Patent ID: 12231455

DETAILED DESCRIPTION

The examples set forth below represent the information to enable individuals to practice the examples and illustrate the best mode of practicing the examples. Upon reading the following description in light of the accompanying drawing figures, individuals will understand the concepts of the disclosure and will recognize applications of these concepts not particularly addressed herein. It should be understood that these concepts and applications fall within the scope of the disclosure and the accompanying claims.

Any flowcharts discussed herein are necessarily discussed in some sequence for purposes of illustration, but unless otherwise explicitly indicated, the examples are not limited to any particular sequence of steps. The use herein of ordinals in conjunction with an element is solely for distinguishing what might otherwise be similar or identical labels, such as “first message” and “second message,” and does not imply an initial occurrence, a quantity, a priority, a type, an importance, or other attribute, unless otherwise stated herein. As used herein and in the claims, the articles “a” and “an” in reference to an element refers to “one or more” of the element unless otherwise explicitly specified. The word “or” as used herein and in the claims is inclusive unless contextually impossible. As an example, the recitation of A or B means A, or B, or both A and B. The word “data” may be used herein in the singular or plural depending on the context.

As used herein, the term “vulnerability” refers to any risk, non-compliance, or other undesirable artifact. For instance, a vulnerability may include any weakness which may allow an attacker to reduce a system's security. In another instance, the vulnerability may be a flaw in a physical or software based structure or any weakness in design, implementation, operation, or internal control. Further non-limiting examples of vulnerabilities may include one or more of backdoors, overflow vulnerabilities, software vulnerabilities (e.g., old versions, obsolete software, software bugs, etc.), viruses, trojan horses, spyware, default or weak passwords, insecure network architecture, and hardware vulnerabilities (e.g., unauthorized devices, obsolete devices, incompatible devices, malfunctioning devices, protocol weaknesses, etc.), brute force attacks, web applications vulnerabilities (e.g. buffer overflow, directory traversal, etc.), DNS and BIND vulnerabilities, database vulnerabilities (e.g., weak password, guessed name, default logins, default accounts, etc.), operating system vulnerabilities (e.g., patches, versions, etc.), e-commerce vulnerabilities (e.g., security, encryption, form manipulation, etc.), FTP vulnerabilities, firewall vulnerabilities (e.g., open ports, DNS, admin ports, etc.), remote services, etc.

As used herein, the term “target device” refers to a device that is reachable by a network vulnerability scanning system. More specifically, the network vulnerability scanning system can send a request (e.g., ping command) over a network and the target device can respond to the request. It should be understood that the target device and the network vulnerability scanning system are under common control (that is, controlled by the same entity).

As used herein, the term “hidden network system” as used herein refers to a network system that is unreachable by the network vulnerability scanning system. More specifically, a request (e.g., ping command) sent by the network vulnerability scanning system will not be received by the hidden network system and therefore the hidden network system is unreachable by the network vulnerability scanning system.

As used herein, the term “network interface” refers to a physical or virtual port that establishes a network connection between the target device and another system (e.g., network vulnerability scanning system, hidden network system, etc.).

Example aspects of the present disclosure are directed to vulnerability scanning. A network vulnerability scanning system can perform a vulnerability scan (e.g., credentialed vulnerability scan) of a target device. As part of the vulnerability scan, the network vulnerability scanning system can obtain network connection data for the target device. The network connection data can, for example, include a list of network connections between the target device and other devices/networks. In some instances, the network connection data can include a network connection between the target device and a hidden network system that is unreachable by the network vulnerability scanning system. It should be appreciated that the target device can include a plurality of network interfaces (e.g., physical ports and/or virtual ports) and a respective network interface of the plurality of network interfaces can establish the network connection between the target device and the hidden network system. It should also be appreciated that the security of the target device can be compromised since the target device is connected to the hidden network system that is unreachable by the network vulnerability scanning system and therefore cannot be scanned by the network vulnerability scanning system.

Example aspects of the present disclosure are directed to vulnerability scanning the hidden network system. The network vulnerability scanning system can be configured to install a network scanning application on the target device in response to determining the network connection data for the target device includes the network connection between the target device and the hidden network system.

In some implementations, the network scanning application can receive one or more commands (e.g., application programming interface (API) calls) from the network vulnerability scanning system and requests data from the hidden network system based, at least in part, on the received command(s). The hidden network system can communicate the requested data to the network scanning application. The network scanning application can then communicate the requested data to the network vulnerability scanning system.

