公开(公告)号：US20230362186A1

公开(公告)日：2023-11-09

申请号：US18222887

申请日：2023-07-17

申请人： QUALYS, INC.

发明人： Wissam Ali-Ahmad ,  Wolfgang Kandek ,  Holger Kruse ,  Vikas Dewan ,  Khair-ed-dine Mazboudi ,  Ganesh Jampani ,  Kenneth K. Okumura

IPC分类号： H04L9/40 ,  G06F3/048 ,  H04L67/02

CPC分类号： H04L63/1433 ,  H04L63/1441 ,  H04L63/166 ,  H04L63/1408 ,  G06F3/048 ,  H04L67/02 ,  H04L63/0281 ,  G06F2221/2101 ,  G06F2221/2119

摘要： Methods and systems for scanning an endpoint terminal across an open computer network are disclosed. An exemplary method includes providing a scanner engine in a computer server in communication with an open computer network, and establishing a secure connection across the open computer network between the scanner engine and a scanner agent installed on the endpoint terminal in communication with the open computer network. Commands for collecting data regarding the endpoint terminal are sent from the scanner engine across the secure connection to the scanner agent. The scanner engine then receives the collected data from the scanner agent across the secure connection, analyzes the data to assess a current posture of the endpoint terminal, and determines any updates for the endpoint terminal from the analysis. Updates are sent across the secure connection to the scanner agent for installation on the endpoint terminal, and the secure connection may then be terminated.

公开(公告)号：US11762991B2

公开(公告)日：2023-09-19

申请号：US17745733

申请日：2022-05-16

申请人： Qualys, Inc.

发明人： Ankur S. Tyagi ,  Mayuresh Vishwas Dani

IPC分类号： G06F21/55

CPC分类号： G06F21/554 ,  G06F2221/034

摘要： The present disclosure relates to methods, systems, and computer program products for generating an attack kill chain for threat analysis. The method comprises receiving a first security event captured by a first security operation associated with a computing device, and receiving a second security event captured by a second security operation associated with the computing device. The first security event and the second security event are associated with an attack campaign. The method further comprises mapping the first security event to first security data in an attack repository, and mapping the second security event to second security data in the attack repository. The method also comprises determining based on the mapping, one or more attack execution operations for executing the attack campaign associated with the first security event and the second security event. Additionally, the method sequences the one or more attack execution operations to form an attack kill chain.

公开(公告)号：US20220311798A1

公开(公告)日：2022-09-29

申请号：US17839339

申请日：2022-06-13

申请人： Qualys, Inc.

发明人： Mayuresh Vishwas Dani ,  Ankur S. Tyagi ,  Rishikesh Jayaram Bhide

IPC分类号： H04L9/40

摘要： Methods and systems for generating an attack path based on user and system risk profiles are presented. The method comprises determining user information associated with a computing device; determining system exploitability information of the computing device; determining system criticality information of the computing device; determining a risk profile for the computing device based on the user information, the system exploitability information, and the system criticality information; and generating an attack path based on the risk profile. The attack path indicates a route through which an attacker accesses the computing device. The system exploitability information indicates one or more of: the vulnerability associated with the computing device, an exposure window associated with the computing device, and a protection window associated with the computing device. The system criticality information indicates one or more: assets associated with the computing device and services associated with the computing device.

公开(公告)号：US11363052B2

公开(公告)日：2022-06-14

申请号：US16516734

申请日：2019-07-19

申请人： Qualys, Inc.

发明人： Mayuresh Vishwas Dani ,  Ankur S. Tyagi ,  Rishikesh Jayaram Bhide

IPC分类号： H04L9/40

摘要： Methods and systems for generating an attack path based on user and system risk profiles are presented. The method comprises determining user information associated with a computing device; determining system exploitability information of the computing device; determining system criticality information of the computing device; determining a risk profile for the computing device based on the user information, the system exploitability information, and the system criticality information; and generating an attack path based on the risk profile. The attack path indicates a route through which an attacker accesses the computing device. The system exploitability information indicates one or more of: the vulnerability associated with the computing device, an exposure window associated with the computing device, and a protection window associated with the computing device. The system criticality information indicates one or more: assets associated with the computing device and services associated with the computing device.

公开(公告)号：US20220006829A1

公开(公告)日：2022-01-06

申请号：US16920380

申请日：2020-07-02

申请人： Qualys, Inc.

发明人： Ganesh Nikam ,  Akash Shah

IPC分类号： H04L29/06 ,  G06F9/445 ,  G06F16/951 ,  G06F9/54

摘要： Methods and systems for securing an application programming interface (API) are presented. The method comprises: receiving API workflow data associated with an API testing tool and generating a scan configuration file using the API workflow data; crawling the collection of API requests by identifying and retrieving a link associated with the collection of API requests; and crawling the link to generate a crawled link response. The method also includes executing one or more vulnerability tests on the crawled link response including applying at least one passive detection rule to the crawled link response and fuzzing the link. The fuzzed link may be transmitted in a request to an application server following which scan data indicative of at least one vulnerability associated with a response from the application server may be generated. The scan data may be used to generate a vulnerability report.

