Patent ID: 11936748
Assignee: CENSYS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 15:
16. One or more non-transitory computer-readable storage media storing program instructions, that when executed on or across one or more processors of continuous scanning engine with automatic protocol detection, cause the one or more processors to perform a transport-layer scan process comprising:
send initial packets to a plurality of ports at a plurality of network addresses of a network;
receive responses to a least some of the initial packets;
asynchronously match the received responses to the sent initial packets;
determine that at least some of the ports at at least some of the network addresses corresponding to the matched received responses require further analysis;
provide information comprising the at least some ports and the at least some network addresses to a protocol inspection component of the continuous scanning engine; and
wherein, based at least in part on the transport-layer scan process completing, the program instructions cause the one or more processors to perform the transport-layer scan process again; and
wherein the program instructions, when executed on or across the one or more processors of the protocol inspection component of the continuous scanning engine, cause the one or more processors to:
attempt to communicate with the at least some ports of the at least some network addresses using a plurality of different application-layer communication protocols;
determine that at least one of the attempted application-layer communication protocols resulted in a successful communication with a service executing on at least one port of at least one network address and the successful communication elicited information about the service from the service;
store an inspection record in a database, wherein the inspection record indicates the at least one port, the at least one network address, the at least one attempted application-layer communication protocol that resulted in the successful communication, and the information elicited from the service; and
periodically perform a refresh of the inspection record, wherein the refresh includes attempting another communication with the at least one port using the application-layer communication protocol indicated in the record to determine whether the service is still present on the at least one port and the information elicited from the service has changed.