In some implementations, the network vulnerability scanning system can be configured to compare requested data from the hidden network system to a plurality of different vulnerability signatures. For instance, the network vulnerability scanning system can be configured to determine the hidden network system has a vulnerability if the requested data from the hidden network system corresponds (e.g., matches) to one of the plurality of different vulnerability signatures.

In some implementations, the network vulnerability scanning system can be configured to uninstall network scanning application on the target device subsequent to scanning the hidden network system for vulnerabilities via the network scanning application. For instance, in some implementations, the network vulnerability scanning system can send one or more commands to the target device to stop executing the network scanning application and delete the network scanning application from memory of the target device. In this manner, memory space on the target device can be conserved and can accommodate other applications specific to the target device.

In some implementations, the network scanning application can be permanently installed on the device. In such implementations, the network scanning application can be executed continuously or at regular intervals to provide real-time or near real-time scanning of the previously identified hidden network system or other hidden network systems that may connect to the target device over time.

In some implementations, the target device can include a network interface that functions as a feedback loop to identify additional network connections established after current network connections for the target device have been scanned for vulnerabilities. More specifically, additional network connection data for the target device can be provided to the network vulnerability scanning system via the network interface. In this manner, the network vulnerability scanning system can automatically scan the additional network connections for vulnerabilities.

Example aspects of the present disclosure can provide numerous technical effects and benefits. For instance, installing the network scanning application on the target device can allow the network vulnerability scanning system to scan a hidden network system that is connected to the target device and otherwise unreachable by the network vulnerability scanning system. In this manner, security of the target device can be improved, because the network vulnerability scanning system can scan the hidden network system for vulnerabilities via the network scanning application installed on the target device.

Referring now to the FIGS.,FIG.1depicts a system100for vulnerability scanning hidden network systems according to some implementations of the present disclosure. The system100can include a network vulnerability scanning system102that includes one or more computing devices104. The computing device(s)104can include one or more processors106and one or more memory devices108. The memory device(s)108can be configured to store a vulnerability scan application110.

In some implementations, the memory device(s)108can be further configured to store a plurality of different vulnerability signatures112. In alternative implementations, the network vulnerability scanning system102can include a database (not shown) configured to store the plurality of different vulnerability signatures112. In such implementations, the computing device(s)104can be communicatively coupled to the database.

The system100can further include a target device120that is reachable by the network vulnerability scanning system102. In some implementations, the target device120can be a router. It should be understood, however, that the target device120can include any suitable device capable of communicating with one or more devices over a network (e.g., wired or wireless).

Since the target device120is reachable by the network vulnerability scanning system102, the network vulnerability scanning system102can perform a vulnerability scan of the target device120. More specifically, the computing device(s)104of the network vulnerability scanning system102can execute the vulnerability scan application110to scan the target device120for vulnerabilities.

It should be appreciated that, in some implementations, the network vulnerability scanning system102can perform a credentialed vulnerability scan of the target device120. In this manner, the network vulnerability scanning system102can obtain data (e.g., system files) associated with the target device120that could not be obtained by performing a non-credentialed vulnerability scan of the target device120.

By performing the vulnerability scan of the target device120, the network vulnerability scanning system102can obtain network connection data for the target device120. In some implementations, the network connection data can include a list of internet protocol (IP) addresses of devices and/or network systems currently connected to the target device120. For example, the network connection data for the target device120can include an IP address for one or more hidden network systems130that are not reachable by the network vulnerability scanning system102. Therefore, the network vulnerability scanning system102can determine a network connection exists between the target device120and the hidden network system(s)130.

The network vulnerability scanning system102can be configured to install a network scanning application122on the target device120in response to determining the network connection between the target device120and the hidden network system(s)130. For instance, the network scanning application122can be machine-readable instructions that the network vulnerability scanning system102can communicate to the target device120. In some implementations, the target device120can include one or more memory devices124configured to store the network scanning application122. Furthermore, the target device120can include one or more processors126configured to execute the network scanning application122.

Once the network scanning application122is installed on the target device120, the network vulnerability scanning system102can perform a vulnerability scan of the hidden network system(s)130via the target device120, specifically the network scanning application122executing thereon. For instance, in some implementations, the network scanning application122can be an application programming interface (API) that receives commands (e.g., application programming interface (API) calls) from the network vulnerability scanning system102and requests data from the hidden network system(s)130based, at least in part, on the received commands.

