Policy-Based Vulnerability Assessment for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current vulnerability scanning technologies face challenges with information overload and false positives due to continuous scanning, which complicates network monitoring and remediation, as they simulate attacker behavior and produce redundant data.
Innovation Solution
A system and method that integrates vulnerability scanning with network security policies to filter out redundant information, allowing continuous scanning while distinguishing scanner activity from attacks, using a policy-based monitor system to manage scanner operations and present actionable remediation procedures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability scanning is performed continuously, then vulnerability detection capability is improved, but false alarms increase and monitoring efficiency deteriorates
Solution Approach 1:
The patent segments scanner traffic into distinct categories (vulnerability scanner traffic, exploit traffic, etc.) and applies different policy rules to each category. This segmentation allows the monitoring system to distinguish between legitimate scanning activities and actual attacks, thereby maintaining high vulnerability detection capability while reducing false alarms from continuous scanning operations.
2Reliability
If vulnerability scanning is performed continuously, then vulnerability detection capability is improved, but information overload increases and processing efficiency deteriorates
Solution Approach 1:
The patent extracts and removes redundant information from vulnerability scanner reports by comparing scan results against known vulnerability databases and policy definitions. This extraction process filters out duplicate findings and focuses on new or changed vulnerabilities, maintaining comprehensive detection capability while reducing information overload for security analysts.
Solution Approach 2:
The patent changes the parameters of information presentation by transforming raw scanner output into standardized vulnerability records with consistent formatting, severity classifications, and remediation guidance. This parameter transformation organizes the data in a more manageable form, reducing information overload while preserving all essential vulnerability detection capabilities.
3Reliability
If network monitoring is applied to detect scanner activity, then attack detection is improved, but scanner operations are misidentified as attacks and monitoring accuracy deteriorates
Solution Approach 1:
The patent introduces a policy-based intermediary layer that sits between the network monitoring system and the vulnerability scanner. This intermediary contains specific policy rules that identify and permit legitimate scanner traffic patterns while blocking actual attacks. The intermediary enables both attack detection and scanner operation by providing a mediation mechanism that distinguishes between the two based on predefined criteria.
4Reliability
If vulnerability scanning is performed frequently, then vulnerability detection capability is improved, but network performance deterioration increases
Solution Approach 1:
The patent implements periodic vulnerability scanning with variable intervals based on risk levels, asset criticality, and change detection triggers. Instead of continuous scanning, the system performs scans at optimized intervals, conducting more frequent scans only when necessary (e.g., after configuration changes or detected threats) and less frequent scans during stable periods. This periodic approach maintains vulnerability detection capability while minimizing network performance deterioration.
Data Source
AI summary
A system and method for a vulnerability assessment mechanism that serves to actively scan for vulnerabilities on a continuous basis and interpret the resulting traffic in context of policy is provided. Vulnerability information is presented within an enterprise manager system enabling the user to access vulnerability information, recommended remediation procedures, and associated network traffic. A studio mechanism is used to add scanners to the appropriate policies and control the scope and distribution of scans within the target network.