# US 11,909,759 B1 · Identifying assets for review > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,759 B1 - Document ID: US11909759B1 - Status: Granted - Kind: B1 - Application number: 16/548,068 - Filed: 2019-08-22 - Granted: 2024-02-20 - Earliest claimed: 2019-08-22 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Richard Tsang; Fatemeh Kazemeyni; Evgeniya Barkova - Web page: https://patentgrep.com/patent/US11909759B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Methods and systems for identifying assets for review. The methods described herein involve generating an organizational statistical model describing assets associated with a first organization and generating a report identifying a discrepancy between the organizational statistical model and an identified asset of the first type associated with the first organization. ## Claims ### Claim 1 A method comprising: executing, by one or more processors, instructions stored on memory, the execution comprising: generating an organizational statistical model describing assets associated with a first organization, wherein the organizational statistical model includes at least one cluster associated with a plurality of assets of a first type and designates a benchmark asset of the at least one cluster that is closest to a centroid of the at least one cluster; identifying an asset of the first type based on a discrepancy between the identified asset and the benchmark asset; generating, via a user interface, a report identifying the identified asset for review; and responsive to user feedback received via the user interface, initiating a threat mitigation procedure on the identified asset, wherein the mitigation procedure includes one or more of placing the identified asset on a blacklist, monitoring the identified asset for malicious, and quarantining the identified asset. ### Claim 2 (depends on 1) The method of claim 1 further comprising generating a cross-organizational statistical model, wherein the cross-organizational statistical model describes a plurality of assets having a plurality of asset types and associated with a plurality of organizations, wherein the cross-organizational statistical model clusters assets of the same type together. ### Claim 3 (depends on 1) The method of claim 1, wherein the user interface is configured to receive user feedback to confirm the discrepancy based on a comparison between the identified asset of the first type and the cross-organizational statistical model. ### Claim 4 (depends on 1) The method of claim 1, wherein the user interface is configured to receive user feedback to dismiss the discrepancy based on a comparison between the identified asset of the first type and the cross-organizational statistical model. ### Claim 5 (depends on 1) The method of claim 1 further comprising receiving organizational asset data at an interface and generating the organizational statistical model includes applying a clustering machine learning algorithm to organize the organizational asset data into a plurality of clusters, each cluster associated with a plurality of assets of the same type. ### Claim 6 (depends on 5) The method of claim 5 wherein the organizational asset data is delivered at scheduled intervals. ### Claim 7 (depends on 5) The method of claim 5 wherein the organizational asset data is configuration data retrieved from a device on a network associated with the first organization. ### Claim 8 (depends on 1) The method of claim 1 wherein the assets of the first organization are grouped into a plurality of clusters based on features of each asset, including one or more of software executing on the asset, versions of software executing on the asset, source IP address of a connection, destination IP address of a connection, connection history associated with the asset, duration of a connection involving the asset, ports used, timestamps of connections involving the asset, packet counts to or from the asset, bytes transmitted to or from the asset, services utilized by the asset. ### Claim 9 (depends on 1) The method of claim 1 wherein the identified asset is determined to be an anomalous asset in the cluster based on a number of assets in the cluster. ### Claim 10 (depends on 1) The method of claim 1 further comprising generating a report of installed assets utilizing the organizational statistical model. ### Claim 11 A system comprising: a computer system comprising one or more hardware processor configured to execute instructions stored on a non-transitory computer-readable medium to: receive, via an interface, organizational asset data related to a first organization; generate an organizational statistical model describing assets associated with a first organization, wherein the organizational statistical model includes at least one cluster associated with a plurality of assets of a first type and designates a benchmark asset of the at least one cluster that is closest to a centroid of the at least one cluster; identify an asset of the first type based on a discrepancy between the identified asset and the benchmark asset; generate, via a user interface, a report identifying the identified asset for review; and responsive to user feedback received via the user interface, initiate a threat mitigation procedure on the identified asset, wherein the mitigation procedure includes one or more of placing the identified asset on a blacklist, monitoring the identified asset for malicious, and quarantining the identified asset. ### Claim 12 (depends on 11) The system of claim 11 wherein the computer system is further configured to generate a cross-organizational statistical model, wherein the cross-organizational statistical model describes a plurality of assets having a plurality of asset types and associated with a plurality of organizations, wherein the cross-organizational statistical model clusters assets of the same type together. ### Claim 13 (depends on 11) The system of claim 11, wherein the user interface is configured to receive user feedback to confirm the discrepancy based on a comparison between the identified asset of the first type and the cross-organizational statistical model. ### Claim 14 (depends on 11) The system of claim 11, wherein the user interface is configured to receive user feedback to dismiss the discrepancy based on a comparison between the identified asset of the first type and the cross-organizational statistical model. ### Claim 15 (depends on 11) The system of claim 11 wherein the computer system generates the organizational statistical model by applying a clustering machine learning algorithm to organize the organizational asset data into a plurality of clusters, each cluster associated with a plurality of assets of the same type. ### Claim 16 (depends on 15) The system of claim 15 wherein the organizational asset data is delivered at scheduled intervals. ### Claim 17 (depends on 15) The system of claim 15 wherein the organizational asset data is configuration data retrieved from a device on a network associated with the first organization. ### Claim 18 (depends on 11) The system of claim 11 wherein the assets of the first organization are grouped into a plurality of clusters based on features of each asset, including one or more of software executing on the asset, versions of software executing on the asset, source IP address of a connection, destination IP address of a connection, connection history associated with the asset, duration of a connection involving the asset, ports used, timestamps of connections involving the asset, packet counts to or from the asset, bytes transmitted to or from the asset, services utilized by the asset. ### Claim 19 (depends on 11) The system of claim 11 wherein the identified asset is determined to be an anomalous asset in the cluster based on a number of assets in the cluster. ### Claim 20 (depends on 11) The system of claim 11 wherein the computer system is further configured to generate a report of installed assets utilizing the organizational statistical model.