PVD: Passive vulnerability detection

The identification of vulnerabilities relies on detailed information about the target infrastructure. The gathering of the necessary information is a crucial step that requires an intensive scanning or mature expertise and knowledge about the system even though the information was already available in a different context. In this paper we propose a new method to detect vulnerabilities that reuses the existing information and eliminates the necessity of a comprehensive scan of the target system. Since our approach is able to identify vulnerabilities without the additional effort of a scan, we are able to increase the overall performance of the detection. Because of the reuse and the removal of the active testing procedures, our approach could be classified as a passive vulnerability detection. We will explain the approach and illustrate the additional possibility to increase the security awareness of users. Therefore, we applied the approach on an experimental setup and extracted security relevant information from web logs.

I. Introduction

Nowadays, the complexity of single systems and computer networks has reached a level which is almost unfeasible to maintain manually by system administrators. The total amount of different software, operating systems, specific versions, and individual configurations on a single computer exceeds the manageable number by far. Additionally, the possibilities to combine and link systems in a network increase this complexity. Thus, detecting vulnerabilities in a single system or in computer networks is a crucial problem. Especially large networks with numerous connected individual systems are difficult to analyze. The unique configuration of each system requires a new scan to identify the setup.