# US 12,695,776 B2 · Method of cyber security and system thereof

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,695,776 B2
- Document ID: US12695776B2
- Status: Granted
- Kind: B2
- Application number: 18/681,335
- Filed: 2022-06-27
- Published: 2024-10-10
- Granted: 2026-07-28
- Earliest claimed: 2021-08-16
- Assignees: Elta Systems Ltd.
- Applicants: Elta Systems Ltd.
- Inventors: Noam Krakover; Camila Edry
- Web page: https://patentgrep.com/patent/US12695776B2

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1433: {Vulnerability analysis}
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computerized cyber security system for generating a consolidated risk score of an entity, usable for analyzing the vulnerabilities of plurality of entities to cyber risks. The system is configured to determine a first set of IP addresses for scanning and then scan the first set of IP addresses, and for each IP address identify a risk and extract corresponding risk criticality score, and determining a misconfiguration score. The system is further configured to map a second set of IP addresses an entity of interest and provide IP address criticality weights associated with the second set of IP addresses. The system is further configured to provide an entity criticality weight associated with the entity of interest.

## Claims

### Claim 1

A computerized cyber security system for generating a consolidated risk score of an entity, usable for analysing the vulnerabilities of plurality of entities to cyber risks, the computerized cyber security system comprising a processor and memory circuitry (PMC) configured to:
determine a first set of IP addresses for scanning;
scan the first set of IP addresses, and for each IP address in the set, and perform, including:
(1) identify at least one risk and extract corresponding at least one risk criticality score, wherein each risk criticality score is informative of the vulnerability of network assets associated with the IP address to the risk;
(2) determining a misconfiguration score being informative of the vulnerability of network assets associated with the IP address to a misconfiguration;
map a second set of IP addresses, of said first set, to at least one entity of interest, wherein each one of said entities of interest is associated with a respective sub-set of IP addresses of said second set;
provide IP address criticality weights associated respectively with said second set of IP addresses, each IP address criticality weight being informative of the IP address's sensitivity to cyber threats relative to the sensitivity of other IP addresses to the cyber threats;
provide an entity criticality weight associated respectively with said at least one entity of interest; the entity criticality weight being informative of the entity's sensitivity to cyber threats, and being distinct from the sensitivity to cyber threats of the IP addresses of the entity, relative to the sensitivity of other entities to cyber threats;
wherein said scanning is performed by at least two scan tools each configured to obtain a subset of said set of risks and wherein each scan tool is associated with a respective tool weight, being informative of the reliability of the tool in detecting risks,
for each entity of interest, determine an entity consolidated risk score based on at least (i) the risk criticality scores associated with the IP addresses of the entity of interest, (ii) the misconfiguration scores associated with the IP addresses of the entity of interest (iii) IP criticality weights associated with the IP addresses of the entity of interest, (iv) the entity criticality weight of the entity of interest, and (v) the corresponding tool weight of the tool that was used for the scanning,
thereby obtaining a plurality of entity consolidated risk scores associated with respective entities of interest.

### Claim 2 (depends on 1)

The computerized cyber security system of claim 1, wherein, for each entity of interest, the PMC is configured to determine the IP risk scores of respective IP addresses associated with the entity of interest, wherein each IP address risk score of an IP address is determined by combining at least (i) the risk criticality scores associated with the IP address (ii) the misconfiguration score associated with the IP address, and (iii) IP criticality weight associated with the IP address,
and wherein said PMC is further configured to determine said consolidated risk score per each entity of interest by combining the determined IP address risk scores of the respective IP addresses that are associated with the entity (iv) entity criticality weight of the entity of interest and (v) the corresponding tool weight of the tool that was used for the scanning.

### Claim 3 (depends on 1)

The computerized cyber security system of claim 1 wherein said PMC is further configured to actively scan said second set of mapped IP addresses by utilizing additional information derived from the mapped IP address to the entity of interest and the entity operator's consent scanning the IP address, to thereby enhance said risk criticality scores and misconfiguration scores.

### Claim 4 (depends on 3)

The computerized cyber security system of claim 3, wherein a tool of said tools is Shodan.

### Claim 5 (depends on 1)

The computerized cyber security system of claim 1, wherein each IP address is associated with a plurality of ports and wherein said scan includes determining a respective port value for each scan port, wherein each port value is informative of whether the “open ports” comply with a policy, and wherein said misconfiguration associated with an IP address is determined by combining the port values of the ports associated with the IP address.

### Claim 6 (depends on 1)

The computerized cyber security system of claim 1, wherein said combining includes using one or more of the following functions: average, weighted average, sum, and max.

### Claim 7 (depends on 1)

The computerized cyber security system of claim 1, wherein said first set of IP addresses is obtained using at least a national ISP data source.

### Claim 8 (depends on 1)

The computerized cyber security system of claim 1, wherein said mapping utilizes at least the WhoIs and DNS repository data sources.

### Claim 9 (depends on 1)

The computerized cyber security system of claim 1, wherein said risk criticality scores that are associated with the respective known risks comply with the National Institute of Standards and Technology (NIST) data source.