公开(公告)号：US20210273972A1

公开(公告)日：2021-09-02

申请号：US17321185

申请日：2021-05-14

申请人： Qualys, Inc.

发明人： Sean M. Molloy ,  Terry Ramos ,  Sumedh Shrinand Thakar

IPC分类号： H04L29/06 ,  G06F16/25 ,  G06F16/907 ,  G06F16/901 ,  G06F16/2457 ,  G06Q10/08 ,  H04L29/08

摘要： A dynamical hierarchical tagging system connected to a user site through a remote communications network. The system may comprise a master controller, a job management server connected to the master controller, one or more scanners in communication with the job management server, wherein the one or more scanners are configured to scan for one or more user assets located at the user site, resulting in scan results, a scan logic processor connected to the master controller, wherein the scan logic processor is configured to store the scan results in a user database, a tagging logic engine connected to the master controller, wherein the tagging logic engine is configured to tag the scan results stored in the user database, and an indexing logic processor connected to the master controller, wherein the indexing logic processor is configured to search and index the tagged scan results stored in the user database.

公开(公告)号：US11102234B2

公开(公告)日：2021-08-24

申请号：US16872067

申请日：2020-05-11

申请人： Qualys, Inc.

发明人： Wissam Ali-Ahmad ,  Wolfgang Kandek ,  Holger Kruse ,  Vikas Dewan ,  Khair-ed-dine Mazboudi ,  Ganesh Jampani ,  Kenneth K. Okumura

IPC分类号： H04L29/06 ,  G06F3/048 ,  H04L29/08

摘要： Methods and systems for scanning an endpoint terminal across an open computer network are disclosed. An exemplary method includes providing a scanner engine in a computer server in communication with an open computer network, and establishing a secure connection across the open computer network between the scanner engine and a scanner agent installed on the endpoint terminal in communication with the open computer network. Commands for collecting data regarding the endpoint terminal are sent from the scanner engine across the secure connection to the scanner agent. The scanner engine then receives the collected data from the scanner agent across the secure connection, analyzes the data to assess a current posture of the endpoint terminal, and determines any updates for the endpoint terminal from the analysis. Updates are sent across the secure connection to the scanner agent for installation on the endpoint terminal, and the secure connection may then be terminated.

公开(公告)号：US10965709B2

公开(公告)日：2021-03-30

申请号：US16384321

申请日：2019-04-15

申请人： Qualys, Inc.

发明人： Mayuresh Vishwas Dani ,  Ankur S. Tyagi

IPC分类号： H04L29/06

摘要： The present describes simulating a threat-actor executing an attack execution operation. According to one aspect of the subject matter described in this disclosure, a method for generating a domain-specific language (DSL) simulant is disclosed. The method may comprise determining, a framework based on an attack repository, determining a first primitive based on the framework, and determining a second primitive based on the framework. In one implementation, the first primitive and the second primitive are fundamental structures or constructs within a DSL. The method further comprises combining the first primitive and the second primitive into a DSL simulant. In one implementation, the DSL simulant is executed to simulate a threat-actor executing an attack execution operation.

公开(公告)号：US20210021629A1

公开(公告)日：2021-01-21

申请号：US16516734

申请日：2019-07-19

申请人： Qualys, Inc.

发明人： Mayuresh Vishwas Dani ,  Ankur S. Tyagi ,  Rishikesh Jayaram Bhide

IPC分类号： H04L29/06

摘要： Methods and systems for generating an attack path based on user and system risk profiles are presented. The method comprises determining user information associated with a computing device; determining system exploitability information of the computing device; determining system criticality information of the computing device; determining a risk profile for the computing device based on the user information, the system exploitability information, and the system criticality information; and generating an attack path based on the risk profile. The attack path indicates a route through which an attacker accesses the computing device. The system exploitability information indicates one or more of: the vulnerability associated with the computing device, an exposure window associated with the computing device, and a protection window associated with the computing device. The system criticality information indicates one or more: assets associated with the computing device and services associated with the computing device.

公开(公告)号：US09613099B2

公开(公告)日：2017-04-04

申请号：US13272189

申请日：2011-10-12

申请人： Sean Molloy ,  Terry Ramos ,  Sumedh Thakar

发明人： Sean Molloy ,  Terry Ramos ,  Sumedh Thakar

IPC分类号： G06F17/30 ,  G06Q10/08

CPC分类号： H04L63/1433 ,  G06F17/30525 ,  G06F17/30563 ,  G06F17/30961 ,  G06F17/30997 ,  G06Q10/087 ,  H04L67/10

摘要： A dynamical hierarchical tagging system connected to a user site through a remote communications network. The system may comprise a master controller, a job management server connected to the master controller, one or more scanners in communication with the job management server, wherein the one or more scanners are configured to scan for one or more user assets located at the user site, resulting in scan results, a scan logic processor connected to the master controller, wherein the scan logic processor is configured to store the scan results in a user database, a tagging logic engine connected to the master controller, wherein the tagging logic engine is configured to tag the scan results stored in the user database, and an indexing logic processor connected to the master controller, wherein the indexing logic processor is configured to search and index the tagged scan results stored in the user database.