# US 11,308,403 B1 · Automatic identification of critical network assets of a private computer network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,403 B1 - Document ID: US11308403B1 - Status: Granted - Kind: B1 - Application number: 15/586,602 - Filed: 2017-05-04 - Granted: 2022-04-19 - Earliest claimed: 2017-05-04 - Assignees: Trend Micro Incorporated - Applicants: Trend Micro Incorporated - Inventors: Ping-I Chou; Yen-Shuo Huang - Web page: https://patentgrep.com/patent/US11308403B1 ## CPC - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - G06Q 10/0631: Resource planning, allocation, distributing or scheduling for enterprises or organisations - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Critical network assets of a private computer are automatically identified by training a machine learning model with histograms of features obtained by aggregating data of log entries. The model is deployed in a private computer network and retrained using training data set of the private computer network. Data from log entries of a target network asset are aggregated, numerically transformed, and converted into features histograms. The features histograms are concatenated into a single file, which is provided to the machine learning model for prediction. The machine learning model outputs a prediction score that gives an indication of whether or not the target network asset is critical. ## Claims ### Claim 1 A computer-implemented method comprising: receiving a plurality of log entries from a log of a private computer network; extracting, from the log entries, particular log entries that indicate logins to a target computer of the private computer network; aggregating the particular log entries to generate a histogram of logins to the target computer; inputting the histogram to a machine learning model to determine whether or not the target computer is a type of computer that provides a service to other computers of the private computer network; receiving a prediction from the machine learning model indicating that the target computer is the type of computer that provides the service to the other computers of the private computer network; and in response to the prediction, providing security to the target computer. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving the machine learning model from a support server computer that is outside the private computer network. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, further comprising: after receiving the machine learning model in the private computer network, retraining the machine learning model in the private computer network. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: numerically transforming the histogram before the histogram is input to the machine learning model. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein numerically transforming the histogram includes applying a logarithmic function to the histogram. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: before inputting the histogram to the machine learning model, transcoding the histogram into a comma separated value format. ### Claim 7 A computer-implemented method comprising: receiving a plurality of log entries from a log of a private computer network; extracting, from the log entries, particular log entries that indicate access to a target account of a service provided on the private computer network; aggregating the particular log entries to generate a histogram of accesses to the target account; inputting the histogram to a machine learning model to determine whether or not the target account is an administrator account of the service; and determining that the target account is the administrator account of the service based on a prediction from the machine learning model. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, further comprising: receiving the machine learning model from a support server computer that is outside the private computer network. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, further comprising: after receiving the machine learning model in the private computer network, retraining the machine learning model in the private computer network. ### Claim 10 (depends on 7) The computer-implemented method of claim 7, further comprising: numerically transforming the histogram before the histogram is input to the machine learning model. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein numerically transforming the histogram includes applying a logarithmic function to the histogram. ### Claim 12 (depends on 7) The computer-implemented method of claim 7, further comprising: before inputting the histogram to the machine learning model, transcoding the histogram into a comma separated value format. ### Claim 13 A computer system comprising a memory and a processor, the memory including instructions that when executed by the processor causes the computer system to: receive a plurality of log entries from a log of a private computer network; extract, from the log entries, particular log entries that indicate access to a target asset of the private computer network; aggregate the particular log entries to generate a histogram of accesses to the target asset; input the histogram to a machine learning model; and receive a prediction from the machine learning model, the prediction indicating a likelihood that the target asset is a critical asset that is more important than other assets of a same type as the target asset. ### Claim 14 (depends on 13) The computer system of claim 13, wherein the instructions, when executed by the processor, further cause the computer system to: determine that the target asset is the critical asset in response to the likelihood being greater than a threshold. ### Claim 15 (depends on 14) The computer system of claim 14, wherein the target asset is a type of computer that provides a service to other computers of the private computer network. ### Claim 16 (depends on 14) The computer system of claim 14, wherein the target asset is an administrator account of a service provided on the private computer network. ### Claim 17 (depends on 13) The computer system of claim 13, wherein the prediction indicates the likelihood of the target asset being a server computer that provides a service to other computers of the private computer network as opposed to a normal user computer that is employed by a single user. ### Claim 18 (depends on 13) The computer system of claim 13, wherein the prediction indicates the likelihood of the target asset being an administrator account as opposed to a normal user account.