Patent ID: 11936748
Assignee: CENSYS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A method, comprising:
performing, by one or more discovery components of a continuous scanning engine with automatic protocol detection, a transport-layer scan process comprising:
sending initial packets to a plurality of ports at a plurality of network addresses of a network;
receiving responses to a least some of the initial packets;
asynchronously matching the received responses to the sent initial packets;
determining that at least some of the ports at at least some of the network addresses corresponding to the matched received responses require further analysis; and
providing information comprising the at least some ports and the at least some network addresses to one or more protocol inspection components of the continuous scanning engine with automatic protocol detection;

performing, based at least in part on a completion of the transport-layer scan process, the transport-layer scan process again; and
performing by the one or more protocol inspection components of the continuous scanning engine with automatic protocol detection:
attempting to communicate with the at least some ports of the at least some network addresses using a plurality of different application-layer communication protocols;
determining that at least one of the attempted application-layer communication protocols resulted in a successful communication with a service executing on at least one port of at least one network address and the successful communication elicited information about the service from the service;
storing an inspection record in a database, wherein the inspection record indicates the at least one port, the at least one network address, the at least one attempted application-layer communication protocol that resulted in the successful communication, and the information elicited from the service; and
periodically performing a refresh of the inspection record, wherein the refresh includes attempting another communication with the at least one port using the application-layer communication protocol indicated in the record to determine whether the service is still present on the at least one port and the information elicited from the service has changed.