Clustering domains for vulnerability scanning
AssigneeMicrosoft Technology Licensing, LLC
InventorAdam Hunt
Life of this patent
Estimating the term…
Abstract
Website assets are optimized for vulnerability scanning using node centrality techniques. A digital footprint of network nodes associated with a domain is determined. A similarity metric is defined using a weighted linear combination of features of a node. After determining a similarity metric for pairs of related nodes in the digital footprint of a domain, a set of centroids is determined. The reduced set of centroids is acted upon for vulnerability scanning.
Claims20
A computer-implemented method, comprising:
- detecting, at a network analysis system, a set of related nodes associated with a target domain;
- defining a similarity metric comprising a weighted linear combination of one or more features;
- calculating similarity scores associated with respective pairs of related nodes in the set of related nodes based on the similarity metric;
- determining a betweenness centrality measure for each related node in the set of related nodes based on a respective subset of the similarity scores that is associated with the respective related node;
- selecting a centroid node from the set of related nodes based on the centroid node having a betweenness centrality measure that is higher than the betweenness centrality measure of each other related node in the set of related nodes;
- and
- performing an action on the centroid node at the network analysis system.
One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
- detecting, at a network analysis system, a set of related nodes associated with a target domain;
- defining a similarity metric comprising a weighted linear combination of one or more features;
- calculating similarity scores associated with respective pairs of related nodes in the set of related nodes based on the similarity metric;
- determining a betweenness centrality measure for each related node in the set of related nodes based on a respective subset of the similarity scores that is associated with the respective related node;
- selecting a centroid node from the set of related nodes based on the centroid node having betweenness centrality measure that is higher than the betweenness centrality measure of each other related node in the set of related nodes;
- and
- performing an action on the centroid node at the network analysis system.
An apparatus, comprising:
- a subsystem, implemented at least partially in hardware, that detects, at a network analysis system, a set of related nodes associated with a target domain;
- a subsystem, implemented at least partially in hardware, that defines a similarity metric comprising a weighted linear combination of one or more features;
- a subsystem, implemented at least partially in hardware, that calculates similarity scores associated with respective pairs of related nodes in the set of related nodes based on the similarity metric;
- a subsystem, implemented at least partially in hardware, that determines a betweenness centrality measure for each related node in the set of related nodes based on a respective subset of the similarity scores that is associated with the respective related node;
- a subsystem, implemented at least partially in hardware, that selects a centroid node from the set of related nodes based on the centroid node having a betweenness centrality measure that is higher than the betweenness centrality measure of each other related node in the set of related nodes;
- and
- a subsystem, implemented at least partially in hardware, that performs an action on the centroid node at the network analysis system.
Dependencies are inferred from the claim text.