Real-time scanning of IP addresses

Patent metadata

Field	Value
Publication number	US-12177231-B2
Application number	US-202318477696-A
Country	US
Kind code	B2
Filing date	Sep 29, 2023
Priority date	Dec 15, 2015
Publication date	Dec 24, 2024
Grant date	Dec 24, 2024

Abstract

Examples of the present disclosure describe systems and methods of providing real-time scanning of IP addresses. In aspects, input may be received by a real-time IP scanning system. The system may generate one or more work orders based on the input. A scanner associated with the system may access a work order and attempt to communicate with one or more devices identified by the work order. If the attempted communication with a device is successful, a protocol analyzer may be used to provide a predefined payload to the device. If the response from the device matches an expected string, the device may be determined to be a safe and/or legitimate device. If the response from the device does not match an expected string, the device may be determined to be a malicious device.

First claim

What is claimed is:

1. A method for providing real-time scanning of IP addresses, the method comprising:
communicating with a computing device to obtain device indicator information from the computing device;
providing the device indicator information to a first machine learned model to obtain a selection of a payload, wherein the payload is configured for a particular device type of the computing device, and wherein the payload is configured to solicit an expected response from the particular device type; and
providing the selected payload to the computing device to solicit a response from the computing device.

2. The method of claim 1 , further comprising determining whether the payload response received from the computing device matches the expected response to the payload by providing the payload response to a second machine learned model and receiving from the second machine learned model an indication based on known data that the computing device is a malicious device.

3. The method of claim 1 , further comprising receiving target internet protocol (IP) information from a client device and identifying a computing device based on the target IP information, wherein receiving the target IP information from the client device comprises receiving a request from the client device via a user interface.

4. The method of claim 3 , wherein identifying the computing device in the target IP information comprises parsing the request received from the client device to identify the target IP information in the request.

5. The method of claim 4 , wherein identifying the computing device based on the target IP information further comprises generating one or more work orders and storing the one or more work orders in a work order queue.

6. The method of claim 5 , wherein identifying the computing device based on the target IP information comprises selecting a first one of the one or more work orders in the work order queue and processing the first one of the one or more work orders to identify the computing device.

7. The method of claim 1 , wherein the target IP information comprises at least one of an IP address, a port, a service and a protocol.

8. A system comprising:
a processor; and
memory coupled to the processor, the memory comprising computer executable instructions that, when executed by the processor, performs a method for providing real-time scanning of client devices, the method comprising:
communicating with a computing device to obtain device indicator information from the computing device;
providing the device indicator information to a first machine learned model to obtain a selection of a payload, wherein the payload is configured for a particular device type of the computing device, and wherein the payload is configured to solicit an expected response from the particular device type; and
providing the selected payload to the computing device to solicit a response from the computing device.

9. The system of claim 8 , wherein the computer executable instructions, when executed by the processor, further perform determining whether the payload response received from the computing device matches the expected response to the payload by providing the payload response to a second machine learned model and receiving from the second machine learned model an indication based on known data that the computing device is a malicious device.

10. The system of claim 8 , wherein the computer executable instructions, when executed by the processor, further perform receiving target internet protocol (IP) information from a client device and identifying a computing device based on the target IP information, wherein receiving the target IP information from the client device comprises receiving a request from the client device via a user interface.

11. The system of claim 10 , wherein identifying the computing device in the target IP information comprises parsing the request received from the client device to identify the target IP information in the request.

12. The system of claim 11 , wherein identifying the computing device based on the target IP information further comprises generating one or more work orders and storing the one or more work orders in a work order queue.

13. The system of claim 12 , wherein identifying the computing device based on the target IP information comprises selecting a first one of the one or more work orders in the work order queue and processing the first one of the one or more work orders to identify the computing device.

14. The system of claim 8 , wherein the target IP information comprises at least one of an IP address, a port, a service and a protocol.

15. A computer program product comprising a non-transitory computer-readable medium storing computer executable instructions that when executed cause a computing system to perform a method for providing real-time scanning of IP addresses, the method comprising:
communicating with a computing device to obtain device indicator information from the computing device;
providing the device indicator information to a first machine learned model to obtain a selection of a payload, wherein the payload is configured for a particular device type of the computing device, and wherein the payload is configured to solicit an expected response from the particular device type; and
providing the selected payload to the computing device to solicit a response from the computing device.

16. The computer program product of claim 15 , wherein the computer executable instructions, when executed by the computing system, further perform determining whether the payload response received from the computing device matches the expected response to the payload by providing the payload response to a second machine learned model and receiving from the second machine learned model an indication based on known data that the computing device is a malicious device.

17. The computer program product of claim 15 , wherein the computer executable instructions, when executed by the computing system, further perform receiving target internet protocol (IP) information from a client device and identifying a computing device based on the target IP information, wherein receiving the target IP information from the client device comprises receiving a request from the client device via a user interface.

18. The computer program product of claim 17 , wherein identifying the computing device in the target IP information comprises parsing the request received from the client device to identify the target IP information in the request.

19. The computer program product of claim 18 , wherein identifying the computing device based on the target IP information further comprises generating one or more work orders and storing the one or more work orders in a work order queue.

20. The computer program product of claim 19 , wherein identifying the computing device based on the target IP information comprises selecting a first one of the one or more work orders in the work order queue and processing the first one of the one or more work orders to identify the computing device.

Assignees

• Open Text Inc

Inventors

• Ho Huy Dang
• Lonas Hal
• Tran Trung

Classifications

• H04L61/2503

  Translation of Internet protocol [IP] addresses · CPC title

• H04L2101/668

  Internet protocol [IP] address subnets · CPC title

• H04L43/18

  Protocol analysers · CPC title

• H04L43/50

  Testing arrangements · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title