# US 10,122,722 B2 · Resource classification using resource requests > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,722 B2 - Document ID: US10122722B2 - Status: Granted - Kind: B2 - Application number: 14/899,640 - Filed: 2013-06-20 - Published: 2016-05-19 - Granted: 2018-11-06 - Earliest claimed: 2013-06-20 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Pratyusa Kumar Manadhata; Prasad V Rao; William G Home - Web page: https://patentgrep.com/patent/US10122722B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1433: {Vulnerability analysis} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one implementation, a resource classification system identifies a plurality of resource requests and generates a plurality of resource access measures based on the plurality of resource requests. Each resource request from the plurality of resource requests is associated with a resource from a plurality of resources by a resource identifier of that resource. Each resource access measure from the plurality of resource access measures is associated with a resource from the plurality of resources. The resource classification system applies a classifier to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure, and assign a security classification to each resource from the plurality of resources based on the classification result for that resource. ## Claims ### Claim 1 A processor-readable medium storing code representing instructions that when executed by a processor cause the processor to: identify a plurality of resource requests, each resource request from the plurality of resource requests associated with a resource from a plurality of resources by a resource identifier of that resource; determine whether a plurality of resource access measures were previously generated for the plurality of resource requests; update the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures; generate the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource requests, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure from the plurality of resource access measures is associated with the resource from the plurality of resources, and each resource access measure is a value that describes an average number of resource requests associated with the plurality of resource requests; apply the classifier for the resource access measures to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure; and assign a security classification to each resource from the plurality of resources based on the classification result for that resource. ### Claim 2 (depends on 1) The processor-readable medium of claim 1, wherein the plurality of resource requests include Domain Name System requests and Hypertext Transfer Protocol requests. ### Claim 3 (depends on 1) The processor-readable medium of claim 1, wherein the plurality of resource requests is a first plurality of resource requests, the plurality of resource access measures is generated at a first time, and the security classification assigned to each resource from the plurality of resources is a first security classification assigned to that resource before a second time, the processor-readable medium further storing code representing instructions that when executed at the processor cause the processor to: update, at the second time after the first time, the plurality of resource access measures based on a second plurality of resource requests and not based on the first plurality of resource requests; apply, after the second time, the classifier for the resource access measures to each resource access measure from the plurality of resource access measures; and assign a second security classification to each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures, after the second time, to the resource access measure from the plurality of resource access measures associated with that resource. ### Claim 4 (depends on 1) The processor-readable medium of claim 1, wherein the plurality of resource requests is a first plurality of resource requests, the plurality of resource access measures is generated at a first time, and the security classification assigned to each resource from the plurality of resources is a first security classification assigned to that resource before a second time, the processor-readable medium further storing code representing instructions that when executed at the processor cause the processor to: update, at the second time after the first time, the plurality of resource access measures based on a second plurality of resource requests and not based on the first plurality of resource requests; modify the classifier for the resource access measures using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications; apply, after the second time, the classifier for the resource access measures to each resource access measure from the plurality of resource access measures; and assign a second security classification to each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures, after the second time, to the resource access measure from the plurality of resource access measures associated with that resource. ### Claim 5 (depends on 1) The processor-readable medium of claim 1, wherein the code representing instructions that when executed at the processor cause the processor to generate the plurality of resource access measures includes code representing instructions that when executed at the processor cause the processor to: determine a sub-resource access measure for that resource from the plurality of resource requests. ### Claim 6 (depends on 1) The processor-readable medium of claim 1, wherein the code representing instructions that when executed at the processor cause the processor to generate the plurality of resource access measures includes code representing instructions that when executed at the processor cause the processor to: determine a host access measure for that resource, a group access measure for that resource, a sub-resource access measure for that resource, or a combination thereof from the plurality of resource requests. ### Claim 7 A resource classification method, comprising: accessing a plurality of resource request records representing resource requests for a plurality of resources, each resource request record from the plurality of resource request records associated with a resource from the plurality of resources by a resource identifier of that resource; determining whether a plurality of resource access measures were previously generated for the plurality of resource request records; updating the plurality of resource access measures based on the plurality of resource request records responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures; generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource request records, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure is a value that describes a ratio of a number of the resource request records associated with the plurality of resource request records; applying the classifier for the resource access measures to the plurality of resource access measures for each resource from the plurality of resources; and assigning a security classification to the plurality of resources for each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures to the plurality of resource access measures associated with that resource. ### Claim 8 (depends on 7) The method of claim 7, wherein: the plurality of resource request records include Domain Name System request records and Hypertext Transfer Protocol request records. ### Claim 9 (depends on 7) The method of claim 7, wherein generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources includes determining a sub-resource access measure for that resource. ### Claim 10 (depends on 7) The method of claim 7, wherein generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources includes determining a host access measure for that resource, a group access measure for that resource, a sub-resource access measure for that resource, or a combination thereof from the plurality of resource request records. ### Claim 11 (depends on 7) The method of claim 7, further comprising: modifying the classifier for the resource access measures, using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications. ### Claim 12 A resource classification system comprising: a hardware processor to identify a plurality of resource requests, each resource request from the plurality of resource requests associated with a resource from a plurality of resources by a resource identifier of that resource; the hardware processor to determine whether a plurality of resource access measures were previously generated for the plurality of resource requests; the hardware processor to update the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures; a resource access measurement hardware processor to generate the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource requests, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure from the plurality of resource access measures is associated with the resource from the plurality of resources; a classifier hardware processor to define the classifier for the resource access measures using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications, and to apply the classifier for the resource access measures to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure, wherein each resource access measure is a value that describes a number of unique clients that have requested access to the resource; and a security hardware processor to assign a security classification to each resource from the plurality of resources based on the classification result for that resource. ### Claim 13 (depends on 12) The system of claim 12, further comprising: a resource request processor to receive the plurality of resource request records associated with the plurality of resource requests from a plurality of resource authorities. ### Claim 14 (depends on 12) The system of claim 12, wherein: the plurality of resource requests is a first plurality of resource requests; the plurality of resource access measures is a first plurality of resource access measures generated at the resource access measurement processor a first time; the resource access measurement processor is configured to update at a second time a second plurality of resource access measures based on a second plurality of resource requests, each resource access measure from the second plurality of resource access measures associated with the resource from the plurality of resources; and the classifier hardware processor is configured to update the classifier for the resource access measures using resource access measures from the second plurality of resource access measures associated with the resources from the plurality of resources having known security classifications. ### Claim 15 (depends on 12) The system of claim 12, wherein: the resource access measurement processor is configured to determine from the plurality of resource requests at least one of a host access measure for each resource from the plurality of resources, a group access measure each resource from the plurality of resources, or a sub-resource access measure for each resource from the plurality of resources to generate the plurality of resource access measures.