### Claim 10

A computerized cyber security method for generating a consolidated risk score of an entity, usable for analysing the vulnerabilities of plurality of entities to cyber risks, the computerized cyber security method comprising:
(a) determining a first set of IP addresses for scanning;
(b) scanning the first set of IP addresses, and for each IP address in the set, and perform, including:
(1) identify at least one risk, and extract corresponding at least one risk criticality score, wherein each risk criticality score is informative of the vulnerability of network assets associated with the IP address to the risk;
(2) determining a misconfiguration score being informative of the vulnerability of network assets associated with the IP address to a misconfiguration;
(c) mapping a second set of IP addresses, of said first set, to at least one entity of interest, wherein each one of said entities of interest is associated with a respective sub-set of IP addresses of said second set;
(d) providing IP address criticality weights associated respectively with said second set of IP addresses; each IP address criticality weight being informative of the IP address's sensitivity to cyber threats relative to the sensitivity of other IP addresses to the cyber threats;
(e) providing an entity criticality weight associated respectively with said at least one entity of interest; the entity criticality weight being informative of the entity's sensitivity to cyber threats, and being distinct from the sensitivity to cyber threats of the IP addresses of the entity, relative to the sensitivity of other entities to cyber threats;
wherein said scanning is performed by at least two scan tools each configured to obtain a subset of said set of risks and wherein each scan tool is associated with a respective tool weight, being informative of the reliability of the tool in detecting risks, and
for each entity of interest,
(f) determining an entity consolidated risk score based on at least (i) the risk criticality scores associated with the IP addresses of the entity of interest, (ii) the misconfiguration scores associated with the IP addresses of the entity of interest (iii) IP criticality weights associated with the IP addresses of the entity of interest, (iv) the entity criticality weight of the entity of interest, and (v) the corresponding tool weight of the tool that was used for the scanning,
thereby obtaining a plurality of entity consolidated risk scores associated with respective entities of interest.

### Claim 11 (depends on 10)

The computerized cyber security method of claim 10,
further comprising:
for each entity of interest, determining IP risk scores of respective IP addresses associated with the entity of interest, wherein each IP address risk score of an IP address is determined by combining at least (i) the risk criticality scores associated with the IP address (ii) the misconfiguration score associated with the IP address, and (iii) IP criticality weight associated with the IP address, and
determining said consolidated risk score per for each entity of interest by combining the determined IP address risk scores of the respective IP addresses that are associated with the entity (iv) entity criticality weight of the entity of interest and (v) the corresponding tool weight of the tool that was used for the scanning.

### Claim 12 (depends on 10)

The computerized cyber security method of claim 10, further comprising: actively scanning said second set of mapped IP addresses by utilizing additional information derived from the mapped IP address to the entity of interest and the entity operator's consent scanning the IP address, to thereby enhance said risk criticality scores and misconfiguration scores.

### Claim 13 (depends on 12)

The computerized cyber security method of claim 12, wherein a tool of said tools is Shodan.

### Claim 14 (depends on 10)

The computerized cyber security method of claim 10, wherein each IP address is associated with a plurality of ports and wherein said scanning includes determining a respective port value for each scan port, wherein each port value is informative of whether the “open ports” comply with a policy, and wherein said misconfiguration associated with an IP address is determined by combining the port values of the ports associated with the IP address.

### Claim 15 (depends on 10)

The computerized cyber security method of claim 10, wherein said combining includes using one or more of the following functions: average, weighted average, sum, and max.

### Claim 16 (depends on 10)

The computerized cyber security method of claim 10, wherein said first set of IP addresses is obtained using at least a national ISP data source.

### Claim 17 (depends on 10)

The computerized cyber security method of claim 10, wherein said mapping utilizes at least the WhoIs and DNS repository data sources.

### Claim 18 (depends on 10)

The computerized cyber security method of claim 10, wherein said risk criticality scores that are associated with the respective known risks comply with the National Institute of Standards and Technology (NIST) data source.

### Claim 19

A non-transitory program storage device readable by a computer, tangibly embodying computer readable instructions executable by the computer to perform a method of generating a consolidated risk score of an entity, usable for analysing the vulnerabilities of plurality of entities to cyber risks, the method comprising:
(a) determining a first set of IP addresses for scanning;
(b) scanning the first set of IP addresses, and for each IP address in the set, perform, including:
(1) identify at least one risk and extract corresponding at least one risk criticality score, wherein each risk criticality score is informative of the vulnerability of network assets associated with the IP address to the risk;
(2) determining a misconfiguration score being informative of the vulnerability of network assets associated with the IP address to a misconfiguration;
(c) mapping a second set of IP addresses, of said first set, to at least one entity of interest, wherein each one of said entities of interest is associated with a respective sub-set of IP addresses of said second set;
(d) providing IP address criticality weights associated respectively with said second set of IP addresses; each IP address criticality weight being informative of the IP address's sensitivity to cyber threats relative to the sensitivity of other IP addresses to the cyber threats;
(e) providing an entity criticality weight associated respectively with said at least one entity of interest; the entity criticality weight being informative of the entity's sensitivity to cyber threat, and being distinct from the sensitivity to cyber threats of the IP addresses of the entity, relative to the sensitivity of other entities to cyber threats;
wherein said scanning is performed by at least two scan tools each configured to obtain a subset of said set of risks and wherein each scan tool is associated with a respective tool weight, being informative of the reliability of the tool in detecting risks, and
for each entity of interest,
(f) determining an entity consolidated risk score based on at least (i) the risk criticality scores associated with the IP addresses of the entity of interest, (ii) the misconfiguration scores associated with the IP addresses of the entity of interest (iii) IP criticality weights associated with the IP addresses of the entity of interest, (iv) the entity criticality weight of the entity of interest, and (v) the corresponding tool weight of the tool that was used for the scanning,
thereby obtaining a plurality of entity consolidated risk scores associated with respective entities of interest.