# US 12,184,510 B2 · Implementing a machine-learning model to identify critical systems in an enterprise environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,510 B2 - Document ID: US12184510B2 - Status: Granted - Kind: B2 - Application number: 18/318,925 - Filed: 2023-05-17 - Published: 2023-10-26 - Granted: 2024-12-31 - Earliest claimed: 2022-03-31 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Karl Ackerman - Web page: https://patentgrep.com/patent/US12184510B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 41/16: using machine learning or artificial intelligence - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/12: Network monitoring probes - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method includes training a machine-learning model, using a training dataset that distinguishes between critical systems and non-critical systems, to classify a particular computer system as critical or non-critical, wherein a label is applied to the particular computer system during the training that identifies the particular computer system as critical or non-critical, and wherein parameters that describe the critical systems or non-critical systems are used as features during the training. The method further includes receiving an input dataset that describes a plurality of computer systems in the enterprise environment. The method further includes outputting, using the trained machine-learning model, an identification of one or more critical systems of the plurality of computer systems within the enterprise environment and an identification of one or more non-critical systems of the plurality of computer systems within the enterprise environment, wherein each identification is associated with a confidence level. ## Claims ### Claim 1 A computer-implemented method to identify one or more critical systems within an enterprise environment, the method comprising: training a machine-learning model, using a training dataset that distinguishes between critical systems and non-critical systems, to classify a particular computer system as critical or non-critical, wherein a label is applied to the particular computer system during the training that identifies the particular computer system as critical or non-critical, and wherein parameters are used as features during the training, the parameters including network exposure that is based on whether a corresponding system communicates with a public network, the corresponding system acts as an exposed point to public networks to protect an internal network, or the corresponding system only communicates with the internal network; generating, based on information from an access control database, clusters of job functions of user accounts and their access to computer systems; receiving an input dataset that describes a plurality of computer systems in the enterprise environment; comparing a feature of the input dataset to the clusters of job functions; outputting a similarity between the feature and a corresponding cluster; and outputting, using the trained machine-learning model, an identification of one or more critical systems of the plurality of computer systems within the enterprise environment and an identification of one or more non-critical systems of the plurality of computer systems within the enterprise environment based on the similarity between the feature and the corresponding cluster, wherein each identification is associated with a confidence level. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the network exposure further based on a history of network connectivity. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the parameters further include a type of data accessed by critical systems including at least one type selected from the group of financial information, medical records, user names, social security numbers, documents related to mergers and acquisitions, personally identifiable information, and combinations thereof. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving an indication of a change to a parameter of a computer system of the plurality of computer systems; and reclassifying the computer system from non-critical to critical based on the change to the parameter. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the clusters are further based on particular privileges associated with each of the job functions. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, wherein the change to the parameter includes an upgrade in hardware associated with the computer system. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein training the machine-learning model includes providing embeddings that are representative of the parameters as input to the machine-learning model. ### Claim 8 A system to identify one or more critical systems within an enterprise environment, the system comprising: one or more processors; and one or more computer-readable media, having instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: training a machine-learning model, using a training dataset that distinguishes between critical systems and non-critical systems, to classify a particular computer system as critical or non-critical, wherein a label is applied to the particular computer system during the training that identifies the particular computer system as critical or non-critical, and wherein parameters are used as features during the training, the parameters including network exposure that is based on whether a corresponding system communicates with a public network, the corresponding system acts as an exposed point to public networks to protect an internal network, or the corresponding system only communicates with the internal network; generating, based on information from an access control database, clusters of job functions of user accounts and their access to computer systems; receiving an input dataset that describes a plurality of computer systems in the enterprise environment; comparing a feature of the input dataset to the clusters of job functions; outputting a similarity between the feature and a corresponding cluster; and outputting, using the trained machine-learning model, an identification of one or more critical systems of the plurality of computer systems within the enterprise environment and an identification of one or more non-critical systems of the plurality of computer systems within the enterprise environment based on the similarity between the feature and the corresponding cluster, wherein each identification is associated with a confidence level. ### Claim 9 (depends on 8) The system of claim 8, wherein the network exposure is further based on a history of network connectivity. ### Claim 10 (depends on 8) The system of claim 8, wherein the parameters further include a type of data accessed by critical systems including at least one type selected from the group of financial information, medical records, user names, social security numbers, documents related to mergers and acquisitions, personally identifiable information, and combinations thereof. ### Claim 11 (depends on 8) The system of claim 8, wherein the operations further comprise: receiving an indication of a change to a parameter of a computer system of the plurality of computer systems; and reclassifying the computer system from non-critical to critical based on the change to the parameter. ### Claim 12 (depends on 8) The system of claim 8, wherein the clusters are further based on particular privileges associated with each of the job functions. ### Claim 13 (depends on 11) The system of claim 11, wherein the change to the parameter includes an upgrade in hardware associated with the computer system. ### Claim 14 (depends on 8) The system of claim 8, wherein training the machine-learning model includes providing embeddings that are representative of the parameters as input to the machine-learning model. ### Claim 15 A computer-program product to identify one or more critical systems within an enterprise environment, the computer-program product including one or more non-transitory computer-readable media with instructions stored thereon that, when executed by one or more computers, cause the one or more computers to perform operations comprising: training a machine-learning model, using a training dataset that distinguishes between critical systems and non-critical systems, to classify a particular computer system as critical or non-critical, wherein a label is applied to the particular computer system during the training that identifies the particular computer system as critical or non-critical, and wherein parameters are used as features during the training, the parameters including network exposure that is based on whether a corresponding system communicates with a public network, the corresponding system acts as an exposed point to public networks to protect an internal network, or the corresponding system only communicates with the internal network; generating, based on information from an access control database, clusters of job functions of user accounts and their access to computer systems; receiving an input dataset that describes a plurality of computer systems in the enterprise environment; comparing a feature of the input dataset to the clusters of job functions; outputting a similarity between the feature and a corresponding cluster; and outputting, using the trained machine-learning model, an identification of one or more critical systems of the plurality of computer systems within the enterprise environment and an identification of one or more non-critical systems of the plurality of computer systems within the enterprise environment based on the similarity between the feature and the corresponding cluster, wherein each identification is associated with a confidence level. ### Claim 16 (depends on 15) The computer-program product of claim 15, wherein the network exposure is further based on a history of network connectivity. ### Claim 17 (depends on 15) The computer-program product of claim 15, wherein the parameters further include a type of data accessed by critical systems including at least one type selected from the group of financial information, medical records, user names, social security numbers, documents related to mergers and acquisitions, personally identifiable information, and combinations thereof. ### Claim 18 (depends on 15) The computer-program product of claim 15, wherein the operations further comprise: receiving an indication of a change to a parameter of a computer system of the plurality of computer systems; and reclassifying the computer system from non-critical to critical based on the change to the parameter. ### Claim 19 (depends on 15) The computer-program product of claim 15, wherein the clusters are further based on particular privileges associated with each of the job functions. ### Claim 20 (depends on 18) The computer-program product of claim 18, wherein the change to the parameter includes an upgrade in hardware associated with the computer system.