Vulnerability Detection via Node Similarity Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability scanning methods in enterprise networks are inefficient, often requiring significant resources and time, and fail to detect vulnerabilities in offline or intermittently connected devices, leading to incomplete results and increased security risks as networks scale.
Innovation Solution
A method that scans a subset of processing nodes, determines similarity measures between these nodes and those with detected vulnerabilities, and modifies access to identify and address undetected vulnerabilities in offline or unavailable nodes, using a threat detection and remediation system with modules for node scanning, similarity computation, and vulnerability identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional vulnerability scanning is performed on all processing nodes in an enterprise network, then complete vulnerability detection is achieved, but the scanning process requires significant time and computational resources
Solution Approach 1:
The system performs preliminary actions by scanning only a subset of processing nodes first, detecting vulnerabilities in advance, and using the results to infer vulnerabilities in other nodes through similarity analysis. This preliminary scanning approach reduces the overall scanning time while maintaining detection effectiveness by avoiding redundant scans of all nodes.
Solution Approach 2:
The system creates a representation or copy of vulnerability patterns from scanned nodes and applies this knowledge to infer vulnerabilities in unscanned nodes. By copying vulnerability information and similarity characteristics from the subset of scanned nodes, the system can identify vulnerabilities in offline or unavailable nodes without directly scanning them.
2Measurement precision
If traditional vulnerability scanning is performed on all processing nodes in an enterprise network, then all vulnerabilities are detected, but significant computational resources are consumed
Solution Approach 1:
The system applies partial action by scanning only a necessary subset of processing nodes rather than all nodes in the network. This partial scanning approach consumes fewer computational resources while still achieving effective vulnerability detection through similarity-based inference, avoiding the excessive resource consumption of comprehensive scanning.
Solution Approach 2:
The system performs preliminary vulnerability detection on a representative subset of nodes, then uses this preliminary information to infer vulnerabilities across the entire network. This preliminary action reduces the need for resource-intensive comprehensive scanning while maintaining detection effectiveness.
3Reliability
If vulnerability scanning is performed frequently to maintain security, then security posture is continuously monitored, but network resources are overwhelmed
Solution Approach 1:
The system implements periodic action by performing vulnerability scans at optimized intervals on a subset of nodes rather than continuously scanning all nodes. This periodic approach maintains security monitoring effectiveness while allowing network operations to proceed normally between scans, avoiding resource overwhelming.
Solution Approach 2:
The system uses partial action by scanning only a subset of nodes during each periodic scan cycle, which reduces the resource burden compared to scanning all nodes. This enables more frequent scanning intervals to be used without overwhelming network resources, thereby maintaining security effectiveness.
Data Source
AI summary
A method includes scanning a subset of a plurality of processing nodes in a network for vulnerabilities, selecting a first one of the processing nodes not in the subset, and determining a similarity measure between the first processing node and at least a second one of the processing nodes in the subset identified as having a given vulnerability. Determining the similarity measure comprises determining a first similarity between vulnerabilities previously detected on the first and second processing nodes and determining a second similarity between attributes of the first and second processing nodes, the similarity measure being based at least in part on the first and second similarities. The method also includes identifying that the first processing node has the given vulnerability based at least in part on the similarity measure, and modifying access to the first processing node responsive to identifying that the first processing node has the given vulnerability.