Identifying network vulnerabilities

1. A method for identifying a network vulnerability, the method comprising:

receiving, using an interface, scan configuration data from a vulnerability assessment device, wherein the scan configuration data comprises

at least one device that is known to the vulnerability assessment device,

whether the at least one known device is scanned by the vulnerability assessment device, and

at least one feature related to the at least one known device;

receiving, using the interface, network activity data including at least one device that is unknown to the vulnerability assessment device;

determining, using a processor executing instructions stored on a memory and providing a classifier, whether the at least one unknown device shares at least one feature with a known device that is scanned;

scanning, using the vulnerability assessment device, the at least one unknown device to identify any vulnerabilities of the at least one unknown device after the processor determines the at least one unknown device shares at least one feature with a known device that is scanned; and

updating the scan configuration data in a disabled state and presenting the updated scan configuration data to an operator using a user interface before the vulnerability assessment device scans the at least one unknown device.

2. The method of claim 1 , wherein

the at least one feature comprises at least one of a set of ports receiving data on the at least one known device, a number of peers connected to the at least one known device, a volume of data sent from the at least one known device, a volume of data received by the at least one known device, a busiest time period of day, and a least busy time period of day.

3. The method of claim 1 , wherein

the network activity data is received from at least one of a Netflow record, an address resolution protocol announcement, a web proxy, a domain name server, and a firewall.

4. The method of claim 1 , wherein

at least one device that is not scanned includes a printer.

5. The method of claim 1 , wherein

at least one device that is not scanned includes a healthcare device.

6. The method of claim 1 , further comprising:

iterating, at a predetermined time interval, the steps of:

receiving scan configuration data;

receiving network activity data including at least one unknown device;

determining whether the at least one unknown device shares at least one feature with at least one known device that is scanned; and

scanning the at least one unknown device to identify any vulnerabilities of the unknown device.

7. The method of claim 1 , wherein

the classifier is a random forest or a support vector machine classifier.

8. The method of claim 1 , further comprising:

issuing an alert using a user interface, wherein

the alert indicates that the scan configuration data should be updated to include the at least one unknown device.

9. The method of claim 1 , further comprising:

autonomously updating the scan configuration data to include the at least one unknown device.

10. A system for identifying a network vulnerability, the system comprising:

an interface for receiving:

scan configuration data from a vulnerability assessment device, wherein

the scan configuration data comprises

at least one device that is known to the vulnerability assessment device,

whether the at least one known device is scanned by the vulnerability assessment device, and

at least one feature related to the at least one known device; and

network activity data including at least one device that is unknown to the vulnerability assessment device; and

a processor executing instructions stored on a memory and providing a classifier,

wherein the processor is configured to:

determine whether the at least one unknown device shares at least one feature with at least one known device that is scanned,

wherein

 the vulnerability assessment device is configured to scan the unknown device to identify any vulnerabilities of the at least one unknown device after the processor determines the at least one unknown device shares at least one feature with a known device that is scanned, and

update the scan configuration data in a disabled state and present the updated scan configuration data to an operator using a user interface before the vulnerability assessment device scans the at least one unknown device.

11. The system of claim 10 , wherein

the at least one feature comprises at least one of a set of ports receiving data on the at least one known device, a number of peers connected to the at least one known device, a volume of data sent from the at least one known device, a volume of data received by the at least one known device, a busiest time period of day, and a least busy time period of day.

12. The system of claim 10 , wherein

the network activity data is received from at least one of a Netflow record, an address resolution protocol announcement, a web proxy, a domain name server, and a firewall.

13. The system of claim 10 , wherein

at least one device that is not scanned includes a printer.

14. The system of claim 10 , wherein

at least one device that is not scanned includes a healthcare device.

15. The system of claim 10 , wherein

the system is configured to, at a predetermined time interval,

receive scan configuration data,

receive network activity data including at least one unknown device,

determine whether the at least one unknown device shares at least one feature with a known device that is scanned, and

scan the at least one unknown device to identify any vulnerabilities of the unknown device.

16. The system of claim, 10 wherein

the classifier is a random forest or a support vector machine classifier.

17. The system of claim, 10 wherein

the processor is further configured to issue an alert using a user interface, wherein

the alert indicates that the scan configuration data should be updated to include the at least one unknown device.

18. The system of claim 10 , wherein

the processor is configured to autonomously update the scan configuration data to include the at least one unknown device.