# US 11,310,120 B1 · Techniques for detection and analysis of network assets under common management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,120 B1 - Document ID: US11310120B1 - Status: Granted - Kind: B1 - Application number: 15/980,688 - Filed: 2018-05-15 - Granted: 2022-04-19 - Earliest claimed: 2017-05-15 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Jonathan Matkowsky - Web page: https://patentgrep.com/patent/US11310120B1 ## CPC - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/085: Retrieval of network configuration; Tracking network configuration history - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are disclosed of detection and analysis of network-based assets under common management by an entity. Network-based assets that are under common management by an entity may be owned or associated with the entity. Some network assets may appear to be under the common management of an entity, but may be operated by an unauthorized entity. Detecting a relationship between or ownership of network assets for malicious network activity may be a challenge. Specifically, the connection between authorized assets and unauthorized assets may be difficult to identify, especially if assets are masked or changed to evade detection. A network analytic system is disclosed that can process different data from multiple sources (e.g., at least multiple, disparate data sources) to identify relationships between network-based assets. ## Claims ### Claim 1 A method comprising: gathering a plurality of data sets from a plurality of data sources; receiving one or more criteria via a graphical interface, the one or more criteria used to filter the plurality of data sets into a plurality of data records; generating the graphical interface to display the plurality of data records; receiving, via the graphical interface, a first selection of a first attribute of the plurality of data records, wherein the first attribute comprises a name server attribute; generating the graphical interface to display a first filtered plurality of data records based on the first selection of the first attribute filtering the plurality of data records; receiving, via the graphical interface, a second selection of a second attribute of the first filtered plurality of data records; filtering the first filtered plurality of data records based on the second attribute to generate a second filtered plurality of data records; identifying, using the first attribute and the second attribute received via the graphical interface and one or more rules, one or more data records in the second filtered plurality of data records having a suspect relationship with one or more network assets of an entity previously identified as potentially malicious, wherein the one or more rules indicate the suspect relationship based on the first attribute and the second attribute; and causing the graphical interface to display the one or more data records with a visual appearance associated with the one or more network assets of the entity identified as potentially malicious based on the identified suspect relationship. ### Claim 2 (depends on 1) The method of claim 1, wherein the second attribute is a domain attribute. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more criteria include one or more of a descriptive tag, Internet Protocol address, application programming interface Internet Protocol address, source, date, and reason. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving user input in the graphical interface, wherein the graphical interface includes a preview panel configured to display web content retrieved from a selected domain name responsive to the user input comprising a user selection of the selected domain name on the graphical interface; and displaying the retrieved web content from the selected domain name in the preview panel responsive to the user input. ### Claim 5 (depends on 1) The method of claim 1, wherein the graphical interface includes a filter dialog interface to receive one or more data values associated with the one or more criteria. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving user input in the graphical interface, wherein the user input comprises custom data to tag a selected data record of the one or more data records with user-specified information associated with the one or more network assets of the entity. ### Claim 7 A system comprising: a network analytic component, implemented at least partially by hardware, configured to: gather a plurality of data sets from a plurality of data sources; receive one or more criteria via a graphical interface, the one or more criteria used to filter the plurality of data sets into a plurality of data records; generate the graphical interface to display the plurality of data records; receive, via the graphical interface, a first selection of a first attribute of the plurality of data records, wherein the first attribute comprises a name server attribute; generate the graphical interface to display a first filtered plurality of data records based on the first selection of the first attribute filtering the plurality of data records; receive, via the graphical interface, a second selection of a second attribute of the first filtered plurality of data records; filter the first filtered plurality of data records based on the second attribute to generate a second filtered plurality of data records; identify, using the first attribute and the second attribute received via the graphical interface and one or more adjustable rules, one or more data records in the second filtered plurality of data records having a suspect relationship with one or more network assets of an entity previously identified as potentially malicious, wherein the one or more rules indicate the suspect relationship based on the first attribute and the second attribute; and cause the graphical interface to display the one or more data records with a visual appearance associated with the one or more network assets of the entity identified as potentially malicious based on the identified suspect relationship. ### Claim 8 (depends on 7) The system of claim 7, wherein the second attribute is a domain attribute. ### Claim 9 (depends on 7) The system of claim 7, wherein the one or more criteria include one or more of a descriptive tag, Internet Protocol address, application programming interface Internet Protocol address, source, date, and reason. ### Claim 10 (depends on 7) The system of claim 7, wherein the network analytic component, implemented at least partially by hardware, is further configured to: receive user input in the graphical interface, wherein the graphical interface includes a preview panel configured to display web content retrieved from a selected domain name responsive to the user input comprising a user selection of the selected domain name on the graphical interface; and display the retrieved web content from the selected domain name in the preview panel responsive to the user input. ### Claim 11 (depends on 7) The system of claim 7, wherein the graphical interface includes a filter dialog interface to receive one or more data values associated with the one or more criteria. ### Claim 12 (depends on 7) The system of claim 7, wherein the network analytic component, implemented at least partially by hardware, is further configured to: receive user input in the graphical interface, wherein the user input comprises custom data to tag a selected data record of the one or more data records with user-specified information associated with the one or more network assets of the entity. ### Claim 13 One or more non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause: gathering a plurality of data sets from a plurality of data sources; receiving one or more criteria via a graphical interface, the one or more criteria used to filter the plurality of data sets into a plurality of data records; generating the graphical interface to display the plurality of data records; receiving, via the graphical interface, a first selection of a first attribute of the plurality of data records, wherein the first attribute comprises a name server attribute; generating the graphical interface to display a first filtered plurality of data records based on the first selection of the first attribute filtering the plurality of data records; receiving, via the graphical interface, a second selection of a second attribute of the first filtered plurality of data records; filtering the first filtered plurality of data records based on the second attribute to generate a second filtered plurality of data records; identifying, using the first attribute and the second attribute received via the graphical interface and one or more adjustable rules, one or more data records in the second filtered plurality of data records having a suspect relationship with one or more network assets of an entity previously identified as potentially malicious, wherein the one or more rules indicate the suspect relationship based on the first attribute and the second attribute; and causing the graphical interface to display the one or more data records with a visual appearance associated with the one or more network assets of the entity identified as potentially malicious based on the identified suspect relationship. ### Claim 14 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the second attribute is a domain attribute. ### Claim 15 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the one or more criteria include one or more of a descriptive tag, Internet Protocol address, application programming interface Internet Protocol address, source, date, and reason. ### Claim 16 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the instructions that, when executed by one or more computing devices, further cause: receiving user input in the graphical interface, wherein the graphical interface includes a preview panel configured to display web content retrieved from a selected domain name responsive to the user input comprising a user selection of the selected domain name on the graphical interface; and displaying the retrieved web content from the selected domain name in the preview panel responsive to the user input. ### Claim 17 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the graphical interface includes a filter dialog interface to receive one or more data values associated with the one or more criteria. ### Claim 18 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the instructions that, when executed by one or more computing devices, further cause: receiving user input in the graphical interface, wherein the user input comprises custom data to tag a selected data record of the one or more data records with user-specified information associated with the one or more network assets of the entity.