The network scanning application122can configure the target device120to communicate the data received from the hidden network system(s)130to the network vulnerability scanning system102. In this manner, the network vulnerability scanning system102can process the data received from the hidden network system(s)130via the network scanning application122executing on the target device120to determine one or more vulnerabilities of the hidden network system(s)130.

In some implementations, the network vulnerability scanning system102can compare the data received from the hidden network system(s)130to the plurality of different vulnerability signatures112. For instance, the network vulnerability scanning system102can be configured to determine vulnerabilities exist on the hidden network system(s)130if the data received from the hidden network system(s)130corresponds (e.g., matches) one of the plurality of different vulnerability signatures112. It should be appreciated, however, that the scope of the present disclosure can include any suitable manner known in the art for determining whether the data received from the hidden network system(s)130is representative of one or more vulnerabilities.

Referring now toFIG.2, a flow diagram of an example method200for vulnerability scanning a hidden network system is provided according to some implementations of the present disclosure. The method200can be implemented by the system100discussed above with reference toFIG.1.FIG.2depicts steps performed in a particular order for purposes of illustration and discussion. Those of ordinary skill in the art, using the disclosure provided herein, will understand that various steps of the method200may be adapted, modified, rearranged, performed simultaneously, or modified in various ways without deviating from the scope of the present disclosure.

At (202), the method200includes obtaining network connection data for the target device120. For instance, in some implementations, the network vulnerability scanning system102can perform a credentialed vulnerability scan of the target device120to obtain the network connection data for the target device120. In some implementations, the network connection data can include a plurality of different internet protocol (IP) addresses for devices/systems that are connected to the target device120.

At (204), the method200includes determining the network connection data obtained at (202) includes a network connection between the target device120and one or more of the hidden network systems130. For instance, in some implementations, the network vulnerability scanning system102can be configured to compare the plurality of IP addresses included in the network connection data obtained at (202) to a list of IP addresses of network systems that are reachable by the network vulnerability scanning system102. If the network vulnerability scanning system102determines one or more of the IP addresses included in the network connection data obtained at (202) is not included in the list of IP addresses to which the network vulnerability scanning system has connectivity with, the method200proceeds to (206). Otherwise, the method200reverts to (202).

At (206), the method200includes installing the network scanning application122on the target device120. For instance, in some implementations, the network vulnerability scanning system102can install the network scanning application122on the target device120on the fly. In such implementations, the network scanning application122can be machine-readable instructions included in one or more data packets the network vulnerability scanning system102communicates to the target device120over a wired or wireless connection.

At (208), the method200includes scanning the hidden network system(s)130via the network scanning application122installed on the target device120at (206). In some implementations, the network vulnerability scanning system102can communicate one or more commands (e.g., a first data packet) to the target device120. The network scanning application122installed on the target device120can cause the target device120to request data from the hidden network system(s)130. The hidden network system(s)130can communicate the requested data (e.g., second data packet) to the target device120. The network scanning application122can configure the target device120to communicate the requested data to the network vulnerability scanning system102.

At (210), the method200includes determining the hidden network system has one or more vulnerabilities based, at least in part, on the scan performed at (208). In some implementations, the network vulnerability scanning system can compare the requested data (e.g., second data packet) obtained from the hidden network system(s)130to a plurality of different vulnerability signatures. If the data obtained from the hidden network system(s)130corresponds to one of the plurality of vulnerability signatures, the method200can proceed to (212). Otherwise, the method200can proceed to (214).

At (212), the method200includes performing one or more control actions in response to determining, at (210), one or more vulnerabilities of the hidden network system(s)130. For instance, in some implementations, the determined vulnerability of the hidden network system(s)130can be an outdated version of a software application executing on the hidden network system(s)130that compromises the security of the hidden network system(s)130as well as the target device120to which the hidden network system(s)130are currently connected. In such implementations, the one or more control actions performed by the network vulnerability scanning system102at (212) can include providing a software update to the hidden network system(s)130via the network scanning application122installed on the target device120. The software update can be associated with updating the software application to the most-recent version of the software application to resolve the security threat to the hidden network system(s)130and the target device120.

In some implementations, the one or more control actions can include generating a notification indicative of one or more vulnerabilities of the hidden network systems(s)130. For instance, the notification can be an electronic notification (e.g., email, short message service (SMS) text, etc.). The electronic notification can prompt a user (e.g., IT specialist) to perform one or more maintenance actions on the hidden network system(s)130to resolve the one or more vulnerabilities of the hidden network system(s)130. It should be appreciated that the method200can proceed to (214) after performing the one or more control actions at (212).

