System and method for monitoring network vulnerabilities

1. A method for managing network vulnerabilities, comprising:

determining, using a computer processor, a filesystem key associated with a first hardware network element in a network,

wherein the filesystem key corresponds to a software container among a plurality of software containers, and

wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the first hardware network element;

determining a first software vulnerability of a first software image using the computer processor, the filesystem key, and a vulnerability map of the network,

wherein the vulnerability map describes a plurality of software vulnerabilities arranged according to a plurality of filesystem keys that are used on the network, and

wherein the first software image is used to generate the software container; and

presenting, using a graphical user interface and the computer processor, the first software vulnerability to a user.

2. The method of claim 1 , wherein the first software vulnerability is determined by a network controller using the vulnerability map.

3. The method of claim 1 , further comprising:

identifying a security issue associated with the first software vulnerability,

wherein the security issue comprises an exposure of software code operating on the network element to an entity outside the network.

4. The method of claim 1 , further comprising:

identifying a hardware issue associated with the first software vulnerability that causes a software application crash on the first hardware network element.

5. The method of claim 1 , further comprising:

transmitting, to a computer system located outside the network, a notification regarding the first software vulnerability on the first hardware network element, wherein the notification identifies a solution to the first software vulnerability.

6. The method of claim 1 , further comprising:

obtaining, from a vulnerability data source, vulnerability information regarding a second software image, wherein the vulnerability information describes a second software vulnerability, and

identify, using the vulnerability map, a second hardware network element that has the second software vulnerability.

7. The method of claim 1 , wherein determining the first software vulnerability comprises:

determining a version of the first software image; and

obtaining, from a software vulnerability data source, common vulnerability and exposure (CVE) data based on the version of the software image.

8. The method of claim 1 , wherein the filesystem key is a secured hash algorithm key for a secured layer of the filesystem comprising a plurality of secured layers.

9. A non-transitory computer readable medium storing instructions managing network vulnerabilities, the instructions comprising functionality for:

determining a filesystem key associated with a first hardware network element in the network,

wherein the filesystem key corresponds to a software container among a plurality of software containers, and

wherein the plurality of software containers are virtualized user-space instances operating on a single kernel in the first hardware network element;

determining, using the filesystem key and a vulnerability map of the network, a first software vulnerability of a first software image,

wherein the vulnerability map describes a plurality of software vulnerabilities arranged according to a plurality of filesystem keys that are used on the network, and

wherein the first software image is used to generate the software container; and

presenting, using a graphical user interface, the first software vulnerability to a user.

10. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

identifying a security issue associated with the first software vulnerability,

wherein the security issue comprises an exposure of software code operating on the network element to an entity outside the network.

11. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

identifying a hardware issue associated with the first software vulnerability that causes a software application crash on the first hardware network element.

12. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

transmitting, to a computer system located outside the network, a notification regarding the first software vulnerability on the first hardware network element, wherein the notification identifies a solution to the first software vulnerability.

13. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

obtaining, from a vulnerability data source, vulnerability information regarding a second software image, wherein the vulnerability information describes a second software vulnerability, and

identify, using the vulnerability map, a second hardware network element that has the second software vulnerability.

14. The non-transitory computer readable medium of claim 9 , wherein determining the first software vulnerability comprises:

determining a version of the first software image; and

obtaining, from a software vulnerability data source, common vulnerability and exposure (CVE) data based on the version of the software image.

15. The non-transitory computer readable medium of claim 9 , wherein the filesystem key is a secured hash algorithm key for a secured layer of the filesystem comprising a plurality of secured layers.

16. The non-transitory computer readable medium of claim 9 , the instructions further comprising functionality for:

obtaining vulnerability information regarding a second software image, wherein the vulnerability information describes a second software vulnerability; and

identifying, using the vulnerability map, a second hardware network element that has the second software vulnerability.

17. A method for managing network vulnerabilities, comprising:

obtaining, at a hardware network element and from a network controller disposed on a network, a callback comprising executable code configured to cause the hardware network element to transmit a filesystem manifest to the network controller;

executing, on the hardware network element, the callback; and

transmitting, in response to executing the callback and to the network controller, image data from the filesystem manifest,

wherein the image data identifies a filesystem key in the filesystem manifest that corresponds to a software container among a plurality of software containers, the plurality of software containers being virtualized user-space instances operating on a single kernel in the hardware network element, and

wherein the image data is configured to cause the network controller to generate a vulnerability map of the network.

18. The method of claim 17 , wherein the callback is a webhook.

19. The method of claim 17 , further comprising:

obtaining, at the hardware network element, a notification from the network controller regarding a threat associated with a software vulnerability that is determined by the network controller using the vulnerability map,

wherein the hardware network element implements a solution to the threat.

20. The method of claim 17 , wherein the filesystem key is a secured hash algorithm key for a secured layer of the filesystem comprising a plurality of secured layers.