Back to results
US 11,689,554 B2Granted
Machine learned network vulnerability assessment
AssigneeRapid7, Inc.
InventorsJustin Pagano, Roy Hodgman
Life of this patent
Estimating the term…
Abstract
Methods and systems for identifying a network vulnerability. The system may gather data regarding a new or previously unknown network device, and compare the gathered data to one or more known devices that are scanned by a vulnerability assessment device. The vulnerability assessment device may then scan the previously unknown device upon a processor determining the previously unknown device shares at least one feature with a known device that is scanned.
Claims20
A method comprising:
- performing, by a vulnerability assessment system implemented by one or more computing devices:
- receiving scan configuration data that indicates:
- a plurality of known devices in a computer network known to the vulnerability assessment system, wherein each known device has respective features, and
- whether individual ones of the known devices are to be scanned for vulnerabilities;
- receiving network activity data from the computer network, wherein the network activity data indicates an unknown device in the network that is unknown to the vulnerability assessment system;
- determining, using a machine learned classifier, to scan the unknown device for vulnerabilities, wherein the machine learned classified is trained based on the respective features of the known devices, and the determination is made based on features of the unknown device;
- in response to the determination, generating a message to a user interface indicating the determination of the machine learned classifier to scan the unknown device;
- and
- in response to user input, updating the scan configuration data to enable scanning of the unknown device.
6 more elements
A system comprising:
- one or more computing devices that a vulnerability assessment system, configured to:
- receive scan configuration data that indicates:
- a plurality of known devices in a computer network known to the vulnerability assessment system, wherein each known device has respective features, and
- whether individual ones of the known devices are to be scanned for vulnerabilities;
- receive network activity data from the computer network, wherein the network activity data indicates an unknown device in the network that is unknown to the vulnerability assessment system;
- determine, using a machine learned classifier, to scan the unknown device for vulnerabilities, wherein the machine learned classified is trained based on the respective features of the known devices, and the determination is made based on features of the unknown device;
- in response to the determination, generate a message to a user interface indicating the determination of the machine learned classifier to scan the unknown device;
- and
- in response to user input, update the scan configuration data to enable scanning of the unknown device.
6 more elements
One or more non-transitory computer-readable media storing program instructions that when executed on one or more processors implement a vulnerability assessment system and cause the vulnerability assessment system to:
- receive scan configuration data that indicates:
- a plurality of known devices in a computer network known to the vulnerability assessment system, wherein each known device has respective features, and
- whether individual ones of the known devices are to be scanned for vulnerabilities;
- receive network activity data from the computer network, wherein the network activity data indicates an unknown device in the network that is unknown to the vulnerability assessment system;
- determine, using a machine learned classifier, to scan the unknown device for vulnerabilities, wherein the machine learned classified is trained based on the respective features of the known devices, and the determination is made based on features of the unknown device;
- in response to the determination, generate a message to a user interface indicating the determination of the machine learned classifier to scan the unknown device;
- and
- in response to user input, update the scan configuration data to enable scanning of the unknown device.
5 more elements
Dependencies are inferred from the claim text.