Discovery engine

• US 9,264,395 B1
• Filed: 05/09/2014
• Issued: 02/16/2016
• Est. Priority Date: 04/11/2012
• Status: Expired due to Fees

• Current Assignee: Artemis Internet Inc.
• Original Assignee: Artemis Internet Inc.
• Inventors: Stamos, Alexander Charles
• Primary Examiner(s): Walsh, John B
• Application Number:
  US14/274,666
• Time in Patent Office: 648 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An identification of a first domain name is received from a first Domain Name Service (DNS) information source. A determination is made that the received first domain name is not already present in an asset repository. The first domain name is added to the asset repository. The first domain name is provided to a job scheduler that is configured to facilitate a scan of a computing resource reachable via the first domain name.

Claims

1. A system, comprising:

a processor configured to;

receive, at an asset discovery engine, an identification of a first domain name from a first Domain Name Service (DNS) information source, wherein the identification is determined based at least in part by analyzing one or more log files obtained from a DNS server and associated with one or more DNS requests, and wherein the first domain name is included as at least one of the requests, and wherein the first domain name is a name for which at least one device requested resolution to an IP address;

determine, using the identification received from the first DNS information source, that the received first domain name is not already present in an asset repository; and

in response to determining that the received first domain name is not already present in the asset repository;

add the first domain name to the asset repository; and

provide the identified first domain name to a job scheduler, wherein the job scheduler is configured to facilitate a scan of a computing resource reachable via the first domain name; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the processor is further configured to associate the first domain name with a policy regime.

3. The system of claim 2 wherein the policy regime was selected by an administrator associated with the first domain name.

4. The system of claim 1 wherein the asset repository comprises an asset database.

5. The system of claim 1 wherein the first domain name is added to the asset repository in response to receiving permission from an administrator associated with the first domain name.

6. The system of claim 1 wherein the first DNS information source is included in a plurality of DNS information sources from which the asset discovery engine is configured to receive domain name information.

7. The system of claim 6 wherein the processor is further configured to receive an identification of the first domain name from a second DNS information source included in the plurality of DNS information sources, wherein the second DNS information source is of a different type than the first DNS information source and wherein the processor is configured to determine that the first domain name is already present in the repository and not add the asset a second time.

8. The system of claim 6 wherein one of the DNS information sources included in the plurality of DNS information sources comprises a DNS sniffer.

9. The system of claim 6 wherein one of the sources included in the plurality of DNS information sources comprises a log analyzer.

10. The system of claim 9 wherein the log analyzer is configured to analyze private DNS logs.

11. The system of claim 9 wherein the log analyzer is configured to analyze public DNS logs.

12. The system of claim 6 wherein one of the DNS information sources included in the DNS information sources comprises a zone transfer agent.

13. A method, comprising:

receiving, at an asset discovery engine, an identification of a first domain name from a first Domain Name Service (DNS) information source, wherein the identification is determined based at least in part by analyzing one or more log files obtained from a DNS server and associated with one or more DNS requests, and wherein the first domain name is included as at least one of the requests, and wherein the first domain name is a name for which at least one device requested resolution to an IP address;

determining, using the identification received from the first DNS information source, that the received first domain name is not already present in an asset repository; and

in response to determining that the received first domain name is not already present in the asset repository;

adding the first domain name to the asset repository; and

providing the identified first domain name to a job scheduler, wherein the job scheduler is configured to facilitate a scan of a computing resource reachable via the first domain name.

14. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving, at an asset discovery engine, an identification of a first domain name from a first Domain Name Service (DNS) information source, wherein the identification is determined based at least in part by analyzing one or more log files obtained from a DNS server and associated with one or more DNS requests, and wherein the first domain name is included as at least one of the requests, and wherein the first domain name is a name for which at least one device requested resolution to an IP address;

determining, using the identification received from the first DNS information source, that the received first domain name is not already present in an asset repository; and

in response to determining that the received first domain name is not already present in the asset repository;

adding the domain name to the asset repository; and

providing the identified first domain name to a job scheduler, wherein the job scheduler is configured to facilitate a scan of a computing resource reachable via the first domain name.