US 2018/0324221 A1Published application

Advanced asset tracking and correlation

AssigneeQualys, Inc.

InventorsSean M. Molloy, Matthew L. Wirges, Amol S. Sonawane

Life of this patent

Estimating the term…

Loading patent…

Abstract

A security management system may be remotely deployed (e.g., using a cloud-based architecture) to add security to an enterprise network. For example, the security management system may scan assets within the enterprise network for vulnerabilities and may receive data chunks from these scans. The security management system may also receive data chunks from other sources, and, as a result, the system may handle data chunks having many different formats and attributes. When the security management system tries to associate data chunks to assets, there may not be a globally unique identifier that is applicable for all received data chunks. Provided in the present disclosure are exemplary techniques for tracking assets across a network using an asset correlation engine that can flexibly match data chunks to assets based on the attribute or attributes that are available within the data chunks.

Claims20

Dependent claims

A system for identifying target assets, the system comprising:

an asset correlation engine executable by one or more computing device processors and in communication with an asset database,
wherein the asset database is operable to store asset entries, wherein at least one asset entry in the asset database is associated with an asset, and
wherein the asset correlation engine is operable to:
access a correlation metric, the correlation metric comprising:
attributes, wherein at least one attribute is associated with a particular attribute weight, and
exclusionary rules associated with the attributes;
receive a data chunk associated with a target asset of a network;
parse the data chunk to identify an attribute associated with the data chunk;
determine, based on accessing the exclusionary rules associated with the attributes, whether the attribute is excludable;
in response to determining the attribute is not excludable, determining, based on accessing the correlation metric, an attribute weight associated with the attribute;
generate, based on the attribute weight associated with the attribute, target asset information, wherein a second attribute excluded by the exclusionary rules is not used in generating the target asset information;
determine, based on the target asset information, whether the data chunk matches an asset entry in the asset database;
and
in response to determining the data chunk at least partially matches the asset entry in the asset database, associate the data chunk with the asset entry in the asset database.

11 more elements

A method for identifying target assets, the method comprising:

accessing, using one or more computing device processors, a correlation metric, the correlation metric comprising:
attributes, wherein at least one attribute is associated with a particular attribute weight, and
exclusionary rules associated with the attributes;
receiving, using the one or more computing device processors, a data chunk associated with a target asset of a network;
parsing, using the one or more computing device processors, the data chunk to identify an attribute associated with the data chunk;
determining, using the one or more computing device processors, based on accessing the exclusionary rules associated with the attributes, whether the attribute is excludable;
in response to determining the attribute is not excludable, determining, using the one or more computing device processors, based on accessing the correlation metric, an attribute weight associated with the attribute;
generating, using the one or more computing device processors, based on the attribute weight associated with the attribute, target asset information, wherein a second attribute that is excluded by the exclusionary rules is not used in generating the target asset information;
determining, using the one or more computing device processors, based on the target asset information, whether the data chunk matches an asset entry in an asset database, wherein the asset database is operable to store asset entries, wherein at least one asset entry in the asset database is associated with an asset;
and
in response to determining the data chunk at least partially matches the asset entry in the asset database, associating, using the one or more computing device processors, the data chunk with the asset entry in the asset database.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/030,719Filed 9 Jul 2018
Priority: 17 Feb 2015
Published: 8 Nov 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
G06F 16/245
Querying: query processing
G06F 16/24578
With adaptation to user needs: using ranking
G06F 16/90335
Querying: query processing

Family

Application14/624,335Continuation · filed 17 Feb 2015
Application15/451,135Continuation · filed 6 Mar 2017
Application16/030,719Continuation
US 10,021,140 B2Related patent
US 10,523,713 B2Related patent
US 2016/0241595 A1Published application
US 2017/0230424 A1Published application
US 9,591,027 B2Related patent
US 2018/0324221 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key