Network Host Reconciliation Across Time
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network vulnerability scanning tools fail to adequately track hosts across changing IP addresses and network administration changes, leading to inadequate security posture assessments in dynamic network environments.
Innovation Solution
A multi-context event streaming network vulnerability scanner employs a rule-based system to match hosts across different point-in-time assessments by associating hosts based on their characteristics, using a scoring system and greedy algorithm to reconcile hosts with their corresponding assets, even when IP addresses change.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If hosts are tracked using only IP address, then tracking is simple, but tracking accuracy deteriorates when IP addresses change
Solution Approach 1:
The system transitions from tracking hosts by a single parameter (IP address) to tracking by multiple parameters including hostname, MAC address, and other characteristics. This multi-parameter approach maintains tracking simplicity while improving accuracy when IP addresses change, as the system can match hosts across different IP addresses using these additional identifying characteristics.
2Reliability
If multiple host characteristics are used for matching, then host tracking accuracy improves, but system complexity increases
Solution Approach 1:
The system automatically collects and processes multiple host characteristics (hostname, MAC address, services, applications) without requiring manual intervention. The automated data collection and matching algorithms handle the complexity internally, improving tracking accuracy while minimizing the operational burden on users.
Solution Approach 2:
The host matching system is designed to work with multiple types of characteristics simultaneously (network identifiers, system identifiers, application identifiers). This multi-functional approach allows the same system to handle various identification methods, improving accuracy without proportionally increasing complexity through standardized processing routines.
3Measurement precision
If hosts are reassessed frequently, then security posture assessment accuracy improves, but resource consumption increases
Solution Approach 1:
The system applies different assessment frequencies and depths to different hosts based on their risk profiles, criticality, and change characteristics. High-value or high-risk hosts receive more frequent and thorough assessments, while lower-priority hosts are assessed less frequently. This localized approach improves overall assessment accuracy while optimizing resource utilization by avoiding uniform high-frequency assessment of all hosts.
Data Source
AI summary
An apparatus, systems, and methods for matching network assets that were previously discovered by a network vulnerability assessment to a not yet reconciled network vulnerability assessment, and allowing for the associating of network assets to their corresponding assessed hosts that were discovered as part of different point-in-time network vulnerability assessments.