Systems and methods for automated determination of network device transiting data attributes

• US 10,594,589 B2
• Filed: 05/01/2019
• Issued: 03/17/2020
• Est. Priority Date: 09/19/2016
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Barnum, Eric, Banks, Terence
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US16/401,032
• Publication Number:
  US 20190260665A1
• Time in Patent Office: 321 Days
• Field of Search: None
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities

Abstract

A system for determining network device transiting data attributes includes one or more memory devices storing instructions, and one or more processors configured to execute the instructions to run a first script on all static ports of a network and run a second script on all known ports of the network. The system may parse the parameters returned from the first and second scripts to identify one or more identified ports of the known ports. The system may run a third script on the one or more identified ports to force one or more denials at the identified ports. Based on the one or more denials, the system may determine network device transiting data attributes including but not limited to allowed protocols and directionality for each of the one or more identified ports.

Claims

1. A system for determining network device transiting data attributes, the system comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or more processors to;

run a first script on static ports of a network, wherein the first script returns parameters for the static ports;

run a second script on known ports of the network, wherein the second script returns parameters for the known ports;

parse the returned parameters for the static ports and the returned parameters for the known ports to designate a plurality of identified ports for additional analysis; and

produce a target/hit view report for the plurality of identified ports indicating a first variance in an established control mechanism of the network and a second variance in the established control mechanism, the first variance identifying where the established control mechanism is predicted to fail and the second variance identifying where the established control mechanism has failed.

2. The system of claim 1, wherein the instructions further cause the one or more processors to:

identify one or more shadow assets by comparing differences between the returned parameters for the static ports and the returned parameters for the known ports.

3. The system of claim 2, wherein the one or more shadow assets comprise one or more inactive shadow assets.

4. The system of claim 1, wherein the instructions further cause the one or more processors to:

identify one or more network anti-patterns by comparing of a first output from running the first script and a second output from running the second script.

5. The system of claim 1, wherein the established control mechanism comprises one or more of a policy or a rule of the network.

6. The system of claim 1, wherein the first script on the static ports returns path and destination addresses for the static ports of the network.

7. The system of claim 1, wherein the static ports include network destinations and firewall locations of the network.

8. The system of claim 1, wherein the second script on the known ports returns path and destination addresses for the known ports of the network and identifies temporarily allowed sessions for each of the known ports.

9. The system of claim 1, wherein the known ports of the network comprise one or more of known active, virtual, and non-active ports of the network.

10. The system of claim 1, wherein the parameters returned by the first script and the second script include one or more of an allowed state of a static port, protocol, input interface, source protocol, source mask, source port, output interface, destination protocol, destination mask and destination port.

11. The system of claim 1, wherein a first port of the plurality of identified ports is designated based on a protocol and a device type to target one or more of network ports and one or more network appliances.

12. The system of claim 11, wherein the instructions further cause the one or more processors to:

capture the data attributes and directionality for the first port; and

generate a database comprising at least a portion of the data attributes and the directionality for the first port.

13. The system of claim 1, wherein the instructions further cause the one or more processors to:

schedule run time for the first script and run rime for the second script for timed targeting.

14. A method for network testing, comprising:

running, via a computing device of a network, a first script on static ports of the network to return parameters for the static ports;

running, via the computing device, a second script on known ports to return parameters for the known ports;

parsing, via the computing device, the returned parameters for the static ports and the returned parameters for the known ports to designate at least a first port of a plurality of identified ports; and

determining, via the computing device, one or more variances that indicate that an established control mechanism of the network has failed or is predicted to fail for at least the first port; and

identifying one or more shadow assets operating in the network based on the one or more variances.

15. The method of claim 14, further comprising:

identifying the one or more shadow assets operating in the network by comparing differences between the returned parameters for the static ports and the returned parameters for the known ports.

16. The method of claim 14, wherein the one or more shadow assets comprise one or more inactive shadow assets.

17. The method of claim 14, wherein at least the first port of the plurality of identified ports is designated based on a protocol and a device type to target one or more of network ports and one or more network appliances.

18. The method of claim 17, further comprising:

capturing data attributes and directionality for at least the first port; and

generating a database comprising at least a portion of the data attributes and the directionality for the first port.

19. The method of claim 14, further comprising identifying one or more network anti-patterns by comparing of a first output from running the first script and a second output from running the second script.

20. The method of claim 14, wherein the established control mechanism comprises one or more of a policy or a rule of the network.