Apparatus, system, and method for reconciling network discovered hosts across time
View Patent ↗An apparatus, systems, and methods for matching network assets that were previously discovered by a network vulnerability assessment to a not yet reconciled network vulnerability assessment, and allowing for the associating of network assets to their corresponding assessed hosts that were discovered as part of different point-in-time network vulnerability assessments.
1. A method for associating current hosts with hosts identified in the past, the method comprising:
receiving in computer memory a data structure representing first hosts, and one or more attributes, obtained with a network scanner, corresponding to each first host, wherein the one or more attributes corresponding to each first host include at least an Internet Protocol (IP) address;
receiving in the computer memory a data structure representing second hosts, and one or more attributes, obtained with the network scanner, corresponding to each second host, wherein the one or more attributes corresponding to each second host include at least an IP address, and the second hosts having been discovered during a point-in-time assessment completed by a first prior time;
receiving in the computer memory a set of matching rules;
executing a matching program to generate a data structure comprising comparison scores, where each comparison score is associated with a different pairing of one of the first hosts and one of the second hosts and is determined based on one or more of the matching rules and an analysis of two or more attributes, wherein at least one of the two or more attributes is an IP address, wherein at least one comparison score from the data structure comprising comparison scores is associated with a pairing of one of the first hosts and one of the second hosts that both correspond to a same physical device, and wherein the one of the first hosts and the one of the second hosts that both correspond to the same physical device each have a different value for a same corresponding attribute;
identifying an identical host in the first hosts and the second hosts, wherein identifying comprises comparing the comparison scores to each other to identify a comparison score, from the data structure comprising comparison scores, that is indicative of a possible match between the two hosts associated with the identified comparison score, and comparing the identified comparison score to a threshold, wherein the identified comparison score exceeding the threshold indicates that the two hosts associated with the identified comparison score are the same host;
determining that the two hosts associated with the identified comparison score correspond to the same physical device when the identified comparison score exceeds the threshold; and
generating a data structure associating at least some of the first hosts with at least some of the second hosts based on at least some of the comparison scores, wherein the data structure associating at least some of the first hosts with at least some of the second hosts is used for a network vulnerability assessment.
2. The method of claim 1 , where the matching rules are comprised of one or more host characteristics, a rule condition related to comparing a first host to a second host's characteristics for the same rule, and a numeric point value associated with the rule.
3. The method of claim 2 , where the comparison scores are comprised of a running total of numeric point values associated with multiple rules.
4. The method of claim 3 , further comprising:
sorting the data structure comprising comparison scores for pairings based on comparison score and associating first hosts to second hosts using a greedy algorithm.
5. The method of claim 3 , further comprising:
receiving in the computer memory a score threshold.
6. The method of claim 1 , where the matching program generates comparison scores for each potential pairing of first hosts and second hosts.
7. The method of claim 1 , where the data structure representing first hosts comprises data obtained by third party software.
8. The method of claim 1 , where the data structure representing second hosts comprises data obtained by third party software.
9. The method of claim 1 , comprising the additional steps of:
permitting the manual modification of the data structure associating first hosts with second hosts.
10. A method for associating current hosts with hosts identified in the past, the method comprising:
receiving in computer memory a data structure representing first hosts, and one or more attributes, obtained with a network scanner, corresponding to each first host, wherein the one or more attributes corresponding to each first host include at least an Internet Protocol (IP) address;
receiving in the computer memory a data structure representing second hosts, and one or more attributes, obtained with a network scanner, corresponding to each second host, wherein the one or more attributes corresponding to each second host include at least an IP address, and the second hosts having been discovered during a point-in-time assessment completed by a first prior time;
receiving in the computer memory a set of matching rules;
executing a matching program to generate a data structure comprising comparison scores, where each comparison score is associated with a different pairing of one of the first hosts and one of the second hosts and is determined based on one or more of the matching rules and an analysis of two or more attributes, wherein at least one of the two or more attributes is an IP address, the executing resulting in a total number of comparison scores equal to the number of first hosts multiplied by the number of second hosts, wherein at least one comparison score from the data structure comprising comparison scores is associated with a pairing of one of the first hosts and one of the second hosts that both correspond to a same physical device, and wherein the one of the first hosts and the one of the second hosts that both correspond to the same physical device each have a different value for a same corresponding attribute;
identifying an identical host in the first hosts and the second hosts, wherein identifying comprises comparing the comparison scores to each other to identify a comparison score, from the data structure comprising comparison scores, that is indicative of a possible match between the two hosts associated with the identified comparison score, and comparing the identified comparison score to a score threshold, wherein the identified comparison score exceeding the score threshold indicates that the two hosts associated with the identified comparison score are the same host;
determining that the two hosts associated with the identified comparison score correspond to the same physical device when the identified comparison score exceeds the threshold; and
generating a data structure associating at least some of the first hosts with at least some of the second hosts based on at least some of the comparison scores, wherein the data structure associating at least some of the first hosts with at least some of the second hosts is used for a network vulnerability assessment.
