Method and apparatus for detecting events pertaining to potential change in vulnerability status
View Patent ↗Method and apparatus for Vulnerability Assessment techniques is disclosed. A method comprises detecting an event on a target in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, and an API. The event comprises a change in status of at least one of a network interface, a server network service, a client network service, and a port. An apparatus comprises a target having at least one of a deployed server network service, and a deployed client network service; and an agent deployed on the target, to detect an event on the target in real time or at periodic intervals. At least one of the agent and the VA server detect the event comprising a change in the status of at least one of a network interface, the server network service, the client network service, and a port.
1. A method comprising:
detecting an event on a target, in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, or an API, the event comprising a change in status of at least one of a network interface, a server network service, a client network service, or a port; and
conducting a test from at least one of a vulnerability assessment (VA) scanner, or a port scanner on the target based on the detecting,
wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed.
2. The method of claim 1 further comprising allocating an IP address to the network interface on the network interface becoming active, the IP address allocated using at least one of a DHCP protocol or via a DHCP agent.
3. The method of claim 1 , wherein the test from the VA scanner comprises at least one of
a test run from the VA scanner to identify the service running on a particular port on the target,
a test run from the VA scanner to find a vulnerability in the service running on a particular port on the target,
a test run from the VA scanner to identify a particular non-port based service running on the target,
a test run from the VA scanner to find a vulnerability in a particular non port based service running on the target,
a test run from the VA scanner to identify target characteristics comprising at least one of an operating system running on a target, a target name, a target IP address, a target DNS name, a target fully qualified domain name, or Common platform enumeration names matched on the target,
a test run from the port scanner used by or a part of the VA scanner, or
a test enabled from the VA scanner and run locally on the target.
4. The method of claim 1 , wherein a test from the port scanner comprises at least one of
a test run from the port scanner to determine the status of a port,
a test run from the port scanner to identify the service running on a particular port on the target, or
a test run from the port scanner to identify target characteristics comprising at least one of an operating system running on the target, a target name, a target IP address, a target DNS name, a target fully qualified domain name, or Common platform enumeration names matched on the target.
5. The method of claim 1 , wherein the VA scanner is a network-based VA scanner.
6. The method of claim 1 , wherein the server network service listens on an open port, or the server network service does not listen on a closed port.
7. The method of claim 1 further comprising determining that a potential change in the vulnerability status of the target has occurred based on detecting the occurrence of the event.
8. The method of claim 1 , wherein target is at least one of an enterprise computer, an enterprise mobile device, a consumer computer, or a consumer mobile device.
9. The method of claim 1 , wherein the target platform runs an operating system comprising at least one of a desktop operating system, a mobile operating system, or an embedded systems operating system.
10. An apparatus comprising:
a target having at least one of a deployed server network service, or a deployed client network service; and
an agent, deployed on the target, to detect an event on the target in real time or at periodic intervals,
wherein at least one of the agent or a vulnerability assessment (VA) server detect the event comprising a change in the status of at least one of a network interface, the server network service, the client network service, or a port,
wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed, and
wherein the VA server comprises at least one of a vulnerability assessment (VA) scanner or a port scanner, the VA server operably coupled with the target.
11. The apparatus of claim 10 , wherein the agent allocates an IP address to the network interface on the network interface becoming active, the IP address allocated using at least one of a DHCP protocol or via a DHCP agent.
12. The apparatus of claim 10 , wherein in response to the detection, the VA server conducts a test on the target from at least one of the vulnerability assessment (VA) scanner, or the port scanner.
13. The apparatus of claim 12 , wherein the test from the VA scanner comprises at least one of
a test run from the VA scanner to identify the service running on a particular port on the target,
a test run from the VA scanner to find a vulnerability in the service running on a particular port on the target,
a test run from the VA scanner to identify a particular non-port based service running on the target,
a test run from the VA scanner to find a vulnerability in a particular non port based service running on the target,
a test run from the VA scanner to identify target characteristics comprising at least one of an operating system running on a target, a target name, a target DNS name, a target fully qualified domain name, common platform enumeration names matched on the target, or a target IP address,
a test run from the port scanner used by or a part of the VA scanner, or
a test enabled from the VA scanner and run locally on the target.
14. The apparatus of claim 12 , wherein the test from the port scanner comprises at least one of
a test run from the port scanner to determine the status of a port,
a test run from the port scanner to identify the service running on a particular port on the target, or
a test run from the port scanner to identify target characteristics comprising at least one of an operating system running on the target, a target name, a target DNS name, a target fully qualified domain name, common platform enumeration names matched on the target, or a target IP address.
15. The apparatus of claim 12 , wherein the VA scanner is a network-based VA scanner.
16. The apparatus of claim 10 , wherein the server network service listens on an open port, or the server network service does not listen on a closed port.
17. The apparatus of claim 10 , wherein the target platform runs an operating system comprising at least one of a desktop operating system, a mobile operating system, or an embedded systems operating system.
18. The apparatus of claim 10 , wherein target is at least one of an enterprise computer, an enterprise mobile device, a consumer computer, or a consumer mobile device.
19. The apparatus of claim 10 , wherein upon detecting the event, at least one of the agent or the VA server determine that a potential change in the vulnerability status of the target has occurred.
20. The apparatus of claim 10 , wherein the agent detects the status, and the VA server detects the change in status.
21. The apparatus of claim 10 , wherein the VA server is deployed on the target.
22. A non-transitory computer readable storage medium for storing computer instructions that, when executed by at least one processor cause the at least one processor to perform a method comprising:
detecting an event on a target, in real time or at periodic intervals, by at least one of an OS service, an OS command, a hook, or an API,
the event comprising a change in status of at least one of a network interface, a server network service, a client network service, or a port; and
conducting a test from at least one of a vulnerability assessment (VA) scanner, or a port scanner on the target based on the detecting,
wherein the status of the network interface comprises the states active and inactive, the status of the network service comprises the states running and not running, and the status of the port comprises the states open and closed.