Dynamic Software Discovery via Process-Linked Directory Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote network management platforms face challenges in accurately and scalably discovering computing devices and software products across diverse networks due to inflexible predefined discovery criteria, which can lead to inefficient resource usage and missed security threats.
Innovation Solution
Implementing software process-based discovery, where the discovery operations focus on file system directories associated with executing software processes, reducing the need for indiscriminate scanning and enhancing the detection of security threats by identifying potential malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If predetermined discovery criteria are used to scan computing devices, then discovery operations can be standardized and automated, but the discovery process becomes inflexible and inefficient across diverse networks with different operating systems and conventions
Solution Approach 1:
The discovery process transitions from static predetermined criteria to dynamic process-based discovery. The system dynamically identifies executing software processes and adapts discovery criteria based on actual process information, allowing the discovery operations to automatically adjust to different networks, operating systems, and conventions while maintaining automation.
2Measurement precision
If predetermined discovery criteria scan entire file systems, then comprehensive coverage is achieved, but resource consumption increases and discovery speed decreases
Solution Approach 1:
The system extracts and focuses discovery operations on specific file system directories associated with executing software processes, rather than scanning entire file systems. By taking out only the relevant portions of the file system that contain files of interest, the system maintains comprehensive coverage of necessary areas while significantly improving discovery speed and reducing resource consumption.
3Loss of time
If predetermined discovery criteria are used, then initial discovery can be performed, but the system cannot adapt to changes made over time within computing devices or managed networks
Solution Approach 1:
The discovery system implements feedback by continuously monitoring executing software processes and using this information to adapt discovery criteria over time. The system receives feedback from the dynamic state of computing devices and adjusts its discovery operations accordingly, enabling it to adapt to changes made over time within computing devices and managed networks while maintaining efficient operation.
Data Source
AI summary
A computing system may include a proxy server application and a database. The proxy server application may provide, to a computing device disposed within a managed network, instructions to identify one or more processes executing on the computing device. The proxy server application may also determine, for a process of the one or more processes, a file system path of a directory associated with the process and, based thereon, select one or more directories to scan for files associated with the process. The computing device may be provided with instructions to (i) scan the one or more directories and (ii) determine a plurality of attributes associated with one or more files discovered therein. The proxy server application may additionally receive results of the scan containing a representation of the plurality of attributes and store, in the database, the results of the scan.