System and method for monitoring network vulnerabilities

1. A method for managing network vulnerabilities, comprising:

transmitting a callback from a network controller and to a network element, wherein the callback comprises executable code configured to cause the network element to transmit a filesystem manifest to the network controller;

obtaining, in response to executing the callback on the network element, image data from the filesystem manifest, wherein the image data identifies a filesystem key in the filesystem manifest that corresponds to a first software container among a plurality of software containers, and wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the network element;

determining, using the filesystem key that is identified from the image data, a first software vulnerability of a first software image, the first software image being used to generate the first software container;

and

generating, using the first software vulnerability and the filesystem key, a vulnerability map of a network,

wherein the vulnerability map describes a plurality of software vulnerabilities arranged according to a plurality of filesystem keys used on the network.

2. The method of claim 1 , further comprising:

determining the plurality of filesystem keys associated with an endpoint in the network; and

determining, using the vulnerability map and the plurality of filesystem keys, one or more software vulnerabilities corresponding to the endpoint.

3. The method of claim 1 , further comprising:

obtaining vulnerability information regarding a second software image, wherein the vulnerability information describes a second software vulnerability; and

identifying, using the vulnerability map, a second software container that has the second software vulnerability.

4. The method of claim 1 ,

wherein determining the first software vulnerability comprises:

determining a version of the first software image; and

obtaining, from a software vulnerability data source, common vulnerability and exposure (CVE) data based on the version of the software image.

5. The method of claim 1 ,

wherein the filesystem key is a secured hash algorithm key for a secured layer of the filesystem comprising a plurality of secured layers.

6. A system for managing network vulnerabilities, comprising:

a plurality of hardware network elements comprising:

a first hardware network element, and

a second hardware network element; and

a network controller operating on a third hardware network element, wherein the network controller is configured to:

transmit a callback to the first hardware network element, wherein the callback comprises executable code configured to cause the first hardware network element to transmit a filesystem manifest to the network controller;

obtain, in response to executing the callback on the first hardware network element, image data from the filesystem manifest, wherein the image data identifies a filesystem key in the filesystem manifest that corresponds to a first software container among a plurality of software containers, and wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the hardware network element;

determine, using the filesystem key that is identified from the image data, a first software vulnerability of a first software image, the first software image being used to generate the first software container;

and

generate, using the first software vulnerability and the filesystem key, a vulnerability map of the plurality of hardware network elements,

wherein the vulnerability map describes a plurality of software vulnerabilities among the plurality of network elements.

7. The system of claim 6 , further comprising:

determining a plurality of filesystem keys associated with an endpoint among the plurality of network elements; and

determining, using the vulnerability map and the plurality of filesystem keys, one or more software vulnerabilities corresponding to the endpoint.

8. The system of claim 6 , further comprising:

a vulnerability data source,

wherein the network controller is further configured to

obtain, from the vulnerability data source, vulnerability information regarding a second software image, wherein the vulnerability information describes a second software vulnerability, and

identify, using the vulnerability map, a fourth hardware network element that has the second software vulnerability.

9. A non-transitory computer readable medium storing instructions managing network vulnerabilities, the instructions comprising functionality for:

transmitting a callback from a network controller and to a network element, wherein the callback comprises executable code configured to cause the network element to transmit a filesystem manifest to the network controller;

obtaining, in response to executing the callback on the network element, image data from the filesystem manifest, wherein the image data identifies a filesystem key in the filesystem manifest that corresponds to a first software container among a plurality of software containers, and wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the network element;

determining, using the filesystem key that is identified from the image data, a first software vulnerability of a first software image, the first software image being used to generate the first software container;

and

generating, using the first software vulnerability, a vulnerability map of a network,

wherein the vulnerability map describes a plurality of software vulnerabilities operating on the network.

10. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

determining a plurality of filesystem keys associated with an endpoint in the network; and

determining, using the vulnerability map and the plurality of filesystem keys, one or more software vulnerabilities corresponding to the endpoint.

11. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

obtaining vulnerability information regarding a second software image, wherein the vulnerability information describes a second software vulnerability; and

identifying, using the vulnerability map, a second software container that has the second software vulnerability.

12. The non-transitory computer readable medium of claim 9 ,

wherein determining the first software vulnerability comprises:

determining a version of the first software image; and

obtaining, from a software vulnerability data source, common vulnerability and exposure (CVE) data based on the version of the first software image.