US6324656B1 — System and method for rules-driven multi-phase ne…

Claim 1

Independent Claim 89 words

A computer implemented method for multi-phase rules-driven network vulnerability assessment, the method comprising: pinging devices on a network to discover devices with a connection to the network; performing port scans on the discovered devices and collecting banners sent as a result of the port scans; storing information from the collected banners as entries in a first database to establish a network configuration; comparing the entries in the network configuration with more than one rule set to determine potential vulnerabilities; and storing results of the comparison in a second database.

Claim 2

Dependent Claim 89 words

A computer implemented method for multi-phase rules-driven network vulnerability assessment, the method comprising: pinging devices on a network to discover devices with a connection to the network; performing port scans on the discovered devices and collecting banners sent as a result of the port scans; storing information from the collected banners as entries in a first database to establish a network configuration; comparing the entries in the network configuration with more than one rule set to determine potential vulnerabilities; and storing results of the comparison in a second database.

Claim 3

Dependent Claim 26 words

The method of claim 1 , further comprising performing host nudges on the devices and storing information from data received as entries in the first database.

Claim 4

Dependent Claim 24 words

The method of claim 1 , further comprising performing active data collection and storing information from data received as entries in the first database.

Claim 5

Dependent Claim 52 words

The method of claim 1 , wherein comparing comprises: comparing an entry in the network configuration to a rule to determine an operating system represented by the entry; comparing the entry to a second rule to determine a service; and comparing the entry to a third rule to determine a potential vulnerability.

Claim 6

Dependent Claim 17 words

The method of claim 1 , wherein the rule sets comprise a text based prepositional logic language.

Claim 7

Dependent Claim 17 words

The method of claim 1 , further comprising confirming a potential vulnerability by performing an active exploit.

Claim 8

Independent Claim 147 words

A system for multi-phase rules-driven network vulnerability assessment, the system comprising: a first database for storing information from collected banners as entries; a plurality of rule sets; a second database for storing results of a comparison; and an execution module coupled to the first database, the rule set, and the second database, the execution module operable to ping devices on a network to discover devices with a connection to the network, the execution module further operable to perform port scans on the discovered device and collect banners sent as a result of the port scans; the execution module operable to store information from the collected entries in the first database to establish a network configuration and compare the entries in the network configuration with more than one rule set to determine potential vulnerabilities; the execution module operable to store results of the comparision in the second database.

Claim 9

Independent Claim 147 words

A system for multi-phase rules-driven network vulnerability assessment, the system comprising: a first database for storing information from collected banners as entries; a plurality of rule sets; a second database for storing results of a comparison; and an execution module coupled to the first database, the rule set, and the second database, the execution module operable to ping devices on a network to discover devices with a connection to the network, the execution module further operable to perform port scans on the discovered device and collect banners sent as a result of the port scans; the execution module operable to store information from the collected entries in the first database to establish a network configuration and compare the entries in the network configuration with more than one rule set to determine potential vulnerabilities; the execution module operable to store results of the comparision in the second database.

Claim 10

Dependent Claim 32 words

The system of claim 7 , wherein the execution module is further operable to perform host nudges on the devices and store information from data received as entries in the first database.

Claim 11

Dependent Claim 30 words

The system of claim 7 , wherein the execution module is further operable to perform active data collection and store information from data received as entries in the first database.

Claim 12

Dependent Claim 56 words

The system of claim 7 , wherein the execution module is operable to: compare an entry in the network configuration to a rule to determine an operating system represented by the entry; compare the entry to a second rule to determine a service; and compare the entry to a third rule to determine a potential vulnerability.

Claim 13

Dependent Claim 17 words

The system of claim 7 , wherein the rule sets comprise a text based prepositional logic language.

Claim 14

Dependent Claim 23 words

The system or claim 7 , wherein the execution module is further operable to confirm a potential vulnerability by performing an active exploit.

Claim 15

Dependent Claim 115 words

A computer implemented method for multiphase rules-driven network vulnerability assessment, the method comprising: pinging devices on a network to discover devices with a connection to the network; performing port scans on the discovered devices and collecting banners sent as a result of the port scans; storing information from the collected banners as entries in a first database to establish a network configuration; comparing an entry in the first database to a rule to determine an operating system represented by the entry; comparing the entry to a second rule to determine a service; comparing the entry to a third rule to determine a potential vulnerability; and storing results of the comparing steps in a second database.

