Method for predicting security risks of assets on a computer network

A method for predicting security risks of assets on a computer network, the method comprising:

• over a first period of time:
• detecting a first set of assets connected to the computer network;
• and
• detecting a first set of behaviors by the first set of assets connected to the computer network;
• partitioning the first set of assets into a first instance of a first cluster of assets and a first instance of a second cluster of assets, assets in the first instance of the first cluster of assets exhibiting similar behaviors during the first period of time, and assets in the first instance of the second cluster of assets exhibiting similar behaviors during the first period of time;
• over a second period of time succeeding the first period of time:
• detecting a second set of assets connected to the computer network;
• and
• detecting a second set of behaviors by the second set of assets connected to the computer network;
• partitioning the second set of assets into a second instance of the first cluster of assets and a second instance of the second cluster of assets, assets in the second instance of the first cluster of assets exhibiting similar behaviors during the second period of time, and assets in the second instance of the second cluster of assets exhibiting similar behaviors during the second period of time;
• identifying a particular asset that shifted from proximal the first instance of the first cluster toward the second instance of the second cluster from the first period of time to the second period of time;
• and
• generating a security alert to investigate the particular asset,
• wherein generating the security alert comprises:
• calculating a deviation rate that measures deviation over time of the particular asset from the first cluster of assets toward the second cluster of assets between the first period of time and the second period of time;
• calculating a security risk score for the particular asset as a function of the deviation rate;
• and
• generating the security alert for the particular asset in response to the security risk score exceeding an alert threshold score;
• and
• wherein calculating the deviation rate of the particular asset from the first cluster of assets comprises computing the deviation rate of the particular asset from the first cluster of assets over a sequence of scans of the computer network.

A method for predicting security risks of assets on a computer network, the method comprising:

• over a first period of time:
• detecting an asset connected to the computer network;
• and
• detecting a first set of behaviors exhibited by the asset connected to computer network during the first period of time;
• associating the asset with a first set of assets based on similarity of the first set of behaviors to behaviors characteristic of the first set of assets;
• over a second period of time succeeding the first period of time:
• detecting the asset connected to the computer network;
• and
• detecting a second set of behaviors exhibited by the asset connected to the computer network during the second period of time;
• detecting deviation of the asset from the first set of assets based on differences between the second set of behaviors and behaviors characteristic of the first set of assets;
• and
• generating a security alert for the asset in response to deviation of the asset from the first set of assets,
• wherein generating the security alert for the asset comprises:
• calculating a rate of deviation that measures deviation over time of the asset from the first set of assets from the first period of time and the second period of time;
• calculating a security risk score for the asset as a function of the rate of deviation;
• and
• generating the security alert for the asset in response to the security risk score exceeding an alert threshold score;
• and
• wherein calculating the deviation rate of the asset from the first set of assets comprises computing the deviation rate of the asset from the first set of assets over a sequence of scans of the computer network.