Complementary Scan Engine Coordination to Avoid Redundant Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability scanning methods, whether local or external, often result in redundant data collection, reducing the overall efficiency of scans due to overlapping data sets when a local agent is deployed alongside an external scan.
Innovation Solution
Implementing a complementary scan engine scheme that interrogates local scan agents to determine the status and history of their data collection, allowing the scan engine to skip redundant vulnerability checks and coordinate with local agents for a more efficient scanning process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If both local scan agents and external scan engines are used for vulnerability scanning, then comprehensive vulnerability detection coverage is improved, but redundant data collection increases reducing scanning efficiency
Solution Approach 1:
The patent combines local scan agent functionality with external scan engine operations into a unified scanning system. The local agents and external engines are merged to work cooperatively, with the external scan engine orchestrating scans and local agents executing them, thereby achieving comprehensive coverage while avoiding redundant data collection through coordinated operation.
Solution Approach 2:
The external scan engine performs preliminary assessment and planning before initiating local agent scans. By pre-evaluating which vulnerability checks are needed and which can be covered by local agents, the system avoids redundant data collection. The external engine prepares scan configurations and coordinates with local agents in advance to ensure efficient resource utilization.
2Reliability
If external scan engine performs all vulnerability checks, then complete vulnerability assessment is achieved, but resource consumption including CPU, memory, and network throughput increases
Solution Approach 1:
The scanning workload is segmented and distributed between external scan engines and local scan agents. The external engine handles orchestration, configuration management, and centralized coordination, while local agents perform actual vulnerability checks on their respective hosts. This segmentation reduces the resource burden on external engines by distributing computational tasks to local machines where the data resides.
Solution Approach 2:
Local scan agents serve as intermediaries between the external scan engine and the target systems. Instead of the external engine directly performing all vulnerability checks remotely (which consumes significant network and computational resources), local agents act as intermediaries that execute scans locally and report results back, thereby reducing network throughput requirements and external engine resource consumption.
3Reliability
If local scan agents are deployed on target assets, then scanning coverage is improved, but system complexity increases due to coordination requirements
Solution Approach 1:
The external scan engine is designed as a universal platform that can orchestrate multiple types of scans across diverse target systems through a standardized interface. Local scan agents are also designed with multi-functionality to handle various vulnerability check types. This universality simplifies coordination by providing consistent interaction protocols regardless of the specific scan type or target system, thereby reducing overall system complexity despite the distributed architecture.
Data Source
AI summary
Various embodiments include systems and methods to implement a complementary scan engine scheme for avoiding redundant vulnerability check data collection when using a scan engine to scan a target asset. The implementation may include determining a set of potential vulnerability checks for scanning the target asset using the scan engine. Fingerprint data indicating which versions of software are installed on the target asset may be collected. Based at least in part on the fingerprint data, it may be determined that a particular version of a local scan agent is installed on the target asset. Responsive to a determination that the local scan agent is functioning, the scan engine may perform any vulnerability check, in the set of potential vulnerability checks, that is not covered by the local scan agent. Responsive to a determination that the local scan agent is not functioning, the scan engine may perform all vulnerability checks in the set of potential vulnerability checks.