CANVuS: Context-Aware Network Vulnerability Scanning

Enterprise networks face a variety of threats including worms, viruses, and DDoS attacks. Development of effective defenses against these threats requires accurate inventories of network devices and the services they are running. Traditional vulnerability scanning systems meet these requirements by periodically probing target networks to discover hosts and the services they are running. This polling-based model of vulnerability scanning suffers from two problems that limit its effectiveness--wasted network resources and detection latency that leads to stale data. We argue that these limitations stem primarily from the use of time as the scanning decision variable. To mitigate these problems, we instead advocate for an event-driven approach that decides when to scan based on changes in the network context--an instantaneous view of the host and network state. In this paper, we propose an architecture for building network context for enterprise security applications by using existing pass...

• Type: Journal
• Year: 2010
• Where: RAID
• Authors: Yunjing Xu, Michael Bailey, Eric Vander Weele, Farnam Jahanian
• Keywords: Computer Networks, Network Context, Network Resources, RAID 2010, Vulnerability Scanning Systems