Network Situational Awareness via Passive Active Crawler System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network discovery tools are inadequate for modern networks with dynamic changes, as they rely on point-in-time scans and fail to detect time-bound security anomalies outside the scan window, making them unsuitable for real-time situational awareness in environments like cloud and software-defined networks.
Innovation Solution
Implementing a system that uses a combination of passive and active crawling techniques within the network's control plane, allowing for continuous data collection and immediate detection of changes, with passive crawlers listening for route advertisements and active crawlers interrogating and analyzing these changes in real-time, providing comprehensive network topology maps and security analytics.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If point-in-time scanning is used for network discovery, then the scanning process is simple and resource-efficient, but the system fails to detect time-bound security anomalies and cannot provide real-time situational awareness
Solution Approach 1:
The patent implements continuous network discovery by maintaining persistent crawler processes that continuously traverse and scan network targets without interruption. Multiple crawlers operate concurrently and continuously, ensuring uninterrupted monitoring of network assets, which eliminates the time window limitation of periodic scanning and enables real-time detection of security anomalies.
Solution Approach 2:
The system performs preliminary actions by pre-establishing crawler processes and maintaining ready-state scanning capabilities before security events occur. The continuous crawlers are already active and monitoring network targets, so when security anomalies occur, they are detected immediately without waiting for the next scheduled scan cycle.
2Reliability
If continuous crawling is implemented for real-time detection, then detection capability and real-time awareness are improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent segments the continuous discovery system into multiple independent crawler processes that operate in parallel. Each crawler is responsible for specific network targets or segments, allowing the system to distribute the complexity of continuous monitoring across multiple simpler, manageable components rather than requiring a single complex monolithic system.
Solution Approach 2:
The crawler processes are designed to be universal and multi-functional, capable of performing multiple discovery tasks including vulnerability scanning, asset inventory, and security anomaly detection simultaneously. This multi-functionality reduces overall system complexity by consolidating multiple specialized tools into a single versatile crawling platform.
3Area of stationary object
If multiple crawlers operate concurrently for comprehensive coverage, then network coverage and detection thoroughness improve, but resource consumption and system overhead increase
Solution Approach 1:
The patent implements partial action by having crawlers focus on specific network segments, target types, or vulnerability categories rather than scanning every network asset uniformly. This selective approach provides comprehensive coverage of critical areas while reducing overall resource consumption by avoiding redundant scanning of already-assessed low-risk targets.
Solution Approach 2:
The system dynamically adjusts crawler behavior based on network conditions, target responsiveness, and detected security risks. Crawlers can be activated or deactivated, adjust scan depths, and modify traversal patterns in real-time, allowing the system to optimize resource utilization while maintaining comprehensive network coverage as conditions change.
Data Source
AI summary
Network route control plane data, advertised by one or more routers on a network, is received from a passive discovery module. The passive discovery module is configured to communicate with the routers using one or more routing protocols, but not to advertise route data. The received network route control plane data is compared to network element data stored in a network element database. If the received network route control plane data is not contained in the network element database, the received network route control plane data is stored in the network element database. If the received network route control plane data is contained in the network element data database, the received network route control plane data is compared to target asset data stored in a target asset database. If the received network route control plane data is not contained in the target asset database, the received network route control plane data is stored in the target asset database. The target asset database is analyzed for unscanned targets. Data describing unscanned targets is delivered to an active discovery module.