SYSTEM AND METHOD FOR THREE-DIMENSIONAL VISUALIZATION OF VULNERABILITY AND ASSET DATA

• US 20110277034A1
• Filed: 05/06/2010
• Published: 11/10/2011
• Est. Priority Date: 05/06/2010
• Status: Active Grant

• Current Assignee: Tenable, Inc. (Tenable Holdings, Inc.)
• Original Assignee: Tenable Network Security Incorporated (Tenable Holdings, Inc.)
• Inventors: Hanson, Jim
• Granted Patent: US 8,549,650 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The system and method for three-dimensional visualization of vulnerability and asset data described herein may provide a management console that integrates various active vulnerability scanners, various passive vulnerability scanners, and a log correlation engine distributed in a network. In particular, the management console may include a three-dimensional visualization tool that can be used to generate three-dimensional visualizations that graphically represent vulnerabilities and assets in the network from the integrated information that management console collects the active vulnerability scanners, the passive vulnerability scanners, and the log correlation engine distributed in the network. As such, the three-dimensional visualization tool may generate three-dimensional representations of the vulnerabilities and assets in the network that can be used to substantially simplify management of the network.

Claims

1. A system for three-dimensional visualization of vulnerability and asset data, comprising:

one or more active vulnerability scanners configured to conduct one or more active scans in a network, wherein the active vulnerability scanners interrogate a plurality of hosts in the network during the one or more active scans conducted in the network;

one or more passive vulnerability scanners configured to passively observe traffic traveling in the network, wherein the passive vulnerability scanners reconstructs one or more sessions involving one or more of the plurality of hosts from the passively observed traffic;

a log correlation engine configured to correlate a plurality of events contained in one or more logs that describe activity detected in the network; and

a management console configured to;

collect information obtained from the active vulnerability scanners interrogating the plurality of hosts, the passive vulnerability scanners reconstructing the one or more sessions, and the log correlation engine correlating the plurality of events;

build a model of the network with the information collected from the active vulnerability scanners, the passive vulnerability scanners, and the log correlation engine, wherein the model of the network includes the plurality of hosts and a plurality of potential vulnerabilities associated with the plurality of hosts; and

display a three-dimensional visualization that graphically represents the model of the network, wherein the three-dimensional visualization includes one or more relationships between the plurality of hosts and the plurality of potential vulnerabilities.

2. The system of claim 1, wherein the collected information includes traceroute data describing one or more of the plurality of hosts that the traffic traverses and one or more of the plurality of hosts that represent destinations for the traffic.

3. The system of claim 2, wherein the three-dimensional visualization includes a routing topology with one or more routing nodes that represent the one or more hosts traversed by the traffic and one or more leaf nodes that represent the destinations for the traffic.

4. The system of claim 3, wherein the routing topology includes a cylindrical helix having the routing nodes placed directly thereon and further having the leaf nodes connected to the routing nodes on vectors directed outward from the cylindrical helix.

5. The system of claim 3, the management console further configured to apply a mirroring visual effect to the three-dimensional visualization, wherein the mirror visual effect reflects the graphically represented network model within the three-dimensional visualization.

6. The system of claim 3, the management console further configured to apply a rotation visual effect to the three-dimensional visualization, wherein the mirror visual effect rotates the graphically represented network model about one axis of the three-dimensional visualization.

7. The system of claim 3, wherein the three-dimensional visualization graphically represents one or more of the routing nodes in the network model commonly traversed by the traffic, dead space in the network model that the traffic does not traverse, and choke points that represent bottlenecks in the network model.

8. The system of claim 7, the management console further configured to modify functionality for one or more of the active vulnerability scanners, the passive vulnerability scanners, or the log correlation engine based on one or more of the commonly traversed routing nodes, the dead space, or the choke points in the network model.

9. The system of claim 3, the management console further configured to display one or more playback controls that present temporal changes to the three-dimensional visualization that occur over time in response to one or more interactions with the playback controls.

10. The system of claim 1, the management console further configured to apply one or more color codes to the three-dimensional visualization, wherein the color codes represent values associated with one or more of the plurality of hosts, the plurality of potential vulnerabilities, or the one or more relationships between the plurality of hosts and the plurality of potential vulnerabilities.

