CANVuS: context-aware network vulnerability scanning

摘要: Enterprise networks face a variety of threats including worms, viruses, and DDoS attacks. Development effective defenses against these requires accurate inventories network devices the services they are running. Traditional vulnerability scanning systems meet requirements by periodically probing target to discover hosts This polling-based model suffers from two problems that limit its effectiveness--wasted resources detection latency leads stale data. We argue limitations stem primarily use time as decision variable. To mitigate problems, we instead advocate for an event-driven approach decides when scan based on changes in context--an instantaneous view host state. In this paper, propose architecture building context enterprise security applications using existing passive data sources common formats. Using architecture, built CANVuS, context-aware system triggers operations indicated activities. Experimental results show outperforms models timeliness consumes much fewer resources.