System, method and computer program product for improved efficiency in network assessment utilizing variable timeout values

• US 7,124,181 B1
• Filed: 06/29/2001
• Issued: 10/17/2006
• Est. Priority Date: 06/29/2001
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: McDonald, John R., Rahmanovic, Tarik, Osborne, Anthony C., Magdych, James S., Tellier, Brock E., Herath, Nishad P.
• Primary Examiner(s): Caldwell, Andrew
• Assistant Examiner(s): Ailes, Benjamin A.
• Application Number:
  US09/895,536
• Time in Patent Office: 1,936 Days
• Field of Search: 709223-224, 713/201, 714/55, 726/25
• US Class Current: 709/224
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system, method and computer program product are provided for executing a risk-assessment scan with a variable timeout duration which is set based on network conditions. Initially, network conditions are measured in a network coupled between a source and a target. Subsequently, a risk-assessment scan is executed on the target from the source. A timeout is performed prior to making a determination that the target is failing to respond to the risk-assessment scan. Such timeout includes a variable duration which is set as a function of the measured network conditions.

Claims

1. A method of executing a risk-assessment scan with a variable timeout duration which is set based on network conditions, comprising:

measuring network conditions in a network coupled between a source and a target;

executing a risk-assessment scan on the target from the source; and

performing a risk-assessment scan-related timeout prior to making a determination that the target is failing to respond to the risk-assessment scan;

wherein the timeout includes a variable duration which is set as a function of the measured network conditions;

wherein the risk-assessment scan is abandoned if the target fails to respond to the risk-assessment scan within the variable duration;

wherein the timeout is set by adding a default value with a variable value which is set as a function of the measured network conditions;

wherein the timeout is set utilizing a plurality of network condition probes that gather multiple network condition measurements on a single target;

wherein the measured network conditions are measured for an entire network segment on which a plurality of target components is located.

2. The method as recited in claim 1, wherein the network conditions include latency associated with communication between the source and the target.

3. The method as recited in claim 1, wherein measuring the network conditions includes transmitting a probe signal from the source to the target utilizing the network.

4. The method as recited in claim 3, wherein the probe signal prompts the target to send a response signal to the source utilizing the network.

5. The method as recited in claim 4, wherein measuring the network conditions further includes receiving the response signal from the target utilizing the network.

6. The method as recited in claim 5, wherein measuring the network conditions further includes measuring a response duration between the transmission of the probe signal and the receipt of the response signal.

7. The method as recited in claim 6, wherein the timeout is set as a function of the response duration.

8. The method as recited in claim 1, wherein executing the risk-assessment scan includes executing a plurality of risk-assessment scan modules.

9. The method as recited in claim 8, wherein the timeout is performed for each of the risk-assessment scan modules.

10. The method as recited in claim 1, and further comprising storing a result of the measurement of the network conditions.

11. The method as recited in claim 1, wherein the source is capable of reducing a latency of the risk-assessment scan by setting the variable duration to a minimal value, while avoiding the abandonment of vulnerable systems reachable over high latency networks by increasing the variable duration to accommodate such scenarios.

12. A computer program product embodied on a computer readable medium for executing a risk-assessment scan with a variable timeout duration which is set based on network conditions, comprising:

a) computer code for measuring network conditions in a network coupled between a source and a target;

b) computer code for executing a risk-assessment scan on the target from the source; and

c) computer code for performing a risk-assessment scan-related timeout prior to making a determination that the target is failing to respond to the risk-assessment scan;

d) wherein the timeout includes a variable duration which is set as a function of the measured network conditions;

e) wherein the risk-assessment scan is abandoned if the target fails to respond to the risk-assessment scan within the variable duration;

wherein the timeout is set by adding a default value with a variable value which is set as a function of the measured network conditions;

f) wherein the timeout is set utilizing a plurality of network condition probes that gather multiple network condition measurements on a single target;

g) wherein the measured network conditions are measured for an entire network segment on which a plurality of target components is located.

13. The computer program product as recited in claim 12, wherein the network conditions include latency associated with communication between the source and the target.

