Systems and methods for modifying network map attributes

• US 20080198856A1
• Filed: 11/14/2005
• Published: 08/21/2008
• Est. Priority Date: 11/14/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Bruzek, Dina L., Vogel, William A.
• Granted Patent: US 7,733,803 B2
• Time in Patent Office: Days
• US Class Current: 370/395.3
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The disclosed systems and methods provide a user interface for modifying host configuration data that has been automatically and passively determined and for adding or modifying other parameters associated with a host. A host data table can store various parameters descriptive of a host including the applicability of specific vulnerabilities. If it is determined that one or more hosts should not be identified as associated with a specific vulnerability, a graphical user interface can be used to modify the vulnerability parameter.

Claims

1. A method for assigning a vulnerability parameter to a device on a network, comprising:

defining a vulnerability parameter for an operating system or service;

storing the vulnerability parameter in a host map associated with a network device;

providing a graphical user interface for viewing and modifying the vulnerability parameter; and

storing the modified vulnerability parameter in the host map associated with the service or operating system.

2. The method of claim 1, wherein the vulnerability parameter is invalid or valid.

3. The method of claim 1, wherein the graphical user interface is provided through an application program interface.

4. The method of claim 1, wherein the graphical user interface provides a function for setting a vulnerability parameter for a plurality of selected hosts or services.

5. The method of claim 1, wherein the vulnerability parameter is associated with a universal unique identifier and is synchronized to a high availability peer.

6. The method of claim 1, wherein the graphical user interface provides a function for deleting a host from a network map.

7. A method for automatically and passively determining the characteristics of a network, comprising:

reading one or more packets transmitted on the network;

identifying a network device on the network using the one or more packets;

recording an identity of the network device in a host map record associated with the network device;

providing a graphical user interface for receiving a parameter from a user; and

recording the user parameter in the host map record associated with the network device.

8. The method of claim 7, wherein the graphical user interface is provided through an application program interface.

9. The method of claim 7, wherein the parameter is an operational criticality attribute.

10. The method of claim 7, wherein the parameter is a location attribute.

11. The method of claim 7, wherein the parameter is an integer in a user-defined range.

12. The method of claim 7, wherein the parameter is a list of string values.

13. The method of claim 7, wherein the parameter is associated with a universal unique identifier and is synchronized to a high availability peer.

14. A system for assigning a vulnerability parameter to a device on a network, comprising:

a computer-readable medium for storing a vulnerability parameter for an operating system or service in a host map associated with a network device;

a display for displaying a graphical user interface for viewing and modifying the vulnerability parameter assigned to the service or operating system; and

a computer-readable medium for storing the modified vulnerability parameter in the host map associated with the service or operating system.

15. The system of claim 14, wherein the vulnerability parameter is invalid or valid.

16. The system of claim 14, wherein the vulnerability parameter is associated with a universal unique identifier and is synchronized to a high availability peer.

17. A system for automatically and passively determining the characteristics of a network, comprising:

a receiver for receiving one or more packets transmitted on the network and identifying a network device on the network using the one or more packets;

a computer-readable medium for storing an identity of the network device in a host map;

a display for displaying a graphical user interface for receiving a parameter from a user; and

a computer-readable medium for storing the user parameter in the host map associated with the identified network device.

18. The system of claim 17, wherein the parameter is associated with a universal unique identifier and is synchronized to a high availability peer.

19. The system of claim 17, wherein the graphical user interface is provided through an application program interface.

20. The system of claim 17, wherein the parameter is an operational criticality attribute.