Semi-autonomous Link Layer Vulnerability Discovery and Mitigation Dissemination

Abstract

Risk and vulnerability management is a critical task in maintaining any nontrivial network, but made increasingly difficult by the dynamic nature of internetworking, transient connectivity, and the use of virtual machines that are connected intermittently, while both real and virtual hosts may harbor vulnerabilities that must be addressed to protect both the vulnerable host and its environment whether these are known to an organization’s asset database or not. This is particularly critical if a security incident is in progress and the exposure to a vulnerability must be assessed and potentially mitigated as quickly and completely as possible. In this paper we therefore propose a probabilistic discovery and mitigation algorithm traversing a network with only knowledge of the immediate network neighborhood as can be obtained from passive observation of the LLDP protocol to minimize bandwidth consumption in con- junction with persistent agents deployed by the traversal to capture transient or intermittently active nodes and provide an analysis of the algorithm’s efficiency under different topologies and taking into account link failure as well as inconclusive or failed discovery and mitigation operation probabilities.