# US 12,003,362 B2 · Machine learning techniques for associating assets related to events with addressable computer network assets > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,362 B2 - Document ID: US12003362B2 - Status: Granted - Kind: B2 - Application number: 18/190,589 - Filed: 2023-03-27 - Published: 2024-02-01 - Granted: 2024-06-04 - Earliest claimed: 2022-07-27 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Stuart Millar; Ralph McTeggart - Web page: https://patentgrep.com/patent/US12003362B2 ## CPC - H04L 9/3247: {involving digital signatures} - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 3/08: Learning methods - H04L 9/3236: {using cryptographic hash functions} - H04L 41/06: Management of faults, events, alarms or notifications - H04L 41/12: Discovery or management of network topologies - H04L 41/16: using machine learning or artificial intelligence - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques comprising: obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated. ## Claims ### Claim 1 A method for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network, the asset catalog assets being addressable on the at least one computer network, the method comprising: using at least one computer hardware processor to perform: while monitoring activity on the at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature of the first asset and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature of the at least one asset was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated. ### Claim 2 (depends on 1) The method of claim 1, wherein the associating comprises identifying a subset of assets in the asset catalog using a locality sensitive hashing (LSH) technique and comparing the signature of the first asset with signatures of assets in the subset of assets. ### Claim 3 (depends on 2) The method of claim 2, wherein using the LSH technique comprises applying the LSH technique to the signature of the first asset, the applying comprising applying a min-hash technique to the signature of the first asset. ### Claim 4 (depends on 2) The method of claim 2, wherein using the LSH technique comprises applying the LSH technique to the signature of the first asset, the applying comprising encoding the signature using a plurality of randomized hyperplanes. ### Claim 5 (depends on 1) The method of claim 1, wherein the computer network addressing information indicates at least one value for at least one network parameter, the at least one network parameter selected from the group consisting of: a hostname for the first asset on the at least one computer network, an IP address for the first asset on the at least one computer network, and a MAC address for the first asset. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the signature of the first asset comprises generating a numeric representation of at least some of the computer network addressing information as the numeric representation. ### Claim 7 (depends on 6) The method of claim 6, wherein generating the numeric representation of the at least some of the computer network addressing information is performed using a character embedding technique. ### Claim 8 (depends on 7) The method of claim 7, wherein generating the numeric representation of the at least some of the computer network addressing information comprises: generating an initial numeric representation by applying the character embedding technique to the at least some of the computer network addressing information; and providing the initial numeric representation as input to the at least one trained machine learning model to obtain the numeric representation, wherein the numeric representation is a lower-dimensional representation than the initial numeric representation. ### Claim 9 (depends on 8) The method of claim 8, wherein at least one trained machine learning model comprises a plurality of trained machine learning models including a first machine learning model and a second machine learning model, wherein the initial numeric representation comprises a plurality of portions including a first portion and a second portion, and wherein the providing further comprises: providing the first portion of the initial numeric representation as input to a first machine learning model to obtain a corresponding first output; providing the second portion of the initial numeric representation as input to a second machine learning model to obtain a corresponding second output; and generating the numeric representation u the first output and second output. ### Claim 10 (depends on 8) The method of claim 8, wherein the at least one trained machine learning model comprises an autoencoder. ### Claim 11 (depends on 1) The method of claim 1, wherein the associating comprises calculating a Hamming distance between the signature of the first asset and at least one signature of the at least one asset in the asset catalog. ### Claim 12 (depends on 1) The method of claim 1, wherein the at least one asset consists of a single asset in the asset catalog. ### Claim 13 (depends on 1) The method of claim 1, wherein the at least one asset comprises multiple assets in the asset catalog, and wherein the associating comprises: comparing the signature of the first asset with signatures of each of the multiple assets in the asset catalog; and associating the first asset with a particular one of the multiple assets based on results of the comparing. ### Claim 14 (depends on 1) The method of claim 1, wherein the event related to the first asset comprises: a communication from the first asset, a communication directed to the first asset, or a communication identifying the first asset. ### Claim 15 (depends on 1) The method of claim 1, wherein the first asset is a physical device addressable on the at least one computer network. ### Claim 16 (depends on 1) The method of claim 1, wherein the first asset is a virtual device addressable on the at least one computer network. ### Claim 17 (depends on 16) The method of claim 16, wherein the virtual device is a container or a virtual machine. ### Claim 18 (depends on 1) The method of claim 1, further comprising: identifying a policy associated with the identified at least one asset; and processing the event related to the first asset in accordance with the identified policy. ### Claim 19 A system for associating events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network, the asset catalog assets being addressable on the at least one computer network, the system comprising: at least one computer hardware processor; and at least one non-transitory computer-readable storage medium storing processor executable instructions that, when executed by the at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising: while monitoring activity on the at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature of the first asset and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature of the at least one asset was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated. ### Claim 20 At least one non-transitory computer-readable storage medium storing processor executable instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising: while monitoring activity on at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information using at least one trained machine learning model, wherein the signature comprises a numeric representation of the first asset; associating the first asset with at least one asset in the asset catalog using the signature of the first asset and at least one signature of the at least one asset in the asset catalog, wherein the at least one signature of the at least one asset was previously determined using the at least one trained machine learning model; and outputting information identifying the at least one asset with which the first asset was associated.