Vulnerability Scanning Optimization via Database Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer network vulnerability scanning methods are inefficient due to the exponential growth of software vulnerabilities and assets, leading to performance issues and resource exhaustion, as existing tools manually run all scripts on every asset, even when previous scans have already identified non-existent or irrelevant vulnerabilities.
Innovation Solution
A system and method that utilize a vulnerability manager to identify known and new vulnerabilities, selectively running scripts only on assets that have not been previously scanned, optimizing scans by disregarding vulnerabilities that are known to not exist, and scheduling periodic full scans to ensure comprehensive system health.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all vulnerability scripts are run on every asset, then comprehensive vulnerability detection is achieved, but scan time and resource usage increase exponentially
Solution Approach 1:
The system performs preliminary actions by maintaining a vulnerability database that stores historical scan results and asset information beforehand. Before conducting a new vulnerability scan, the system queries this database to retrieve previously identified vulnerabilities and asset characteristics, allowing it to skip redundant checks and focus only on new or changed vulnerabilities, thereby reducing scan time while maintaining detection comprehensiveness
Solution Approach 2:
The system implements feedback mechanisms by continuously updating the vulnerability database with results from each scan. The database stores information about which vulnerabilities have been detected on which assets, and this feedback is used in subsequent scans to avoid re-checking known vulnerabilities. The system also feedbacks on asset changes (new assets, removed assets, modified assets) to dynamically adjust scan scope, reducing unnecessary scanning while ensuring comprehensive coverage of relevant vulnerabilities
2Reliability
If all vulnerability scripts are run on every asset, then complete vulnerability assessment is achieved, but system resources are exhausted
Solution Approach 1:
The system extracts and stores vulnerability information and asset characteristics into a separate vulnerability database during preliminary actions. This extracted information is then used to filter out redundant vulnerability checks during actual scanning operations. By taking out the knowledge of previously scanned vulnerabilities and asset states, the system avoids re-processing the same information, thereby reducing system resource consumption while maintaining complete vulnerability assessment coverage
Solution Approach 2:
The system dynamically changes scanning parameters based on feedback from the vulnerability database. It adjusts the scope of vulnerability checks by identifying new assets, removed assets, and modified assets, and modifies the scan configuration to focus only on relevant vulnerabilities for each asset type and state. This parameter adaptation reduces unnecessary resource consumption while ensuring thorough assessment of critical vulnerabilities
3Adaptability or versatility
If vulnerability scanning covers thousands of applications and operating systems, then comprehensive security coverage is achieved, but management complexity increases
Solution Approach 1:
The vulnerability database serves as a universal component that stores and manages information across multiple asset types (new assets, existing assets, removed assets, modified assets) and multiple vulnerability categories. This single database structure handles diverse asset inventories and vulnerability types through unified data models and query interfaces, reducing management complexity while maintaining comprehensive security coverage across thousands of applications and operating systems
4Reliability
If new vulnerability checks are continuously added, then detection capability is improved, but scan performance deteriorates
Solution Approach 1:
When new vulnerability checks are added to the system, the vulnerability database is updated in advance with this new vulnerability information and associated asset requirements. During subsequent scans, the system performs preliminary queries to the updated database to determine which new vulnerability checks are actually applicable to the current asset inventory. This preliminary action prevents the system from executing all newly added checks on all assets, thereby maintaining improved detection capability while avoiding performance deterioration from redundant checks
Data Source
AI summary
A method in one embodiment includes identifying a set of known vulnerabilities and a set of new vulnerabilities in an asset, selecting one or more scripts that include checks for vulnerabilities in a union of the set of known vulnerabilities and the set of new vulnerabilities, and using the selected scripts to scan the asset. Known vulnerabilities and new vulnerabilities may be identified by accessing results of previous scans on the asset. The method may also include identifying a plurality of assets to scan in a network, identifying a plurality of sets of known vulnerabilities and a plurality of sets of new vulnerabilities in substantially all assets in the plurality of assets, and inserting checks for vulnerabilities included in a union of the plurality of sets of known vulnerabilities and the plurality of sets of new vulnerabilities into the selected scripts.