Network Monitoring and Enumerating Vulnerabilities in Large Heterogeneous Networks

Abstract

In this paper, we present an empirical study on vulnerability enumeration in computer networks using common network probing and monitoring tools. We conducted active network scans and passive network monitoring to enumerate software resources and their version present in the network. Further, we used the data from third-party sources, such as Internet-wide scanner Shodan. We correlated the measurements with the list of recent vulnerabilities obtained from NVD using the CPE as a common identifier used in both domains. Subsequently, we compared the approaches in terms of network coverage and precision of system identification. Finally, we present a sample list of vulnerabilities observed in our campus network. Our work helps in approximating the number of vulnerabilities and vulnerable hosts in large networks, where it is often impractical or costly to perform vulnerability scans using specialized tools, and in situations, where a quick estimate is more important than thorough analysis.

Design and Implementation of Network Monitoring System for Campus Infrastructure Using Software Agents

“…This design based on multiple agents is scalable to allow the incorporation of other protocols in the collection and analysis of the data to convert it into information or present it in the form of a report or graphical interface. It can be used at the level of energy consumption calculation, in a similar way as those presented in the literature (Laštovička et al, 2020;Jin et al, 2019;Allahham and Rahman, 2018), with the great difference of reducing the number of sensors required, that is, the hardware component is reduced through the estimation of energy levels based on theoretical models, and some agent of the developed system is in charge of computing them.…”

“…Finally, network monitoring has evolved into the field of cybersecurity as a monitoring system on a campus and industry infrastructure to identify and mitigate potential vulnerabilities (Laštovička et al, 2020), in addition to analyzing the network flow with recurring neural networks (Yang et al, 2020), wireless analysis (Jin et al, 2019;Allahham and Rahman, 2018), or risk assessment (Awang et al, 2020).…”

Current Challenges of Cyber Threat and Vulnerability Identification Using Public Enumerations

“…OS fingerprinting captures network connection properties, such as TCP window size and Time to Live (TTL), to infer the device's operating system. Passive OS fingerprinting from IP flow was used by Laštovička et al [23] to enumerate vulnerabilities in large networks.…”

“…Vulnerability Discovery Precision: Another issue of vulnerability discovery is a lot of false positives. Methods that have extensive coverage (e.g., based on OS fingerprinting) can be imprecise or will not reveal sufficient details [23]. It causes employees to spend much time validating vulnerabilities [14], e.g., using vulnerability scanners that can use automated vulnerability exploits to confirm true positives.…”

“…Gawron et al [16] can often extract only an application name and a version from logs for the CPE match strings (see Figure 2). On the contrary, Laštovička et al [23] used active scanning and passive monitoring that can determine only the first parts of the match string up to the version part.…”