Information collection system, information collection method, medium, and information collection program
An information collection system includes: a side-channel information processing unit that derives load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data; an allow list generation unit that generates an allow list including a scan timing and a scan range in which the availability is not affected, the allow list generation unit generating the allow list based on the load information; and an allow list storage unit that stores the allow list. An active scan of the target machine is executed by referencing the allow list stored in the allow list storage unit to collect asset information of the target machine.
1. An information collection system comprising:
at least one processor configured to execute instructions to:
derive load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data;
generate, based on the load information, an allow list including a scan timing and a scan range in which the availability is not affected; and
memory that stores the allow list,
wherein an active scan of the target machine is executed by referencing the allow list stored in the memory to collect asset information of the target machine,
wherein the load information comprises energy load information,
wherein the side-channel data is power consumption data,
wherein deriving load information comprises deriving the energy load information by processing the power consumption data,
wherein generating the allow list comprises generating the allow list including the scan timing and the scan range by referencing the energy load information, and
wherein the at least one processor is configured to execute the instructions to determine that the active scan is executable on the target machine when the energy load information is lower than a threshold.
2. The information collection system according to claim 1 , wherein
the scan range is determined by IP address information, and
the IP address information is at least one of: an IP address of the target machine; a network address that represents a subnet to which the IP address of the target machine belongs; and an IP address range including the IP address of the target machine.
3. The information collection system according to claim 1 , wherein to generate comprises determining the scan timing by obtaining a start time of allowed scanning and an end time of allowed scanning as time information which is based on the load information and generating the allow list including the time information when the start time of allowed scanning and the end time of allowed scanning are different from each other.
4. The information collection system according to claim 3 , wherein the memory further includes a database to store the allow list connecting the start time of allowed scanning and the end time of allowed scanning with each other for data items in the allow list.
5. The information collection system according to claim 3 , wherein the at least one processor is configured to execute the instructions to:
obtain the allow list from the memory and send a scan execution request;
execute the active scan in response to receiving the scan execution request; and
determine a timing to send the scan execution request based on the start time of allowed scanning and the end time of allowed scanning in the allow list.
6. The information collection system according to claim 5 ,
wherein the at least one processor is configured to execute the instructions to:
extract the time information and an IP address information of the target machine that sends a high-load signal; and
stop sending the scan execution request in response to receiving the high-load signal,
wherein to stop comprises stopping the scan execution request prior to the timing that the active scan is executable based on the start time of allowed scanning and the end time of allowed scanning in the allow list, when a time difference between a current time and the time of receiving the high-load signal is lower than a threshold.
7. The information collection system according to claim 5 ,
wherein the at least one processor is configured to execute the instructions to:
send a scan stopping request in response to receiving a high-load signal;
stop the active scan of the target machine associated with an IP address information attached with the scan stopping request; and
determine to send the scan stopping request when a current time is equal to the time between the start time of allowed scanning and the end time of allowed scanning which are described in the allow list.
8. A computer-implemented information collection method comprising:
deriving load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data;
generating an allow list including a scan timing and a scan range in which the availability is not affected, the allow list being based on the load information; and
storing the allow list in memory,
wherein an active scan of the target machine is executed by referencing the allow list stored in the memory to collect asset information of the target machine,
wherein the load information comprises energy load information,
wherein the side-channel data is power consumption data,
wherein deriving comprises deriving the energy load information by processing the power consumption data,
wherein generating comprises generating the allow list including the scan timing and the scan range by referencing the energy load information, and
wherein the computer-implemented information collection method comprises determining that the active scan is executable on the target machine when the energy load information is lower than a threshold.
9. A non-transitory computer-readable storage medium storing a program that causes a computer to execute instructions to:
derive load information to estimate an impact on the availability of a target machine for active scanning by using side-channel data;
generate an allow list including a scan timing and a scan range in which the availability is not affected, the allow list being based on the load information; and
store the allow list in memory,
wherein an active scan of the target machine is executed by referencing the allow list stored in the memory to collect asset information of the target machine,
wherein the load information comprises energy load information,
wherein the side-channel data is power consumption data,
wherein deriving load information comprises deriving the energy load information by processing the power consumption data,
wherein generating the allow list comprises generating the allow list including the scan timing and the scan range by referencing the energy load information; and
determine that the active scan is executable on the target machine when the energy load information is lower than a threshold.