# US 11,310,258 B2 · Network portion risk assessment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,258 B2
- Document ID: US11310258B2
- Status: Granted
- Kind: B2
- Application number: 16/583,023
- Filed: 2019-09-25
- Published: 2020-10-08
- Granted: 2022-04-19
- Earliest claimed: 2019-04-08
- Assignees: Forescout Technologies, Inc.
- Applicants: Forescout Technologies, Inc.
- Inventors: Arun Raghuramu; Aveek Kumar Das; Yang Zhang
- Web page: https://patentgrep.com/patent/US11310258B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/102: {Entity profiles}
- H04W 12/12: Detection or prevention of fraud
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04W 12/088: using filters or firewalls
- H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles
- H04W 12/73: Access point logical identity
- H04W 84/12: WLAN [Wireless Local Area Networks]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems, methods, and related technologies for determining a risk associated with a network portion are described. The determination of risk associated with a network portion may include accessing network traffic from a network and determining an entity type associated with at least one entity communicatively coupled to the network. A network portion associated with the at least one entity can be determined. A risk associated with the at least one entity can be determined. A risk associated with the network portion associated with the at least one entity can be determined based on the risk associated with the at least one entity. The risk associated with the network portion can then be stored.

## Claims

### Claim 1

A method comprising:
accessing network traffic from a network;
determining an entity type associated with at least one entity communicatively coupled to the network;
determining a network portion associated with the at least one entity based on a context of the at least one entity, wherein the context comprises at least one of an entity type and an entity function;
determining a risk associated with the at least one entity, wherein the risk associated with the at least one entity is based on an objective associated with minimizing entity sensitivity and an entity types mix within the network portion, wherein the entity sensitivity is based on the sensitivity of data that the entity processes or stores;
determining, by a processing device, a risk associated with the network portion associated with the at least one entity based on the risk associated with the at least one entity, wherein the risk associated with the network portion is based on the entity sensitivity associated with the at least one entity; and
storing the risk associated with the network portion.

### Claim 2 (depends on 1)

The method of claim 1, wherein the network portion is at least one of a virtual local access network (VLAN), a service set identifier (SSID), or a segment.

### Claim 3 (depends on 1)

The method of claim 1 further comprising:
performing an action based on the risk associated with the network portion.

### Claim 4 (depends on 3)

The method of claim 3, wherein the action comprises at least one of changing a VLAN associated with the at least one entity, quarantining the at least one entity, initiating an update, tracking traffic of the at least one entity, or sending a notification associated with the at least one entity.

### Claim 5 (depends on 1)

The method of claim 1, wherein the risk associated with the at least one entity is based on at least one of a Common Vulnerabilities and Exposures (CVE) associated with the at least one entity, patch version, software version, security posture, or credentials.

### Claim 6 (depends on 1)

The method of claim 1, wherein the risk associated with the at least one entity is based on a sensitivity associated with the at least one entity.

### Claim 7

A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access network traffic from a network;
determine an entity type associated with at least one entity communicatively coupled to the network;
determine a network portion associated with the at least one entity based on a context of the at least one entity, wherein the context comprises at least one of an entity type and an entity function;
determine a risk associated with the at least one entity, wherein the risk associated with the at least one entity is based on an objective associated with minimizing entity sensitivity and an entity types mix within the network portion, wherein the entity sensitivity is based on the sensitivity of data that the entity processes or stores;
determine a risk associated with the network portion associated with the at least one entity based on the risk associated with the at least one entity, wherein the risk associated with the network portion is based on a sensitivity associated with the at least one device; and
store the risk associated with the network portion.

### Claim 8 (depends on 7)

The system of claim 7, wherein the network portion is at least one of a virtual local access network (VLAN), a service set identifier (SSID), or a segment.

### Claim 9 (depends on 7)

The system of claim 7, the processing device further to:
perform an action based on the risk associated with the network portion.

### Claim 10 (depends on 9)

The system of claim 9, wherein the action comprises at least one of changing a VLAN associated with the at least one entity, quarantining the at least one entity, initiating an update, tracking traffic of the at least one entity, or sending a notification associated with the at least one entity.

### Claim 11 (depends on 7)

The system of claim 7, wherein the risk associated with the at least one entity is based on at least one of a Common Vulnerabilities and Exposures (CVE) associated with the at least one entity, patch version, software version, security posture, or credentials.

### Claim 12 (depends on 7)

The system of claim 7, wherein the risk associated with the at least one entity is based on a sensitivity associated with the at least one entity.

### Claim 13

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access network traffic from a network;
determine an entity type associated with at least one entity communicatively coupled to the network;
determine a network portion associated with the at least one entity based on a context of the at least one entity, wherein the context comprises at least one of an entity type and an entity function;
determine a risk associated with the at least one entity, wherein the risk associated with the at least one entity is based on an objective associated with minimizing entity sensitivity and an entity types mix within the network portion, wherein the entity sensitivity is based on the sensitivity of data that the entity processes or stores;
determine, by the processing device, a risk associated with the network portion associated with the at least one entity based on the risk associated with the at least one entity, wherein the risk associated with the network portion is based on a sensitivity associated with the at least one device; and
store the risk associated with the network portion.

### Claim 14 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the network portion is at least one of a virtual local access network (VLAN), a service set identifier (SSID), or a segment.

### Claim 15 (depends on 13)

The non-transitory computer readable medium of claim 13, the processing device further to perform an action based on the risk associated with the network portion.

### Claim 16 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the action comprises at least one of changing a VLAN associated with the at least one entity, quarantining the at least one entity, initiating an update, tracking traffic of the at least one entity, or sending a notification associated with the at least one entity.

### Claim 17 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the risk associated with the at least one entity is based on at least one of a Common Vulnerabilities and Exposures (CVE) associated with the at least one entity, a patch version, a software version, a security posture, or one or more credentials.