Systems and methods for detecting vulnerabilities in network processes during runtime

Patent metadata

Field	Value
Publication number	US-11706239-B2
Application number	US-202017003450-A
Country	US
Kind code	B2
Filing date	Aug 26, 2020
Priority date	Aug 26, 2020
Publication date	Jul 18, 2023
Grant date	Jul 18, 2023

Abstract

Systems, methods, and non-transitory computer-readable storage media are disclosed for detecting vulnerabilities in real-time during execution of a process or an application. In one example, a device may have one or more memories storing computer-readable instructions and one or more processors configured to execute the computer-readable instructions to obtain real-time process information associated with a process executing in an endpoint. The device can then determine package information for a package associated with the process based on the process information. The device can then identify at least one vulnerability associated with the package information using a database of vulnerabilities stored on a backend component of the network. The backend component may have a database of vulnerabilities for packages.

First claim

What is claimed is:

1. A method comprising:
obtaining, at a network controller and from one or more sensors running on one or more endpoints, real-time process information associated with at least one process executing on at least one of the one or more endpoints, wherein the network controller is communicatively connected to the one or more endpoints over a communication network;
determining, at the network controller, package information for a corresponding package associated with the at least one process based on the real-time process information; and
identifying, at the network controller and during runtime of the at least one process on the at least one of the one or more endpoints, at least one vulnerability associated with the package information using a database of vulnerabilities available only to the network controller.

2. The method of claim 1 , wherein the real-time process information includes an executable path and a filename for the at least one process.

3. The method of claim 1 , wherein the package information includes a package name, a package version and a package publisher.

4. The method of claim 1 , wherein the database of vulnerabilities is not stored at the endpoint.

5. The method of claim 1 , further comprising:
fixing the at least one vulnerability.

6. A non-transitory computer-readable medium comprising computer-readable instructions, which when executed by one or more processors at a network controller, cause the network controller to:
obtain, from one or more sensors running on one or more endpoints, real-time process information associated with at least one process executing on at least one of the one or more endpoints, wherein the network controller is communicatively connected to the one or more endpoints over a communication network;
determine package information for a corresponding package associated with the at least one process based on the real-time process information; and
identify, during runtime of the at least one process on the at least one of the one or more endpoints, at least one vulnerability associated with the package information using a database of vulnerabilities available only to the network controller.

7. The non-transitory computer-readable medium of claim 6 , wherein the real-time process information includes an executable path and a filename for the at least one process.

8. The non-transitory computer-readable medium of claim 6 , wherein the package information includes a package name, a package version and a package publisher.

9. The non-transitory computer-readable medium of claim 6 , wherein the database of vulnerabilities is not stored at the endpoint.

10. The non-transitory computer-readable medium of claim 6 , wherein the computer-readable instructions, which when executed by the one or more processors, cause the network controller to:
fix the at least one vulnerability.

11. A network controller comprising:
one or more processors storing computer-readable instructions; and
one or more processors configured to execute the computer-readable instructions to:
obtain, from one or more sensors running on one or more endpoints, real-time process information associated with at least one process executing on at least one of the one or more endpoints, wherein the network controller is communicatively connected to the one or more endpoints over a communication network;
determine package information for a corresponding package associated with the at least one process based on the real-time process information; and
identify, during runtime of the at least one process on the at least one of the one or more endpoints, at least one vulnerability associated with the package information using a database of vulnerabilities available only to the network controller.

12. The device of claim 11 , wherein the real-time process information includes an executable path and a filename for the at least one process.

13. The device of claim 11 , wherein the package information includes a package name, a package version and a package publisher.

14. The device of claim 11 , wherein the database of vulnerabilities is not stored at the endpoint.

15. The device of claim 11 , wherein the network controller is further configured to:
fix the at least one vulnerability.

Assignees

• Cisco Tech Inc

Inventors

• Vu Hai
• Nguyen Thanh Nhan
• Palkar Vaishali
• Malhotra Varun
• Chang Shih-Chun
• Liu Xin

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title