# US 12,058,177 B2 · Cybersecurity risk analysis and anomaly detection using active and passive external reconnaissance

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,058,177 B2
- Document ID: US12058177B2
- Status: Granted
- Kind: B2
- Application number: 17/220,150
- Filed: 2021-04-01
- Published: 2021-11-18
- Granted: 2024-08-06
- Earliest claimed: 2015-10-28
- Assignees: Qomplx LLC
- Applicants: Qomplx LLC
- Inventors: Jason Crabtree; Andrew Sellers; Richard Kelley
- Web page: https://patentgrep.com/patent/US12058177B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 16/2477: {Temporal data queries}
- G06F 16/951: Indexing; Web crawling techniques
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for cybersecurity risk analysis and anomaly detection using active and passive external reconnaissance, that identifies critical network entities within a cyber-physical graph, identifies anomalous events within the network, determines the risk of identified anomalies based on the value of the entities involved, and determines an effectiveness score for the network based on the identified risks.

## Claims

### Claim 1

A system for cybersecurity profiling and rating using internal and external reconnaissance, comprising:
a cyber-physical graph module comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to create a cyber-physical graph of an organization using information about the organization, the cyber-physical graph comprising nodes representing entities associated with the organization and edges representing relationships between entities associated with the organization;
a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
perform a reconnaissance search using the cyber-physical graph; and
apply a plurality of results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and
a scoring engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
receive the cybersecurity profile and the reconnaissance search results;
using the cyber-physical graph and the reconnaissance search results:
assign a criticality score to each of a plurality of nodes within the cyber-physical graph, the criticality score indicating a measure of importance of the respective entity represented by a node;
identify a plurality of cybersecurity risks associated with each of the nodes to which a relative value was assigned;
identify an anomalous event based on analysis of cyber-physical graph and the reconnaissance search results;
assign a risk value to the identified anomalous event, the risk value being determined based on the assigned criticality score for a node associated with the anomalous event; and
determine an effectiveness score for the network based on the cyber-physical graph and the risk value.

### Claim 2 (depends on 1)

The system of claim 1, wherein the information about the organization further comprises information about business processes within the organization.

### Claim 3 (depends on 1)

The system of claim 1, wherein the information about the organization further comprises prior loss information for the organization.

### Claim 4

A method for cybersecurity profiling and rating using internal and external reconnaissance, comprising the steps of:
creating a cyber-physical graph of an organization using entities associated with the organization and relationships between the entities associated with the organization, the cyber-physical graph comprising nodes representing the entities associated with the organization and edges representing the relationships between entities associated with the organization;
performing a reconnaissance search using the cyber-physical graph;
applying some or all of the results of the reconnaissance search to the cyber-physical graph to create a cybersecurity profile of the organization; and
using the cyber-physical graph and the reconnaissance search results:
assigning a criticality score to each of a plurality of nodes within the cyber-physical graph, the criticality score indicating a measure of importance of the respective entity represented by a node;
identifying a plurality of cybersecurity risks associated with each of the nodes to which a relative value was assigned;
identifying an anomalous event based on analysis of cyber-physical graph and the reconnaissance search results;
assigning a risk value to the identified anomalous event, the risk value being determined based on the assigned criticality score for a node associated with the anomalous event; and
determining an effectiveness score for the network based on the cyber-physical graph and the risk value.

### Claim 5 (depends on 4)

The method of claim 4 wherein the information about the organization further comprises information about business processes within the organization.

### Claim 6 (depends on 4)

The method of claim 4 wherein the information about the organization further comprises prior loss information for the organization.