14. The computer program product as recited in claim 12, wherein measuring the network conditions includes transmitting a probe signal from the source to the target utilizing the network.

15. The computer program product as recited in claim 14, wherein the probe signal prompts the target to send a response signal to the source utilizing the network.

16. The computer program product as recited in claim 15, wherein measuring the network conditions further includes receiving the response signal from the target utilizing the network.

17. The computer program product as recited in claim 16, wherein measuring the network conditions further includes measuring a response duration between the transmission of the probe signal and the receipt of the response signal.

18. The computer program product as recited in claim 17, wherein the timeout is set as a function of the response duration.

19. The computer program product as recited in claim 12, wherein executing the risk-assessment scan includes executing a plurality of risk-assessment scan modules.

20. The computer program product as recited in claim 19, wherein the timeout is performed for each of the risk-assessment scan modules,.

21. The computer program product as recited in claim 12, and further comprising computer code for storing a result of the measurement of the network conditions.

22. The computer program product as recited in claim 12, wherein the network conditions are measured for a network segment, and the measured network conditions are used to set the timeout for a plurality of targets located on the network segment.

23. A system embodied on a computer readable medium for executing a risk-assessment scan with a variable timeout duration which is set based on network conditions, comprising:

a) logic for measuring network conditions in a network coupled between a source and a target;

b) logic for executing a risk-assessment scan on the target from the source; and

c) logic for performing a risk-assessment scan-related timeout prior to making a determination that the target is failing to respond to the risk-assessment scan;

d) wherein the timeout includes a variable duration which is set as a function of the measured network conditions;

e) wherein the risk-assessment scan is abandoned if the target fails to respond to the risk-assessment scan within the variable duration;

wherein the timeout is set by adding a default value with a variable value which is set as a function of the measured network conditions;

f) wherein the timeout is set utilizing a plurality of network condition probes that gather multiple network condition measurements on a single target;

g) wherein the measured network conditions are measured for an entire network segment on which a plurality of target components is located.

24. A method of executing a risk-assessment scan with a variable timeout duration which is set based on network conditions, comprising:

a) transmitting a probe signal from a source to a target utilizing a network, the probe signal prompting the target to send a response signal to the source utilizing the network

b) receiving the response signal from the target utilizing the network;

c) measuring a response duration between the transmission of the probe signal and the receipt of the response signal;

d) executing a risk-assessment scan including a plurality of risk-assessment scan modules;

e) performing a risk-assessment scan-related timeout prior to making a determination that the target is failing to respond to each of the risk-assessment scan modules, wherein the timeout includes a variable duration which is set as a function of the response duration; and

f) abandoning the risk-assessment scan modules if the target fails to respond to the risk-assessment scan modules within the variable duration

wherein the timeout is set by adding a default value with a variable value which is set as a function of the measured network conditions;

g) wherein the timeout is set utilizing a plurality of network condition probes that gather multiple network condition measurements on a single target;

h) wherein the measured network conditions are measured for an entire network segment on which a plurality of target components is located.

25. A computer program product embodied on a computer readable medium for executing a risk-assessment scan with a variable timeout duration which is set based on network conditions, comprising:

a) computer code for transmitting a probe signal from a source to a target utilizing a network, the probe signal prompting the target to send a response signal to the source utilizing the network;

b) computer code for receiving the response signal from the target utilizing the network;

c) computer code for measuring a response duration between the transmission of the probe signal and the receipt of the response signal;

d) computer code for executing a risk-assessment scan including a plurality of risk-assessment scan modules;

e) computer code for performing a risk-assessment scan-related timeout prior to making a determination that the target is failing to respond to each of the risk-assessment scan modules, wherein the timeout includes a variable duration which is set as a function of the response duration; and

f) computer code for abandoning the risk-assessment scan modules if the target fails to respond to the risk-assessment scan modules within the variable duration;

wherein the timeout is set by adding a default value with a variable value which is set as a function of the measured network conditions;

g) wherein the timeout is set utilizing a plurality of network condition probes that gather multiple network condition measurements on a single target;

h) wherein the measured network conditions are measured for an entire network segment on which a plurality of target components is located.