Software Identification via Process Start Events and Log Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability management systems are resource-intensive and time-consuming due to repetitive searches of computing devices for software identification, and they fail to incorporate log data for efficient software discovery, making them sub-optimal in critical cybersecurity environments.
Innovation Solution
Implementing a method that uses real-time process start events to identify software types and versions by analyzing binary locations and log data, reducing redundant processing through previously processed binary records and frequency analysis, and integrating log data for passive fingerprinting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing vulnerability management systems perform repetitive searches of host computing systems to identify software, then software identification can be achieved, but computing resources are consumed excessively and the process becomes time-consuming
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing log data in advance to create a software inventory database. This preliminary software identification using log data (such as registry keys, file paths, and process information) allows the system to have software information ready before vulnerability scanning begins, eliminating the need for repetitive searches during the actual vulnerability management process.
Solution Approach 2:
The patent introduces log data as an intermediary medium between the vulnerability management system and the software inventory. Instead of directly searching host systems repeatedly, the system uses log data (collected from Windows Event Logs, registry information, and file system data) as an intermediate representation that contains software identification information, thereby reducing direct system searches and improving efficiency.
2Reliability
If existing vulnerability management systems comb through hard drives repeatedly to identify software, then software existence can be confirmed, but the process becomes resource-intensive and redundant
Solution Approach 1:
The system creates a copy of software identification information by extracting data from log files and registry information into a structured software inventory database. This copy contains essential software metadata (names, versions, installation paths) that can be queried efficiently without needing to repeatedly access the actual hard drive files or perform exhaustive searches, thereby reducing computing resource utilization while maintaining identification reliability.
Solution Approach 2:
The system performs preliminary data collection and processing by gathering software information from log data and registry keys before the vulnerability scanning process. This advance preparation creates a ready-to-use software inventory that eliminates the need for repetitive, resource-intensive hard drive searches during vulnerability management operations.
3Productivity
If traditional vulnerability management systems do not incorporate log data for software discovery, then the system remains simple, but software identification becomes sub-optimal and inefficient
Solution Approach 1:
The patent makes the vulnerability management system multi-functional by integrating log data analysis capabilities into the existing software identification process. The system now serves dual purposes: traditional vulnerability scanning and efficient software inventory creation from log data. This universal approach allows a single system to perform both security assessment and software discovery tasks, improving productivity without proportionally increasing complexity.
Solution Approach 2:
The system enables self-service by automatically collecting software identification information from existing log data that is already generated by the operating system during normal operation. Instead of requiring separate, complex discovery mechanisms, the system leverages already-available log information (process logs, registry events, file system logs) to automatically build and update the software inventory, thereby improving efficiency with minimal additional complexity.
Data Source
AI summary
Disclosed herein are methods, systems, and processes to perform passive and realtime software identification and data collection for vulnerability management. Vulnerability management based on agent-collected event data involves monitoring a process start event associated with an application executing on a computing device that is part of a network, identifying a binary location of the process start event, and based on the binary location, identifying a software type of the application and a version of the software type. Vulnerability management based on event data in logs involves monitoring the process start event for configuration or file changes, generating fingerprint rules by mapping the configuration or files changes and the process start event associated with a software installation or an upgrade of the software, and processing log data to fingerprint the software type and the version of the software type. Agent-collected event data and event data in logs can be amalgamated to perform software and version identification for vulnerability management.