Palo Alto Networks, Inc.

Corey Fredericks

Matthew Kraning

Peter Dickinson

John Holliman

Matthew Anderson

Andrew Seidel

Andrew Clayton Scott

Techniques for identifying and managing an organization's remote attack surface that account for the fluid nature of the remote attack surface are described. Data collected from organization-issued endpoint devices are obtained and analyzed to determine public IP addresses used by the endpoint devices. The devices connected to external networks (i.e., non-organization networks) at various time windows are identified by distinguishing between public IP addresses that are associated with the organization and those that are not. Data obtained from ongoing global probing of public IP addresses, which at least indicate software instances hosted on networks corresponding to the public IP address, are correlated with each public IP address determined to be associated with an external network to which an endpoint device has connected. From these data, any security risks that connections to external networks may pose to the organization's network can be identified.

Remote attack surface discovery and management

A distributed system of scanning nodes is provided job portions to collectively scan network systems numbering in the tens of thousands and beyond million across the Internet. A scanning controller creates the job portions to fulfill a scanning request. The scanning controller creates the job portions based on availability of scanning nodes and a size of the scanning request (i.e., number of network addresses indicated by the request). The scanning controller creates each job portion with scanning instructions for an available scanning node to execute on a selected set of the network addresses indicated in the request, with each job portion having a different set of addresses to scan and being independently executable.

Distributed scanning

A system for scanning a network includes an interface and a processor. The interface is configured to receive an indication to scan a set of network addresses. The processor is configured to determine a set of available scanning nodes and determine a job plan for scanning the set of network addresses using the set of available scanning nodes. The job plan includes one or more job portions. The processor is configured to, for a job portion of the one or more job portions, select a scanning node of the set of available scanning nodes and provide the job portion to the scanning node.

Growing community of inventors

Oakland, CA, United States of America

Corey Fredericks