Distributed Network Vulnerability Scan Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Performing network vulnerability scans in distributed computing environments is challenging due to resource-intensive sequential execution, which degrades performance and results in unreliable scans, especially when targets change network addresses or go offline, leading to increased costs and downtime.
Innovation Solution
A network scanning system that structures scans as a collection of functions executed in discrete stages, using a directed acyclic graph to coordinate and prioritize functions based on dependencies, allowing for concurrent execution and pausing scans when targets become unavailable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network vulnerability scans are executed sequentially using traditional methods, then the scan can be completed with straightforward execution, but the computational resources required are substantial and service performance degrades
Solution Approach 1:
The network vulnerability scan is divided into multiple independent scan tasks that can be executed in parallel. Each scan task represents a segment of the overall scanning process, allowing distributed execution across multiple computing nodes. This segmentation enables concurrent processing while reducing the computational burden on any single node, thereby improving overall productivity without excessive resource consumption.
Solution Approach 2:
The patent transitions from sequential single-threaded scan execution to parallel multi-threaded distributed execution. By adding the dimension of parallelism and distribution across multiple nodes, the system achieves higher throughput and better resource utilization. The scan framework operates across multiple computing nodes simultaneously, transforming the execution model from one-dimensional sequential processing to multi-dimensional parallel processing.
2Reliability
If network scans are performed continuously without interruption, then comprehensive coverage is achieved, but the scan results become unreliable when targets change network addresses or go offline
Solution Approach 1:
The scan execution framework dynamically adapts to target availability changes during the scanning process. The system monitors target responsiveness and dynamically adjusts execution by pausing when targets are unavailable and resuming when they become available. This dynamic approach ensures that scan results remain accurate and reliable by only recording results when targets are actually reachable, while minimizing time loss through automatic resumption capability.
Solution Approach 2:
The system implements feedback mechanisms to monitor target availability and scan progress in real-time. When scan tasks encounter unavailable targets, the framework receives feedback about the target's unavailability and adjusts execution accordingly by pausing or skipping inappropriate tasks. This feedback-driven approach maintains result reliability by avoiding false positives from unreachable targets while minimizing overall scan time through intelligent task management.
3Reliability
If compute resources are allocated for scanning but not actively used when services are offline, then resource allocation remains simple, but scanning costs increase due to wasted resource usage
Solution Approach 1:
The distributed scan framework implements partial execution by dynamically adjusting which scan tasks are actually performed based on real-time target availability. Rather than executing all planned scan tasks regardless of target status, the system performs only those tasks that are likely to succeed, skipping or pausing tasks for unavailable targets. This partial action approach reduces wasted computational resources while maintaining reliable scan results by focusing efforts on reachable targets.
Data Source
AI summary
Systems for performing a network scan of one or more targets are provided. The systems select, from functions related to performing a network scan of a target, a first group of functions that are ready to execute at a first time. The first group of functions may be executed by a distributed computing system in parallel to generate first and second results. A third function may then be identified as ready to execute based on the first result, and a fourth function may be excluded from the network scan based on the second result.