V-Digger: An Efficient and Secure Vulnerability Assessment for Large-Scale ISP Network

Vulnerability assessment allows cyber security professionals to discover vulnerable end devices. Generally, in such a process one extracts the default Service Banner (SB) from the application layer message of each device, prior to matching the SB with each Common Vulnerabilities and Exposures (CVE) in the public National Vulnerability Database (NVD). However, such an approach is not practical in large-scale ISP networks due to the efforts involved (e.g., collecting of SBs, and CVE matching) and potential vulnerability information leakage. In this paper, we propose V-Digger, an efficient and secure vulnerability assessment approach. Specifically, we adopt a flexible distributed architecture based on Local Area Network (LAN), which allows each LAN of the respective ISP network to participate in vulnerability assessment and share vulnerability data as per demand. To obtain more SBs, we design a system parameter evaluation method, which ensures that the collection task is performed under light network load. To expedite CVE matching, we devise an efficient SB-to-CPE transformer and a fast CVE searching algorithm. To prevent vulnerability leakage, we also design a secure vulnerability sharing protocol. We then undertake extensive theoretical analysis and real-world experiments to prove the effectiveness and efficiency of V-Digger. The results show that the assessment accuracy can achieve almost 85%, and its assessment rate is about 330 seconds per 1,000 devices.