# US 12,113,824 B2 · Distributed system for autonomous discovery and exploitation of an organization's computing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,824 B2 - Document ID: US12113824B2 - Status: Granted - Kind: B2 - Application number: 17/941,958 - Filed: 2022-09-09 - Published: 2023-01-19 - Granted: 2024-10-08 - Earliest claimed: 2019-02-06 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: David Wolpoff; Eric McIntyre; Evan Anderson - Web page: https://patentgrep.com/patent/US12113824B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 9/5011: {the resources being hardware resources other than CPUs, Servers and Terminals} - G06F 9/5061: {Partitioning or combining of resources} - G06F 2209/5011: Pool - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for performing autonomous analysis of computing resources of a particular entity across the open internet. In particular, a modularized system that is configured to distribute work to ephemeral worker nodes in order perform a blackbox analysis of a target entity and various computing resources under the control or administration of that entity. The blackbox analysis includes an evaluation of discovered resources and services based on appeal or threat actor temptation heuristic. ## Claims ### Claim 1 A modularized system for evaluation of a vulnerability presented by an instance of software executed by a computing resource, the modularized system configured to receive a set of entity reconnaissance data associated with an entity, comprising: identifying at least one computing resource likely administered by the entity and, for each respective computing resource: identifying an instance of software executed by the computing resource: identifying a vulnerability presented by the instance of software; and generating or updating an appeal score based at least in part on the vulnerability, the appeal score corresponding to a prediction of attractiveness of the respective computing resource to an exploitation attempt by a third party; and generating or updating a reconnaissance plan comprising a set of jobs, each job defining at least one computational task, the reconnaissance plan based on one or more of: at least one appeal score; or at least one identified vulnerability. ### Claim 2 (depends on 1) The system of claim 1, further comprising: a user interface configured to send a user a display of information relating to at least a subset of the identified computer resource based on the appeal score. ### Claim 3 (depends on 1) The system of claim 1, wherein the user interface is configured to generate a graphical representation of computer resources selected based on the appeal score. ### Claim 4 (depends on 1) The system of claim 1, wherein: the reconnaissance plan is updated based on at least one identified appeal score; and the updated reconnaissance plan comprises an exploit job configured to exploit at least one vulnerability. ### Claim 5 (depends on 4) The system of claim 4, further comprising: the modularized system further configured to: receive, as input, a data item associated with the entity; and a pool of worker node instances, each worker node instance configured to receive one respective job of the set of jobs and to execute each respective computational task defined by the one respective job, thereby generating data; a data aggregator configured to receive, and to aggregate, data resulting from execution of one or more jobs of the set of jobs by one or more worker nodes, thereby generating aggregated data, and the modularized system configured to receive the aggregated data. ### Claim 6 (depends on 5) The system of claim 5, wherein at least one of the pool of worker node instances executes the exploit job, thereby targeting the respective computing resource. ### Claim 7 (depends on 1) The system of claim 1 wherein the appeal score is based at least in part on a selected sophistication of the third party. ### Claim 8 (depends on 1) The system of claim 1, wherein the appeal score is decreased based on a computing resource likely supported by a control. ### Claim 9 A method for evaluation of Internet-connected computing resources administered by an entity, the method comprising: receiving data from at least one computing task performed as part of entity reconnaissance of an entity, and with the data: identifying a computing resource likely administered by the entity; identifying an instance of software executed by the computing resource; identifying a vulnerability presented by the instance of software; and updating an appeal score of the computing resource, the appeal score corresponding to a likelihood of an exploitation attempt by a third party. ### Claim 10 (depends on 9) The method of claim 9, further comprising: generating a graphical user interface based at least in part on the appeal score. ### Claim 11 (depends on 9) The method of claim 9, further comprising: storing, in an encrypted database, the exfiltrated data. ### Claim 12 (depends on 9) The method of claim 9, wherein the appeal score of the computing resource is based, at least in part, on the exfiltrated data. ### Claim 13 (depends on 9) The method of claim 9, further comprising: receiving, as input, a data item associated with the entity; generating a reconnaissance plan based on the data item, the reconnaissance plan comprising a set of jobs, each job defining at least one computational task; and iteratively or recursively assigning each respective job to a respective ephemeral worker node. ### Claim 14 (depends on 13) The method of claim 13 wherein at least one ephemeral worker node is decommissioned upon successful execution of its respective assigned job. ### Claim 15 (depends on 13) The method of claim 13, further comprising with the data: identifying an exploit to the vulnerability; and executing the exploit to compromise the computing resource. ### Claim 16 (depends on 15) The method of claim 15, wherein the reconnaissance plan is updated, at least in part, based on the compromised computing resource. ### Claim 17 A method for presenting and ranking results of an evaluation operation enumerating computing resources of an entity, the method comprising: receiving data from entity reconnaissance associated with a target entity, and with the received data: identifying a computing resource likely administered by the target entity; identifying an instance of software executed by the computing resource; identifying a vulnerability presented by the instance of software; and updating or creating an appeal score of the computing resource, the appeal score corresponding to a prediction of attractiveness of the computing resource and vulnerability to an exploitation attempt by a third party; displaying at a user interface information related to at least a subset of identified computing resources, in descending order of appeal score. ### Claim 18 (depends on 17) The method of claim 17, wherein for each respective computing resource of the subset of identified computing resources displayed by the user interface, additionally displaying information related to at least one of: the respective software instance; or the respective vulnerability. ### Claim 19 (depends on 17) The method of claim 17, further comprising: generating, with the received data, a reconnaissance plan comprising a set of jobs based on the appeal score; executing an exploit of the vulnerability to compromise the computing resource; and updating the user interface to display information related to the executed exploit.