Off-node vulnerability scanning via virtual replica
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer scanning methods, particularly authenticated vulnerability analysis, introduce security risks and operational hazards due to the need for scanners to access and execute on the target computer or require administrator credentials, potentially leading to malfunctions or exploitation.
Innovation Solution
Off-node scanning is performed by collecting system state data from a target computer and generating a virtual replica on a separate computer, allowing scans to be conducted without direct access to the target computer, thereby reducing security risks and operational hazards.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If authenticated vulnerability scanning is performed on the target computer, then vulnerability detection capability is improved, but security risks and operational hazards increase
Solution Approach 1:
The patent creates a virtual replica (copy) of the target computer's file system structure and stores it in a data lake. The scanner then analyzes this copied structure instead of the live target system, maintaining vulnerability detection capability while eliminating security risks associated with direct access to the target computer.
Solution Approach 2:
The patent introduces an intermediary layer consisting of the virtual file system structure and data lake that mediates between the scanner and the target computer. This intermediary allows the scanner to access necessary information for vulnerability assessment without directly accessing or impacting the target system.
2Ease of operation
If scanner executes on target computer with administrator credentials, then access to system data is improved, but risk of malfunctions and exploitation increases
Solution Approach 1:
Instead of executing the scanner on the target computer with administrator credentials, the patent creates a virtual copy of the file system structure and analyzes it separately. This eliminates the need for administrator access to the target system while maintaining the ability to perform comprehensive vulnerability assessments.
Solution Approach 2:
The patent extracts the essential file system structure and metadata from the target computer and stores it in a data lake. This extracted copy contains sufficient information for vulnerability scanning without requiring the scanner to execute on or access the live target system, thereby removing the risks associated with administrator credential usage.
3Productivity
If scanner accesses target computer directly, then scanning efficiency is improved, but risk of introducing bugs or flaws increases
Solution Approach 1:
The patent creates a virtual replica of the target file system structure and performs scanning operations on this copy rather than the live system. This approach maintains scanning efficiency by providing direct access to file system data while eliminating the risk of introducing bugs or flaws to the target computer.
Solution Approach 2:
The patent performs preliminary analysis of the file system structure by creating a virtual copy before any potential harmful actions could occur on the target system. By pre-extracting and storing the file system structure in a data lake, the system prevents any possibility of the scanner introducing bugs or flaws to the production environment.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Security risks associated with scanning a computer are at least mitigated by performing the scanning off node. State data of a target node, or computer, can be acquired in various ways. The acquired state data can be subsequently employed to generate a virtual replica of the target computer or portion thereof on a second computer isolated from the target computer. The virtual replica of the target computer provides a scanner access to the data needed to perform a scan on the second computer without accessing or being able to impact the target computer.