Claim 16

Dependent Claim 115 words

A computer implemented method for multiphase rules-driven network vulnerability assessment, the method comprising: pinging devices on a network to discover devices with a connection to the network; performing port scans on the discovered devices and collecting banners sent as a result of the port scans; storing information from the collected banners as entries in a first database to establish a network configuration; comparing an entry in the first database to a rule to determine an operating system represented by the entry; comparing the entry to a second rule to determine a service; comparing the entry to a third rule to determine a potential vulnerability; and storing results of the comparing steps in a second database.

Claim 17

Dependent Claim 26 words

The method of claim 13 , further comprising performing host nudges on the devices and storing information from data received as entries in the first database.

Claim 18

Dependent Claim 24 words

The method of claim 13 , further comprising performing active data collection and storing information from data received as entries in the first database.

Claim 19

Dependent Claim 16 words

The method of claim 13 , wherein the rules comprise an ASCII based prepositional logic language.

Claim 20

Dependent Claim 17 words

The method of claim 13 , further comprising confirming a potential vulnerability by performing an active exploit.

Claim 21

Dependent Claim 93 words

Logic encoded in media for multi-phase rules-driven network vulnerability assessment and operable to perform the following steps: pinging devices on a network to discover devices with a connection to the network; performing port scans on the discovered devices and collecting banners sent as a result of the port scans; storing information from the collected banners as entries in a first database to establish a network configuration; comparing the entries in the network configuration with more than one rule set to detemine potential vulnerabilities; and storing results of the comparison in a second database.

Claim 22

Dependent Claim 93 words

Logic encoded in media for multi-phase rules-driven network vulnerability assessment and operable to perform the following steps: pinging devices on a network to discover devices with a connection to the network; performing port scans on the discovered devices and collecting banners sent as a result of the port scans; storing information from the collected banners as entries in a first database to establish a network configuration; comparing the entries in the network configuration with more than one rule set to detemine potential vulnerabilities; and storing results of the comparison in a second database.

Claim 23

Dependent Claim 29 words

The logic of claim 18 , further comprising the step of performing host nudges on the devices and storing information from data received as entries in the first database.

Claim 24

Dependent Claim 27 words

The logic of claim 18 , further comprising the step of performing active data collection and storing information from data received as entries in the first database.

Claim 25

Dependent Claim 52 words

The logic of claim 18 , wherein comparing comprises: comparing an entry in the network configuration to a rule to determine an operating system represented by the entry; comparing the entry to a second rule to determine a service; and comparing the entry to a third rule to determine a potential vulnerability.

Claim 26

Dependent Claim 20 words

The logic of claim 18 , further comprising the step of confirming a potential vulnerability by performing an active exploit.

Claim 27

Independent Claim 95 words

An apparatus for multi-phase rules-driven network vulnerability assessment comprising: means for pinging devices on a network to discover devices with a connection to the network; means for performing port scans on the discovered devices and collecting banners sent as a result of the port scans; means for storing information from the collected banners as entries in a first database to establish a network configuration; means for comparing the entries in the network configuration with more than one rule set to determine potential vulnerabilities; and means for storing results of the comparison in a second database.

Claim 28

Independent Claim 95 words

An apparatus for multi-phase rules-driven network vulnerability assessment comprising: means for pinging devices on a network to discover devices with a connection to the network; means for performing port scans on the discovered devices and collecting banners sent as a result of the port scans; means for storing information from the collected banners as entries in a first database to establish a network configuration; means for comparing the entries in the network configuration with more than one rule set to determine potential vulnerabilities; and means for storing results of the comparison in a second database.

Claim 29

Dependent Claim 28 words

The apparatus of claim 23 , further comprising means for performing host nudges on the devices and storing information from data received as entries in the first database.

Claim 30

Dependent Claim 26 words

The apparatus of claim 23 , further comprising means for performing active data collection and storing information from data received as entries in the first database.

Claim 31

Dependent Claim 60 words

The apparatus of claim 23 , wherein means for comparing comprises: means for comparing an entry in the network configuration to a rule to determine an operating system represented by the entry; means for comparing the entry to a second rule to determine a service; and means for comparing the entry to a third rule to determine a potential vulnerability.

Claim 32

Dependent Claim 19 words

The apparatus of claim 23 , further comprising means for confirming a potential vulnerability by performing an active exploit.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	2004-11-26	2005-05-28	2005-11-27	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	2008-11-26	2009-05-28	2009-11-27	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2012-11-26	2013-05-28	2013-11-27	$7700.00	Window Closed / Lapsed

System and method for rules-driven multi-phase network vulnerability assessment

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag