SYSTEMS AND METHODS FOR IDENTIFYING AND REPORTING APPLICATION AND FILE VULNERABILITIES
In various embodiments, a method comprises receiving a plurality of records from a first digital device, each of the plurality of records generated during execution or termination of a different executable and containing information related to execution or termination of the different executable, retrieving at least one segment from at least one of the plurality of records, the at least one segment being less than all of the at least one of the plurality of records, the segment including an application or file attribute related to the different executable, comparing the application or file attribute to a vulnerability database, identifying a risk based on the comparison, and generating a report identifying the risk.
1 . A method comprising:
receiving a plurality of records from a first digital device, each of the plurality of records generated during execution or termination of a different executable and containing information related to execution or termination of the different executable;
retrieving at least one segment from at least one of the plurality of records, the at least one segment being less than all of the at least one of the plurality of records, the segment including an application or file attribute related to the different executable;
comparing the application or file attribute to a vulnerability database;
identifying a risk based on the comparison; and
generating a report identifying the risk.
2 . The method of claim 1 wherein the plurality of records comprises log files associated with different executables.
3 . The method of claim 1 wherein the application or file attributes comprises an application or file version.
4 . The method of claim 1 wherein the application or file attributes comprises an execution time.
5 . The method of claim 1 wherein the application or file attributes comprises a calling process.
6 . The method of claim 1 further comprising:
identifying a type of the at least one of the plurality of records;
retrieving record information from a record information database based on the identified type of the at least one of the plurality of records; and
identifying a position of the at least one segment within the at least one of the plurality of records, wherein retrieving the at least one segment comprises retrieving the at least one segment from the identified position.
7 . The method of claim 1 further comprising scheduling when the comparison of the application or file attribute to the vulnerability database is to occur and waiting to compare the application or file attribute to the vulnerability database based on the schedule.
8 . The method of claim 1 further comprising authenticating the plurality of records, wherein the application or file attribute is compared to the vulnerability database only after successful authentication.
9 . The method of claim 1 wherein comparing the application or file attribute to a vulnerability database comprises comparing the application or file attribute to a whitelist.
10 . The method of claim 1 wherein comparing the application or file attribute to a vulnerability database comprises comparing the application or file attribute to a blacklist.
11 . The method of claim 1 wherein comparing the application or file attribute to a vulnerability database comprises comparing the application or file attribute to a greylist, the greylist comprising application or file attributes associated with suspicious applications or files.
12 . The method of claim 11 further comprising:
determining a risk value based on the comparison of the application or file attribute to the greylist; and
providing an alert based on the risk value.
13 . The method of claim 12 further comprising comparing the risk value to a user threshold wherein providing the alert based on the risk value comprises providing the alert based on the comparison.
14 . A system comprising:
a communication module configured to receive a plurality of records from a first digital device, each of the plurality of records generated during execution or termination of a different executable and containing information related to execution or termination of the different executable;
an information retrieval module configured to retrieve at least one segment from at least one of the plurality of records, the at least one segment being less than all of the at least one of the plurality of records, the segment including an application or file attribute related to the different executable;
an assessment module configured to compare the application or file attribute to a vulnerability database and identify a risk based on the comparison; and
a report module configured to generate a report identifying the risk.
15 . The system of claim 14 wherein the plurality of records comprises log files associated with different executables.
16 . The system of claim 14 wherein the application or file attributes comprises an application or file version.
17 . The system of claim 14 wherein the application or file attributes comprises an execution time.
18 . The system of claim 14 wherein the application or file attributes comprises a calling process.
19 . The system of claim 14 further comprising:
a record management module configured to identify a type of the at least one of the plurality of records; and
an information retrieval module configured to retrieve record information from a record information database based on the identified type of the at least one of the plurality of records; and identify a position of the at least one segment within the at least one of the plurality of records, wherein retrieving the at least one segment comprises retrieving the at least one segment from the identified position.
20 . The system of claim 14 further comprising an assessment scheduler configured to schedule when the comparison of the application or file attribute to the vulnerability database is to occur.
21 . The system of claim 14 further comprising a request authentication module configured to authenticate the plurality of records, wherein the application or file attribute is compared to the vulnerability database only after successful authentication.
22 . The system of claim 14 wherein the assessment module configured to compare the application or file attribute to the vulnerability database comprises the assessment module configured to compare the application or file attribute to a whitelist.
23 . The system of claim 14 wherein the assessment module configured to compare the application or file attribute to the vulnerability database comprises the assessment module configured to compare the application or file attribute to a blacklist.
24 . The system of claim 14 wherein the assessment module configured to compare the application or file attribute to the vulnerability database comprises the assessment module configured to compare the application or file attribute to a greylist, the greylist comprising application or file attributes associated with suspicious applications or files.
25 . The system of claim 24 further comprising:
an alert module configured to determine a risk value based on the comparison of the application or file attribute to the greylist and to provide an alert based on the risk value.
26 . The system of claim 25 wherein the alert module is further configured to compare the risk value to a user threshold.
27 . A computer readable medium comprising executable instructions, the instructions being executable by a processor to perform a method, the method comprising:
receiving a plurality of records from a first digital device, each of the plurality of records generated during execution or termination of a different executable and containing information related to execution or termination of the different executable;
retrieving at least one segment from at least one of the plurality of records, the at least one segment being less than all of the at least one of the plurality of records, the segment including an application or file attribute related to the different executable;
comparing the application or file attribute to a vulnerability database;
identifying a risk based on the comparison; and
generating a report identifying the risk.