11. The method of claim 10 , where the matching rules are comprised of one or more host characteristics, a rule condition related to comparing a first host to a second host's characteristics for the same rule, and a numeric point value associated with the rule.
12. The method of claim 11 , where the comparison scores are comprised of a running total of numeric point values associated with multiple rules.
13. The method of claim 12 , further comprising:
sorting the comparison scores in the data structure comprising comparison scores, and associating first hosts to second hosts by applying a greedy algorithm to the sorted comparison scores.
14. The method of claim 12 , further comprising:
receiving in the computer memory a score threshold.
15. The method of claim 10 , where the matching program generates comparison scores for each potential pairing of first hosts and second hosts.
16. The method of claim 10 , where the data structure representing first hosts comprises data obtained by third party software.
17. The method of claim 10 , where the data structure representing second hosts comprises data obtained by third party software.
18. The method of claim 10 , comprising:
permitting the manual modification of the data structure associating first hosts with second hosts.
19. A method for associating current hosts with hosts identified in the past, the method comprising:
receiving in computer memory a data structure representing hosts identified in the past, and one or more attributes corresponding, obtained with a network scanner, to each host identified in the past, wherein the one or more attributes corresponding to each host identified in the past include at least an Internet Protocol (IP) address;
receiving in the computer memory a data structure representing current hosts discovered during a point-in-time assessment, and one or more attributes, obtained with a network scanner, corresponding to each current host, wherein the one or more attributes corresponding to each current host include at least an IP address;
receiving in the computer memory a set of matching rules;
executing a matching program to generate a data structure comprising comparison scores, where each comparison score is associated with a different pairing of one of the hosts identified in the past and one of the current hosts and is determined based on one or more of the matching rules and an analysis of two or more attributes, wherein at least one of the two or more attributes is an IP address, wherein at least one comparison score from the data structure comprising comparison scores is associated with a pairing of one of the hosts identified in the past and one of the current hosts that both correspond to a same physical device, and wherein the one of the hosts identified in the past and the one of the current hosts that both correspond to the same physical device each have a different value for a same corresponding attribute;
identifying an identical host in the hosts identified in the past and the current hosts, wherein identifying comprises comparing the comparison scores to each other to identify a comparison score, from the data structure comprising comparison scores, that is indicative of a possible match between the two hosts associated with the identified comparison score, and comparing the identified comparison score to a score threshold, wherein the identified comparison score exceeding the score threshold indicates that the two hosts associated with the identified comparison score are the same host;
determining that the two hosts associated with the identified comparison score correspond to the same physical device when the identified comparison score exceeds the score threshold; and
generating a data structure associating hosts identified in the past with current hosts based on at least some of the comparison scores, wherein the data structure associating hosts identified in the past with current hosts is used for a network vulnerability assessment.
20. The method of claim 19 , where the rules are comprised of one or more device characteristics, a rule condition related to comparing a host identified in the past to a current host's characteristics for the same rule, and a numeric point value associated with the rule.
21. The method of claim 20 , where the comparison scores are comprised of a running total of numeric point values associated with multiple rules.
22. The method of claim 21 , further comprising:
sorting the data structure comprising comparison scores for pairings based on comparison score and associating hosts identified in the past to current hosts using a greedy algorithm.
23. The method of claim 21 , further comprising:
receiving in the computer memory a score threshold.
24. The method of claim 19 , where the matching program generates comparison scores for each potential pairing of hosts identified in the past and current hosts.
25. The method of claim 19 , where the data structure representing hosts identified in the past comprises data obtained by third party software.
26. The method of claim 19 , where the data structure representing current hosts comprises data obtained by third party software.
27. The method of claim 19 , comprising:
permitting the manual modification of the data structure associating hosts identified in the past with current hosts.
