System and method for detecting vulnerability state deltas

Patent metadata

Field	Value
Publication number	US-9900333-B2
Application number	US-201514614920-A
Country	US
Kind code	B2
Filing date	Feb 5, 2015
Priority date	Feb 5, 2015
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

Described herein is a system and method for detecting vulnerability state deltas, the method comprising the steps of: receiving data related to a network connected device; determining a vulnerability state of the network connected device based upon the data; storing the vulnerability state in a vulnerability state database; receiving additional data related to the network connected device; determining an updated vulnerability state of the network connected device based upon the additional data; determining one or more deltas based upon differences between the vulnerability stare and the updated vulnerability state; and updating the stored vulnerability state with the updated vulnerability state.

First claim

What is claimed is:

1. A method for detecting vulnerability state deltas comprising the steps of:
receiving first and second data related to a device connected to a network, wherein the first data is received from a first source, and wherein the second data is received from a second source;
combining the first and second data to generate first combined data;
identifying a first overlap in the first combined data, wherein a first data entry of the first data conflicts with a second data entry of the second data in the first combined data;
resolving the first overlap by:
determining that the first source is more reliable than the second source based upon the first source being located within the network and the second source being located external to the network; and
including the first data entry in the first combined data and not including the second data entry in the first combined data;

determining a first vulnerability state of the device based upon the first combined data;
storing the first vulnerability state in a vulnerability state database;
receiving third and fourth data related to the device, wherein the third data is received from a third source, and wherein the fourth data is received from a fourth source;
combining the third and fourth data to generate second combined data;
identifying a second overlap in the second combined data, wherein a third data entry of the third data conflicts with a fourth data entry of the fourth data in the second combined data;
resolving the second overlap by:
determining that the third source is more reliable than the fourth source based upon the third source being located within the network and the fourth source being located external to the network; and
including the third data entry in the second combined data and not including the fourth data entry in the second combined data;

determining a second vulnerability state of the device based upon the second combined data;
storing the second vulnerability state in the vulnerability state database; and
detecting a vulnerability state delta for the device based upon determining a difference between the first vulnerability state and the second vulnerability state.

2. The method of claim 1 , wherein each of the first and third sources comprises one or more of a collector and an agent, and each of wherein the second and fourth sources comprise web scanners.

3. The method of claim 1 , further comprising:
determining the first data and the second data both describe a resource of the device.

4. The method of claim 1 further comprising:
determining the third data and the fourth data both describe a resource of the device.

5. The method of claim 1 , wherein the first source is the same as the third source, and wherein the second source is the same as the fourth source.

6. The method of claim 1 further comprising:
creating a notification in response to detecting the vulnerability state delta, wherein the notification identifies the vulnerability state delta; and
transmitting the notification.

7. The method of claim 1 , wherein the third and fourth data is received in a pseudo-continuous fashion, wherein the second vulnerability state is determined in a pseudo-continuous fashion, and wherein the vulnerability state delta is detected in a pseudo-continuous fashion.

8. The method of claim 1 , wherein each of the first, second, third, and fourth data comprises information descriptive of vulnerabilities associated with the device or a current state of the device.

9. The method of claim 1 , wherein at least one of the first, second, third, and fourth data is received in response to scanning the device.

10. The method of claim 1 , wherein storing the second vulnerability state in the vulnerability state database comprises overwriting the first vulnerability state with the second vulnerability state in the vulnerability state database.

11. A device for detecting vulnerability state deltas comprising:
a memory; and
a processor configured to:
receive first and second data related to a device connected to a network, wherein the first data is received from a first source, and wherein the second date is received from a second source;
combine the first and second data to generate first combined data;
identify a first overlap in the first combined data, wherein a first data entry of the first data conflicts with a second data entry of the second data in the first combined data;
resolve the first overlap by:
determining that the first source is more reliable than the second source based upon the first source being located within the network and the second source being located external to the network; and
including the first data entry in the first combined data and not including the second data entry in the first combined data;

determine a first vulnerability state of the device based upon the first combined data;
store the first vulnerability state in a vulnerability state database;
receive third and fourth data related to the network connected device, wherein the third data is received from a third source, and wherein the fourth data is received from a fourth source;
combine the third and fourth data to generate second combined data;
identify a second overlap in the second combined data, wherein a third data entry of the third data conflicts with a fourth data entry of the fourth data in the second combined data;
resolve the second overlap by:
determining that the third source is more reliable than the fourth source based upon the third source being located within the network and the fourth source being located external to the network; and
including the third data entry in the second combined data and not including the fourth data entry in the second combined data;

determine a second vulnerability state of the device based upon the second combined data;
storing the second vulnerability state in the vulnerability state database; and
detecting a vulnerability state delta based upon determining a difference between the first vulnerability state and the second vulnerability state.

12. The device of claim 11 , wherein each of the first and third sources comprises one or more of a collector and an agent, and wherein each of the second and fourth sources comprises web scanners.

13. The device of claim 11 , wherein the processor is further configured to:
determine the first data and the second data both describe a resource of the device.

14. The device of claim 11 , wherein the processor is further configured to:
determine the third data and the fourth data both describe a resource of the device.

15. The device of claim 11 , wherein the first source is the same as the third source, and wherein the second source is the same as the fourth source.

16. The device of claim 11 , wherein the processor is further configured to:
create a notification in response to detecting the vulnerability state delta, wherein the notification identifies the vulnerability state delta; and
transmit the notification.

17. The device of claim 11 , wherein the third and fourth data is received in a pseudo-continuous fashion wherein the second vulnerability state is determined in a pseudo-continuous fashion, and wherein the vulnerability state delta is detected in a pseudo-continuous fashion.

18. The device of claim 11 , wherein each of the first, second, third, and fourth data comprises information descriptive of vulnerabilities associated with the device or a current state of the device.

19. The device of claim 11 , wherein at least

Assignees

• Qualys Inc

Inventors

• Thakar Sumedh
• Patel Bharat
• Venkatesan Balaji
• Burch Tristan
• Molloy Sean M
• Wirges Matthew L

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title