Hierarchical Scanning of Internet Assets for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
System administrators often fail to detect and address security vulnerabilities in internet-connected assets due to the complexity and vastness of network systems, where not all details are known or monitored effectively.
Innovation Solution
A hierarchical scanning system that sends an initial payload to a broad range of network devices and ports, determines if follow-up probes are necessary based on responses, and stores data in a database, allowing for efficient cataloging and querying of network devices, software, and settings, thereby reducing the time needed for network scanning and enabling proactive security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive network scanning is performed to detect all security vulnerabilities, then detection completeness is improved, but scanning time and system resources consumed increase significantly
Solution Approach 1:
The scanning process is divided into multiple hierarchical levels (Level 1: basic port detection, Level 2: service identification, Level 3: vulnerability assessment). Not all devices undergo all levels of scanning, allowing the system to segment the comprehensive scanning task into manageable phases that can be applied selectively based on device characteristics and risk assessment.
Solution Approach 2:
The system performs preliminary actions by first conducting Level 1 scans to identify basic port availability and device responsiveness before proceeding to more time-consuming Level 2 and Level 3 scans. This preliminary filtering ensures that only devices that are likely to be vulnerable or critical undergo exhaustive scanning, significantly reducing overall scanning time while maintaining detection completeness for high-risk targets.
2Measurement precision
If detailed scanning of each network device is performed, then detection accuracy is improved, but operational complexity and resource consumption increase
Solution Approach 1:
The scanning operation is segmented into distinct hierarchical levels with increasing detail. Level 1 performs basic connectivity checks, Level 2 identifies services and configurations, and Level 3 conducts vulnerability assessments. This segmentation allows administrators to understand the scanning process in manageable stages and select appropriate levels based on device criticality, reducing operational complexity while maintaining accuracy for essential devices.
Solution Approach 2:
Different scanning depths and methodologies are applied to different network devices based on their local characteristics, criticality, and risk profiles. Critical devices receive comprehensive multi-level scanning with high detection accuracy, while less critical devices undergo simplified Level 1 or Level 2 scanning. This local quality approach maintains accuracy where needed while reducing overall operational complexity and resource consumption.
3Measurement precision
If all network devices are scanned with multiple probes, then vulnerability identification is improved, but scanning efficiency deteriorates
Solution Approach 1:
The system performs preliminary Level 1 scanning to identify basic device characteristics and responsiveness before applying more resource-intensive Level 2 and Level 3 probes. This preliminary action filters out devices that are unlikely to be vulnerable or critical, allowing the system to maintain high vulnerability identification accuracy for important targets while significantly improving overall scanning efficiency by avoiding exhaustive probing of low-risk devices.
Solution Approach 2:
The system applies partial scanning (Level 1 or Level 2) to devices that are low-risk or non-critical, while reserving comprehensive multi-level scanning (Level 3) for high-value targets. This partial action approach maintains sufficient vulnerability identification accuracy for most devices while dramatically improving scanning efficiency by avoiding excessive probing of devices that do not require detailed inspection.
Data Source
AI summary
Hierarchical scanning begins with communicating probes over the Internet to ports and networks addresses to determine publicly accessible devices. Based on responses to those probes, follow-up probes are determined to obtain additional information about the publicly accessible devices. The probes are transmitted from a system that is external to the networks corresponding to the network addresses. This provides an external view of the scanned networks and facilitates a probing paradigm that scales beyond a few networks.