Vulnerability detection platform
Embodiments of a vulnerability detection platform and various examples of its uses are disclosed. A set of attack servers associated with malicious activity is received. A set of potentially vulnerable target servers is also received. A determination of an association between at least one attack server included in the set and one potentially vulnerable target server included in the set is made. An action is performed, at least in part, based on the determined association.
1. A system, comprising:
a processor configured to:
receive a first set of attack servers associated with malicious activity;
receive a second set of potentially vulnerable target servers;
determine a connectivity association between at least one attack server included in the first set of attack servers and one potentially vulnerable target server included in the second set of potentially vulnerable target servers, wherein determining the connectivity association includes categorizing a node with which at least one of the at least one attack server and the one potentially vulnerable target server has communicated; and
perform a remediation action, at least in part, based on the determined connectivity association; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein receiving the first set of attack servers includes identifying a command and control (C2) server.
3. The system of claim 1 , wherein receiving the first set of attack servers includes identifying attacker infrastructure.
4. The system of claim 1 , wherein receiving the first set of attack servers includes receiving at least a portion of the set of attack servers from a third party service.
5. The system of claim 1 , wherein receiving the first set of attack servers includes querying a repository of server information collected by a set of scanners.
6. The system of claim 1 , wherein the second set of potentially vulnerable target servers includes a server known to be exploitable.
7. The system of claim 1 , wherein receiving the second set of potentially vulnerable target servers includes querying a repository of server information collected by a set of scanners.
8. The system of claim 1 , wherein the processor is configured to categorize the node at least in part by facilitating a scan of the node.
9. The system of claim 1 , wherein the processor is further configured to confirm that the one potentially vulnerable target server is an actually vulnerable target server.
10. The system of claim 1 , wherein determining the connectivity association includes determining that a first target server and a first attack server are collocated.
11. The system of claim 1 , wherein the processor is further configured to determine that a first attack server is in communication with one or more additional attack servers.
12. The system of claim 1 , wherein determining the connectivity association includes determining that a first attack server is in communication with one or more target servers.
13. The system of claim 1 , wherein determining the connectivity association includes determining that a first target server is in communication with one or more attack servers.
14. The system of claim 1 , wherein determining the connectivity association includes determining that a first attack server is in communication with an unknown server, wherein the unknown server is not included in either of the first set of attack servers or the second set of potentially vulnerable target servers.
15. The system of claim 1 , wherein determining the connectivity association includes determining that an unknown server is in communication with an attack server, wherein the unknown server is not included in either of the first set of attack servers or the second set of potentially vulnerable target servers.
16. The system of claim 1 , wherein the processor is further configured to use at least a portion of NetFlow information in determining the connectivity association.
17. The system of claim 16 , wherein using the at least a portion of the NetFlow information includes filtering the NetFlow information based on protocol.
18. The system of claim 16 , wherein using the at least a portion of the NetFlow information includes filtering the NetFlow information based on traffic volume.
19. The system of claim 1 , wherein the processor is further configured to filter third party scanners from the first set of attack servers.
20. The system of claim 1 , wherein performing the remediation action includes facilitating identification of an unknown server, wherein the unknown server is not included in either of the first set of attack servers or the second set of potentially vulnerable target servers.
21. A method, comprising:
receiving a first set of attack servers associated with malicious activity;
receiving a second set of potentially vulnerable target servers;
determining a connectivity association between at least one attack server included in the first set of attack servers and one potentially vulnerable target server included in the second set of potentially vulnerable target servers, wherein determining the connectivity association includes categorizing a node with which at least one of the at least one attack server and the one potentially vulnerable target server has communicated; and
performing a remediation action, at least in part, based on the determined connectivity association.
22. The method of claim 21 , wherein receiving the first set of attack servers includes identifying a command and control (C2) server.
23. The method of claim 21 , wherein receiving the first set of attack servers includes identifying attacker infrastructure.
24. The method of claim 21 , wherein receiving the first set of attack servers includes receiving at least a portion of the set of attack servers from a third party service.
25. The method of claim 21 , wherein receiving the first set of attack servers includes querying a repository of server information collected by a set of scanners.
26. The method of claim 21 , wherein the second set of potentially vulnerable target servers includes a server known to be exploitable.
27. The method of claim 21 , wherein receiving the second set of potentially vulnerable target servers includes querying a repository of server information collected by a set of scanners.
28. The method of claim 21 , wherein categorizing the node includes facilitating a scan of the node.
29. The method of claim 21 , further comprising confirming that the one potentially vulnerable target server is an actually vulnerable target server.
30. The method of claim 21 , wherein determining the connectivity association includes determining that a first target server and a first attack server are collocated.
31. The method of claim 21 , further comprising determining that a first attack server is in communication with one or more additional attack servers.
32. The method of claim 21 , wherein determining the connectivity association includes determining that a first attack server is in communication with one or more target servers.
33. The method of claim 21 , wherein determining the connectivity association includes determining that a first target server is in communication with one or more attack servers.
34. The method of claim 21 , wherein determining the connectivity association includes determining that a first attack server is in communication with an unknown server, wherein the unknown server is not included in either of the first set of attack servers or the second set of potentially vulnerable target servers.
35. The method of claim 21 , wherein determining the connectivity association includes determining that an unknown server is in communication with an attack server, wherein the unknown server is not included in either of the first set of attack servers or the second set of potentially vulnerable target servers.
36. The method of claim 21 , further comprising using at least a portion of NetFlow information in determining the connectivity association.
37. The method of claim 36 , wherein using the at least a portion of the NetFlow information includes filtering the NetFlow information based on protocol.
38. The method of claim 36 , wherein using the at least a portion of the NetFlow information includes filtering the NetFlow information based on traffic volume.
39. The method of claim 21 , further comprising filtering third party scanners from the first set of attack servers.
40. The method of claim 21 , wherein performing the remediation action includes facilitating identification of an unknown server, wherein the unknown server is not included in either of the first set of attack servers or the second set of potentially vulnerable target servers.
41. A non-transitory computer-readable storage medium comprising computer instructions for:
receiving a first set of attack servers associated with malicious activity;
receiving a second set of potentially vulnerable target servers;
determining a connectivity association between at least one attack server included in the first set of attack servers and one potentially vulnerable target server included in the second set of potentially vulnerable target servers, wherein determining the connectivity association includes categorizing a node with which at least one of the at least one attack server and the one potentially vulnerable target server has communicated; and
performing a remediation action, at least in part, based on the determined connectivity association.