow lists or deny lists to determine suitable scan ranges and timings for active scanning, using side-channel data to estimate the impact on system availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active scanning is performed to collect asset information, then security assessment capability is improved, but system availability and stability deteriorate
Solution Approach 1:
The scanning system dynamically adjusts scanning parameters based on real-time monitoring of target system performance metrics. The system continuously monitors CPU usage, memory consumption, and response times, and automatically modifies scanning intensity, frequency, and scope to maintain system availability while collecting asset information.
Solution Approach 2:
The system implements periodic scanning with variable intervals instead of continuous or fixed-schedule scanning. Scanning operations are performed at optimized intervals that balance information collection needs with system stability requirements, reducing impact on availability while maintaining assessment effectiveness.
2Measurement precision
If exhaustive active scanning is performed to ensure complete asset information collection, then measurement precision is improved, but processing load and labor burden increase
Solution Approach 1:
The system performs scanning operations that are sufficient to achieve complete asset information collection without being excessively comprehensive. It identifies and scans only the necessary portions of the target system based on predefined criteria and real-time conditions, avoiding redundant scanning that would increase processing load without adding value.
Solution Approach 2:
The scanning system automatically manages its own operation without requiring manual intervention for each scanning task. It self-configures scan parameters, selects target systems, executes scanning operations, and processes results autonomously, significantly reducing the labor burden on operators while maintaining thorough asset information collection.
3Productivity
If periodic polling is used for continuous scanning, then productivity is improved, but system availability deteriorates due to不考虑 impact on target machine
Solution Approach 1:
The system implements continuous monitoring of target system performance metrics and uses this feedback to dynamically adjust scanning operations. By continuously gathering data on CPU usage, memory consumption, and system response times, the scanning system can adapt its polling frequency and intensity to maintain system availability while achieving continuous asset information collection.
Solution Approach 2:
The scanning system transitions from static periodic polling to dynamic adaptive scanning. Scanning parameters such as interval, duration, and scope are continuously adjusted based on real-time system conditions, enabling continuous operation without fixed schedules that could negatively impact target machine availability.
Data Source
AI summary
An information collection system includes: a side-channel information processing unit that derives load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; an allow list generation unit that generates an allow list including a scan timing and a scan range in which the availability is not affected, the allow list generation unit generating the allow list based on the load information; and an allow list storage unit that stores the allow list. An active scan of the target machine is executed by referencing the allow list stored in the allow list storage unit to collect asset information of the target machine.