28. A non-transitory computer-readable medium comprising computer-readable code that, when executed by a computer, causes the computer to perform operations comprising:
receiving in computer memory a data structure representing hosts identified in the past, and one or more attributes, obtained with a network scanner, corresponding to each host identified in the past, wherein the one or more attributes corresponding to each host identified in the past include at least an Internet Protocol (IP) address;
receiving in the computer memory a data structure representing current hosts discovered during a point-in-time assessment, and one or more attributes, obtained with a network scanner, corresponding to each current host, wherein the one or more attributes corresponding to each current host include at least an IP address;
receiving in the computer memory a set of matching rules;
executing a matching program to generate a data structure comprising comparison scores, where each comparison score is associated with a different pairing of one of the hosts identified in the past and one of the current hosts and is determined based on one or more of the matching rules and an analysis of two or more attributes, wherein at least one of the two or more attributes is an IP address, wherein at least one comparison score from the data structure comprising comparison scores is associated with a pairing of one of the hosts identified in the past and one of the current hosts that both correspond to a same physical device, and wherein the one of the hosts identified in the past and the one of the current hosts that both correspond to the same physical device each have a different value for a same corresponding attribute;
identifying an identical host in the hosts identified in the past and the current hosts, wherein identifying comprises comparing the comparison scores to each other to identify a comparison score, from the data structure comprising comparison scores, that is indicative of a possible match between the two hosts associated with the identified comparison score, and comparing the identified comparison score to a score threshold, wherein the identified comparison score exceeding the score threshold indicates that the two hosts associated with the identified comparison score are the same host;
determining that the two hosts associated with the identified comparison score correspond to the same physical device when the identified comparison score exceeds the score threshold; and
generating a data structure associating hosts identified in the past with current hosts based on at least some of the comparison scores, wherein the data structure associating hosts identified in the past with current hosts is used for a network vulnerability assessment.
29. The non-transitory computer-readable medium of claim 28 , further comprising computer-readable code that, when executed by a computer, causes the computer to perform operations comprising:
receiving in the computer memory rules comprised of one or more host characteristics, a rule condition related to comparing a host identified in the past with a current host's entity characteristics for the same rule, and a numeric point value associated with the rule.
30. The non-transitory computer-readable medium of claim 29 , where the comparison scores are comprised of a running total of numeric point values associated with multiple rules.
31. The non-transitory computer-readable medium of claim 30 , further comprising computer readable code that, when executed by a computer, causes the computer to perform operations comprising:
sorting the comparison scores in the data structure comprising comparison scores, and associating first hosts to second hosts by applying a greedy algorithm to the sorted comparison scores.
32. The non-transitory computer-readable medium of claim 30 , further comprising computer readable code that, when executed by a computer, causes the computer to perform operations comprising:
receiving in the computer memory a score threshold.
33. The non-transitory computer-readable medium of claim 28 , where the matching program generates comparison scores for each potential pairing of hosts identified in the past and current hosts.
34. The non-transitory computer-readable medium of claim 28 , where the data structure representing hosts identified in the past comprises data obtained by third party software.
35. The non-transitory computer-readable medium of claim 28 , where the data structure representing current hosts comprises data obtained by third party software.
36. A computer system configured to associate current hosts with hosts identified in the past, the computer system comprising:
a computer processor in communication with computer memory, the computer processor being configured to:
receive a data structure representing first hosts, and one or more attributes, obtained with a network scanner, corresponding to each first host, wherein the one or more attributes corresponding to each first host include at least an Internet Protocol (IP) address;
receive a data structure representing second hosts, and one or more attributes, obtained with a network scanner, corresponding to each second host, wherein the one or more attributes corresponding to each second host include at least an IP address, and the second hosts having been discovered during a point-in-time assessment completed by a first prior time;
receive a set of matching rules;
execute a matching program to generate a data structure comprising comparison scores, where each comparison score is associated with a different pairing of one of the first hosts and one of the second hosts and is determined based on one or more of the matching rules and an analysis of two or more attributes, wherein at least one of the two or more attributes is an IP address, wherein at least one comparison score from the data structure comprising comparison scores is associated with a pairing of one of the first hosts and one of the second hosts that both correspond to a same physical device, and wherein the one of the first hosts and the one of the second hosts that both correspond to the same physical device each have a different value for a same corresponding attribute;
identify an identical host in the first hosts and the second hosts, wherein identifying comprises comparing the comparison scores to each other to identify a comparison score, from the data structure comprising comparison scores, that is indicative of a possible match between the two hosts associated with the identified comparison score, and comparing the identified comparison score to a score threshold, wherein the identified comparison score exceeding the score threshold indicates that the two hosts associated with the identified comparison score are the same host;
determine that the two hosts associated with the identified comparison score correspond to the same physical device when the identified comparison score exceeds the score threshold; and
generate a data structure associating at least some of the first hosts with at least some of the second hosts based on at least some of the comparison scores, wherein the data structure associating at least some of the first hosts with at least some of the second hosts is used for a network vulnerability assessment.