11. The system of claim 1, the management console further configured to filter the model of the network in response to a query that includes one or more criteria, wherein the one or more relationships graphically represented in the three-dimensional visualization match the criteria provided in the query.

12. The system of claim 1, the management console further configured to receive custom input data from a client device in communication with the management console, wherein the management console further builds the model of the network with the custom input data received from the client device.

13. The system of claim 1, the management console further configured to display the three-dimensional visualization with one or more supplementary visualizations within one three-dimensional space, wherein the three-dimensional space further includes one or more relationships between one or more data points in the three-dimensional visualization and one or more data points in the one or more supplementary visualizations.

14. A method for three-dimensional visualization of vulnerability and asset data, comprising:

conducting one or more active scans in a network, wherein one or more active vulnerability scanners interrogate a plurality of hosts in the network during the one or more active scans conducted in the network;

passively observing traffic traveling in the network, wherein one or more passive vulnerability scanners reconstruct one or more sessions involving one or more of the plurality of hosts from the passively observed traffic;

correlating a plurality of events contained in one or more logs that describe activity detected in the network, wherein a log correlation engine correlates the plurality of events that describe the activity detected in the network;

building a model of the network with information collected from the active vulnerability scanners interrogating the plurality of hosts, the passive vulnerability scanners reconstructing the one or more sessions, and the log correlation engine correlating the plurality of events, wherein the model of the network includes the plurality of hosts and a plurality of potential vulnerabilities associated with the plurality of hosts; and

displaying a three-dimensional visualization that graphically represents the model of the network, wherein the three-dimensional visualization includes one or more relationships between the plurality of hosts and the plurality of potential vulnerabilities.

15. The method of claim 14, wherein the collected information includes traceroute data describing one or more of the plurality of hosts that the traffic traverses and one or more of the plurality of hosts that represent destinations for the traffic.

16. The method of claim 15, wherein the three-dimensional visualization includes a routing topology with one or more routing nodes that represent the one or more hosts traversed by the traffic and one or more leaf nodes that represent the destinations for the traffic.

17. The method of claim 16, wherein the routing topology includes a cylindrical helix having the routing nodes placed directly thereon and further having the leaf nodes connected to the routing nodes on vectors directed outward from the cylindrical helix.

18. The method of claim 16, further comprising applying a mirroring visual effect to the three-dimensional visualization, wherein the mirror visual effect reflects the graphically represented network model within the three-dimensional visualization.

19. The method of claim 16, further comprising applying a rotation visual effect to the three-dimensional visualization, wherein the mirror visual effect rotates the graphically represented network model about one axis of the three-dimensional visualization.

20. The method of claim 16, wherein the three-dimensional visualization graphically represents one or more of the routing nodes in the network model commonly traversed by the traffic, dead space in the network model that the traffic does not traverse, and choke points that represent bottlenecks in the network model.

21. The method of claim 20, further comprising modifying functionality for one or more of the active vulnerability scanners, the passive vulnerability scanners, or the log correlation engine based on one or more of the commonly traversed routing nodes, the dead space, or the choke points in the network model.

22. The method of claim 16, further comprising displaying one or more playback controls that present temporal changes to the three-dimensional visualization that occur over time in response to one or more interactions with the playback controls.

23. The method of claim 14, further comprising applying one or more color codes to the three-dimensional visualization, wherein the color codes represent values associated with one or more of the plurality of hosts, the plurality of potential vulnerabilities, or the one or more relationships between the plurality of hosts and the plurality of potential vulnerabilities.

24. The method of claim 14, further comprising filtering the model of the network in response to a query that includes one or more criteria, wherein the one or more relationships graphically represented in the three-dimensional visualization match the criteria provided in the query.

25. The method of claim 14, further comprising receiving custom input data from a client device, wherein the model of the network further includes the custom input data received from the client device.

26. The method of claim 14, further comprising displaying the three-dimensional visualization with one or more supplementary visualizations within one three-dimensional space, wherein the three-dimensional space further includes one or more relationships between one or more data points in the three-dimensional visualization and one or more data points in the one or more supplementary visualizations.