External Attack Surface Discovery for Unknown Internet-Facing Assets

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity measures struggle to identify and protect against unknown and forgotten assets, entry points, and vulnerabilities in computing networks, which are often exploited by hackers.

Innovation Solution

A system and method that utilizes primary and secondary identification data, DNS searches, IP address determination, and open-source tools to discover and assess computing assets, vulnerabilities, and threats, enriching information through multiple databases and AI/machine learning models to create a comprehensive external attack surface management catalog.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If traditional cybersecurity measures are used to detect known assets and vulnerabilities, then detection accuracy for documented assets is maintained, but the ability to detect unknown and forgotten assets deteriorates

Engineering Contradiction:

Improvedetection of unknown assetsVSAvoidsecurity protection effectiveness

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The system performs preliminary actions by proactively discovering and cataloging unknown assets before they can be exploited. It continuously scans network infrastructure, queries databases of known vulnerabilities, and identifies forgotten assets in advance, allowing security measures to be implemented before attacks occur rather than reacting after detection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary layer between traditional security tools and the network infrastructure. This intermediary component aggregates data from multiple sources including DNS queries, database searches, and network scans to create a comprehensive view of unknown assets that traditional single-point tools cannot detect alone.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Quantity of substance

If comprehensive scanning of all network assets is performed to ensure complete asset discovery, then detection completeness is improved, but system complexity and resource consumption increase

Engineering Contradiction:

Improvenumber of detected assetsVSAvoidsystem complexity

Core Design Contradiction:

Quantity of substanceVSDevice complexity

Solution Approach 1:

The system segments the comprehensive scanning task into multiple coordinated operations: DNS data collection, database queries against vulnerability repositories, network port scanning, and cross-referencing results. Each segment handles a specific aspect of asset discovery, making the overall complex task manageable and resource-efficient through division of labor.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system employs multi-functional components that perform multiple tasks. For example, the same scanning infrastructure used to detect unknown assets also validates known vulnerabilities, and the database querying mechanism serves both asset discovery and vulnerability assessment functions, reducing overall system complexity through resource sharing.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Measurement precision

If manual assessment of network assets is performed to ensure thorough vulnerability evaluation, then assessment accuracy is improved, but time consumption and productivity decrease

Engineering Contradiction:

Improvevulnerability assessment accuracyVSAvoidasset discovery speed

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system performs self-service by automatically executing vulnerability assessments without requiring manual intervention. It autonomously queries vulnerability databases, analyzes scan results, cross-references findings, and generates assessments independently, maintaining high accuracy while eliminating the time consumption associated with manual evaluation processes.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system replaces manual mechanical assessment processes with automated computational mechanisms. Instead of human analysts manually scanning and evaluating each asset, the system uses automated scripts, database queries, and algorithmic analysis to perform the same functions at scale and speed, significantly improving productivity while maintaining measurement precision through systematic approaches.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20250379882A1System and method of discovering external attack surface based on identification data

Publication Date: 2025.12.11 QUALYS

AI summary

Disclosed are systems and methods for discovering one or more computing assets associated with primary identification data. The systems and methods comprise a series of processes and steps to discover an organization's external attack surface. The processes and steps include building a unique external attack surface management catalog to be used as a configuration value as a first step of discovering unknown internet-facing assets of an organization. Then the processes and steps include using the unique external attack surface management catalog in combination with open-source reconnaissance and proprietary scanners to determine the external attack surface of the organization. The disclosed systems and methods then uniquely present the acquired relevant data to users using a single display screen. The disclosed systems and methods not only discover the external attack surface and internet-facing assets of an organization and its aliases, but also internet-facing assets of related subsidiary, affiliate, and partner entities.