At (214), the method200can continue. In some implementations, the method200can include uninstalling the network scanning application122from the target device120. For instance, in some implementations, the network vulnerability scanning system102can communicate one or more commands to the target device120to prompt the target device120to remove the network scanning application122from the memory device(s)124of the target device120. In this manner, available space of the memory device(s)124can be increased to accommodate other applications that are specific to the target device120.

In some implementations, the method200can, at (214), revert to (202) and can perform a vulnerability scan of the target device120to obtain network connection data for the target device120. In this manner, the target device120can be scanned to check to see if an additional hidden network system has connected to the target device120since the most-recent scan of the target device120.

Referring now toFIG.3, a system diagram of a feedback loop between the network vulnerability scanning system102and the target device120is provided according to some implementations of the present disclosure. The network vulnerability scanning system102can scan the target device120for initial network connection data via a first network interface300of the target device120to obtain initial network connection data for the target device120. The initial network connection data can include one or more initial network connections between the target device and one or more of the plurality of hidden network systems130(FIG.1). For instance, the initial network connections can include a connection between the target device120and a first hidden network system310. More specifically, the connection between the target device120and the first hidden network system310can be established via a second network interface302of the target device120that is different from the first network interface300.

After the initial vulnerability scan of the target device120is performed to obtain the initial network connection data for the target device120, the network vulnerability scanning system102can, as discussed above with reference toFIGS.1and2, install the network scanning application122(FIG.1) on the target device120and scan the initial network connection(s) for vulnerabilities. For instance, the network scanning application122can scan the second network interface302of the target device120for vulnerabilities of the first hidden network system310.

It should be appreciated that additional hidden network systems130(FIG.1) can connect to the target device120after the initial network connections after scanned for vulnerabilities. For instance, an additional network connection can be established between the target device120and a second hidden network system312of the plurality of hidden network systems130via a third network interface304of the target device120that is different from both the first network interface300and the second network interface302. The first network interface300establishing the network connection between the network vulnerability scanning system102and the target device120can provide a feedback loop for communicating data indicative of the additional network connections for the target device120to the network vulnerability scanning system102. In this manner, the network vulnerability scanning system102can be configured to automatically scan the additional network connections for vulnerabilities and can therefore improve the security of the target device120against vulnerabilities of hidden network systems130that connect to the target device120. For instance, the network scanning application installed on the target device120can scan the third network interface304of the target device120for vulnerabilities of the second hidden network system312that connected to the target device120after the previous vulnerability scan of the initial network connections (e.g., first hidden network system310).

Referring now toFIG.4, a flow diagram of an example method400for vulnerability scanning hidden network systems connected to a target device is provided according to some implementations of the present disclosure. The method400can be implemented by the system100discussed above with reference toFIGS.1and3.FIG.4depicts steps performed in a particular order for purposes of illustration and discussion. Those of ordinary skill in the art, using the disclosure provided herein, will understand that various steps of the method400may be adapted, modified, rearranged, performed simultaneously, or modified in various ways without deviating from the scope of the present disclosure.

At (402), the method400can include scanning the target device120for vulnerabilities to obtain initial network connection data for the target device120via the first network interface300of the target device120. The initial network connection data can include an initial network connection between the target device120and the first hidden network system310of the plurality of hidden network systems130. It should be appreciated that the initial network connection between the target device120and the first hidden network system310can be established via the second network interface302of the target device120.

At (404), the method400can include installing a network scanning application on the target device. At (406), the method400includes scanning the initial network connection for vulnerabilities via the network scanning application122installed on the target device120at (404). More specifically, the network vulnerability scanning system102can scan the second network interface302for vulnerabilities of the first hidden network system310.

At (408), the method400can include obtaining additional network connection data for the target device120via the first network interface300of the target device120. It should be appreciated that the additional network connection data can be obtained subsequent to scanning the initial network connection for vulnerabilities at (406). The additional network connection data can include an additional network connection between the target device120and the second hidden network system312of the plurality of hidden network systems130. It should be appreciated that the additional network connection can be established via the third network interface304of the target device120.

At (410), the method400can include scanning the additional network connection for vulnerabilities via the network scanning application122installed on the target device120at (404). More specifically, the network vulnerability scanning system102can scan the third network interface304for vulnerabilities of the second hidden network system312.

Individuals will recognize improvements and modifications to the preferred examples of the disclosure. All such improvements and modifications are considered within the scope of the concepts disclosed herein and the claims that follow.