# US 11,310,132 B2 · System and method of identifying internet-facing assets

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,132 B2
- Document ID: US11310132B2
- Status: Granted
- Kind: B2
- Application number: 17/103,916
- Filed: 2020-11-24
- Published: 2021-03-18
- Granted: 2022-04-19
- Earliest claimed: 2014-10-21
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: David K. Pon; Elias Manousos; Chris Kiernan; Ben Adams; Megan Chiu; Jonas Edgeworth
- Web page: https://patentgrep.com/patent/US11310132B2

## CPC

- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L 61/4511: using domain name system [DNS]
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method includes receiving a seed at a computing device. The method further includes identifying, based on first domain name system (DNS) data, first border gateway protocol (BGP) data, first whois data, or a combination thereof, a plurality of first internet-facing assets related to the seed. The method further includes identifying, based on second DNS data, second BGP data, second whois data, or a combination thereof, a plurality of second internet-facing assets related to at least one of the first internet-facing assets. The method further includes generating a graphical user interface (GUI) that includes a list of internet-facing assets related to the seed, where the list includes the plurality of first internet-facing assets and the plurality of second internet-facing assets.

## Claims

### Claim 1

A method comprising:
creating a list of seeds at a computing device, wherein each seed in the list is associated with an asset type;
creating a list of internet-facing assets based on the list of seeds by recursively identifying internet-facing assets associated with each seed in the list of seeds;
retrieving information for each internet-facing asset in the list of internet-facing assets;
storing the retrieved information with each associated internet-facing asset in the list of internet-facing assets;
adding one or more internet-facing assets in the list of internet-facing assets to a list of internet-facing assets to be ignored in future identifying searches;
causing display of an alert upon determining that an internet facing asset in the list of internet-facing assets is a security risk.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to track changes that occur in that internet-facing asset.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to detect malware.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to detect malware;
in response to detecting malware on a particular internet-facing asset, causing display of an alert indicating that the internet-facing asset has been infected with malware.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to confirm policy compliance of that internet-facing asset.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to confirm policy compliance of that internet-facing asset;
in response to a finding that a particular internet-facing asset does not comply with a policy, causing display of an alert indicating that the internet-facing asset does not comply with the policy.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to confirm policy compliance of that internet-facing asset;
in response to a finding that a particular internet-facing asset does not comply with a policy, causing display of an alert indicating that the internet-facing asset does not comply with the policy;
removing the particular internet-facing asset from the continuous scanning group.

### Claim 9 (depends on 1)

The method of claim 1, wherein causing display of the alert further comprises:
receiving user input indicating that the user has selected the alarm;
in response to the indication that the user has selected the alarm, displaying additional details associated with the alarm.

### Claim 10

One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one of more processors cause performance of:
creating a list of seeds at a computing device, wherein each seed in the list is associated with an asset type;
creating a list of internet-facing assets based on the list of seeds by recursively identifying internet-facing assets associated with each seed in the list of seeds;
retrieving information for each internet-facing asset in the list of internet-facing assets;
storing the retrieved information with each associated internet-facing asset in the list of internet-facing assets;
adding one or more internet-facing assets in the list of internet-facing assets to a list of internet-facing assets to be ignored in future identifying searches;
causing display of an alert upon determining that an internet facing asset in the list of internet-facing assets is a security risk.

### Claim 11 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group.

### Claim 12 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to track changes that occur in that internet-facing asset.

### Claim 13 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to detect malware.

### Claim 14 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to detect malware;
in response to detecting malware on a particular internet-facing asset, causing display of an alert indicating that the internet-facing asset has been infected with malware.

### Claim 15 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to confirm policy compliance of that internet-facing asset.

### Claim 16 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to confirm policy compliance of that internet-facing asset;
in response to a finding that a particular internet-facing asset does not comply with a policy, causing display of an alert indicating that the internet-facing asset does not comply with the policy.

### Claim 17 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, further comprising:
adding one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scanning each internet-facing asset in the continuous scanning group to confirm policy compliance of that internet-facing asset;
in response to a finding that a particular internet-facing asset does not comply with a policy, causing display of an alert indicating that the internet-facing asset does not comply with the policy;
removing the particular internet-facing asset from the continuous scanning group.

### Claim 18 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, wherein causing display of the alert further comprises:
receiving user input indicating that the user has selected the alarm;
in response to the indication that the user has selected the alarm, displaying additional details associated with the alarm.

### Claim 19

An apparatus, comprising:
one or more processors; and
a memory storing instructions, which when executed by the one or more processors, cause the one or more processors to:
create a list of seeds at a computing device, wherein each seed in the list is associated with an asset type;
create a list of internet-facing assets based on the list of seeds by recursively identifying internet-facing assets associated with each seed in the list of seeds;
retrieve information for each internet-facing asset in the list of internet-facing assets;
store the retrieved information with each associated internet-facing asset in the list of internet-facing assets;
add one or more internet-facing assets in the list of internet-facing assets to a list of internet-facing assets to be ignored in future identifying searches;
cause display of an alert upon determining that an internet facing asset in the list of internet-facing assets is a security risk.

### Claim 20 (depends on 19)

The apparatus of claim 19, wherein the instructions, which when executed by the one or more processors, further cause the one or more processors to:
add one or more internet-facing assets in the list of the plurality of internet-facing assets to a continuous scanning group;
continuously scan each internet-facing asset in the continuous scanning group to detect malware;
in response to detecting malware on a particular internet-facing asset, cause display of an alert indicating that the internet-facing asset has been infected with malware.