Computing Entity Discovery Through Network Protocol Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional scanning systems struggle to identify and respond to new or unique network communication protocols used by target entities, as they are not updated in real-time and can be easily detected by these entities, leading to missed detections and blocked scans.
Innovation Solution
A scanning system that transmits messages formatted in the network communication protocol to elicit responses, emulates the protocol to obscure its identity, and learns enough of the protocol to identify and add entities of interest to a group, even for unknown protocols, using reverse engineering when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional scanning systems use fixed protocol databases, then system complexity is reduced and ease of operation is improved, but the ability to detect new or unknown protocols deteriorates
Solution Approach 1:
The patent transforms the static protocol database into a dynamic learning system. The scanning system automatically learns new communication protocols by analyzing captured traffic and reverse-engineering protocol specifications in real-time, allowing the system to adapt to new protocols without manual updates while maintaining ease of operation.
Solution Approach 2:
The scanning system performs self-updating through automated protocol learning and reverse engineering. The system captures communication traffic, analyzes it to discover new protocols, and automatically updates its own protocol database without requiring external intervention or manual database maintenance.
2Measurement precision
If the scanning system transmits identifiable scan messages, then detection accuracy is improved, but the vulnerability to detection and blocking by target entities increases
Solution Approach 1:
The patent introduces protocol emulation as an intermediary layer between the scanning system and target entities. By emulating legitimate protocol behavior and traffic patterns, the scanning system can probe targets accurately while appearing as normal communication, thereby avoiding detection and blocking.
Solution Approach 2:
The scanning system dynamically changes its communication parameters by adapting to discovered protocols. It modifies message formats, timing, and communication patterns to match the emulated protocol behavior, allowing accurate detection while maintaining stealth against anti-scanning measures.
3Adaptability or versatility
If the scanning system updates protocol databases in real-time, then adaptability to new protocols is improved, but device complexity and processing requirements increase
Solution Approach 1:
The system achieves real-time adaptation through self-service protocol learning. By automatically capturing, analyzing, and reverse-engineering protocols from live traffic, the system updates its own knowledge base without external input, balancing real-time adaptability with automated operation that masks the underlying complexity.
Data Source
AI summary
One embodiment provides a method for discovering an entity communicating using a network communication protocol. A scanning system of a system transmits, at a plurality of communication ports, a message using the network communication protocol to elicit a response from an entity accessing one of the communication ports. The transmitting includes emulating a portion of the network communication protocol. The scanning system receives a response to the message from the entity accessing one of the communication ports. The scanning system determines the entity is an entity of interest by determining that the response is provided using the network communication protocol and is responsive to the message. Responsive to determining that the entity is an entity of interest, the entity is added to a group of entities of interest.