# US 2018/0324221 A1 · Advanced asset tracking and correlation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0324221 A1
- Document ID: US20180324221A1
- Status: Published application
- Kind: A1
- Application number: 16/030,719
- Filed: 2018-07-09
- Published: 2018-11-08
- Earliest claimed: 2015-02-17
- Assignees: Qualys, Inc.
- Applicants: Qualys, Inc.
- Inventors: Sean M. Molloy; Matthew L. Wirges; Amol S. Sonawane
- Web page: https://patentgrep.com/patent/US20180324221A1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 16/245: Query processing
- G06F 16/24578: {using ranking}
- G06F 16/90335: {Query processing}
- G06F 40/205: Parsing
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A security management system may be remotely deployed (e.g., using a cloud-based architecture) to add security to an enterprise network. For example, the security management system may scan assets within the enterprise network for vulnerabilities and may receive data chunks from these scans. The security management system may also receive data chunks from other sources, and, as a result, the system may handle data chunks having many different formats and attributes. When the security management system tries to associate data chunks to assets, there may not be a globally unique identifier that is applicable for all received data chunks. Provided in the present disclosure are exemplary techniques for tracking assets across a network using an asset correlation engine that can flexibly match data chunks to assets based on the attribute or attributes that are available within the data chunks.

## Claims

### Claim 1

A system for identifying target assets, the system comprising:
an asset correlation engine executable by one or more computing device processors and in communication with an asset database,
wherein the asset database is operable to store asset entries, wherein at least one asset entry in the asset database is associated with an asset, and
wherein the asset correlation engine is operable to:
access a correlation metric, the correlation metric comprising:
attributes, wherein at least one attribute is associated with a particular attribute weight, and
exclusionary rules associated with the attributes;
receive a data chunk associated with a target asset of a network;
parse the data chunk to identify an attribute associated with the data chunk;
determine, based on accessing the exclusionary rules associated with the attributes, whether the attribute is excludable;
in response to determining the attribute is not excludable, determining, based on accessing the correlation metric, an attribute weight associated with the attribute;
generate, based on the attribute weight associated with the attribute, target asset information, wherein a second attribute excluded by the exclusionary rules is not used in generating the target asset information;
determine, based on the target asset information, whether the data chunk matches an asset entry in the asset database; and
in response to determining the data chunk at least partially matches the asset entry in the asset database, associate the data chunk with the asset entry in the asset database.

### Claim 2 (depends on 1)

The system of claim 1, wherein the attribute is at least one of a strongly correlated attribute, a moderately correlated attribute, and a loosely correlated attribute.

### Claim 3 (depends on 2)

The system of claim 2, wherein a first attribute weight of the strongly correlated attribute is greater than a second attribute weight of the moderately correlated attribute, or wherein the second attribute weight of the moderately correlated attribute is greater than a third attribute weight of the loosely correlated attribute.

### Claim 4 (depends on 2)

The system of claim 2, wherein a first attribute weight of the strongly correlated attribute is at least 1.5 to 40 times as large as a second attribute weight of the moderately correlated attribute, or wherein the second attribute weight of the moderately correlated attribute is at least 1.5 to 25 times as large as a third attribute weight of the loosely correlated attribute.

### Claim 5 (depends on 1)

The system of claim 1, wherein the target asset information is comprised in a digital fingerprint.

### Claim 6 (depends on 1)

The system of claim 1, wherein the attribute weights for the attributes comprised in the correlation metric are generated using an iterative training process.

### Claim 7 (depends on 1)

The system of claim 1, wherein the iterative training process comprises iteratively testing candidate attribute weights for the attributes comprised in the correlation metric, and determining whether the candidate attribute weights lead to an expected matching result for mapping a test target asset with a test asset entry.

### Claim 8 (depends on 1)

The system of claim 1, wherein the target asset comprises at least one of a desktop workstation, a server, a laptop, a tablet, a mobile phone, and a virtual machine, or wherein the attribute comprises at least one of an IP address attribute, a DNS name attribute, a network attribute, an operating system attribute, a NetBIOS name attribute, an agent identification, and an instance identification.

### Claim 9 (depends on 1)

The system of claim 1, wherein the asset correlation engine is further operable to receive the data chunk from an agent operable to scan the target asset.

### Claim 10 (depends on 9)

The system of claim 9, wherein the agent comprises or is a cloud agent.

### Claim 11

A method for identifying target assets, the method comprising:
accessing, using one or more computing device processors, a correlation metric, the correlation metric comprising:
attributes, wherein at least one attribute is associated with a particular attribute weight, and
exclusionary rules associated with the attributes;
receiving, using the one or more computing device processors, a data chunk associated with a target asset of a network;
parsing, using the one or more computing device processors, the data chunk to identify an attribute associated with the data chunk;
determining, using the one or more computing device processors, based on accessing the exclusionary rules associated with the attributes, whether the attribute is excludable;
in response to determining the attribute is not excludable, determining, using the one or more computing device processors, based on accessing the correlation metric, an attribute weight associated with the attribute;
generating, using the one or more computing device processors, based on the attribute weight associated with the attribute, target asset information, wherein a second attribute that is excluded by the exclusionary rules is not used in generating the target asset information;
determining, using the one or more computing device processors, based on the target asset information, whether the data chunk matches an asset entry in an asset database, wherein the asset database is operable to store asset entries, wherein at least one asset entry in the asset database is associated with an asset; and
in response to determining the data chunk at least partially matches the asset entry in the asset database, associating, using the one or more computing device processors, the data chunk with the asset entry in the asset database.

### Claim 12 (depends on 11)

The method of claim 11, wherein the data chunk is received using an agent.

### Claim 13 (depends on 12)

The method of claim 12, wherein the agent is a cloud-based agent.

### Claim 14 (depends on 13)

The method of claim 13, wherein the target asset comprises an IP address.

### Claim 15 (depends on 11)

The method of claim 11, further comprising in response to determining the data chunk does not at least partially match the asset entry in the asset database, create a new asset entry in the asset database, and associate the data chunk with the new asset entry in the asset database.

### Claim 16 (depends on 11)

The method of claim 11, wherein determining, based on the target asset information, whether the data chunk matches an asset entry in the asset database, comprises scanning, based on the target asset information, the asset entries in the database and determining a list of potentially matching asset entries.

### Claim 17 (depends on 11)

The method of claim 11, wherein determining, based on the target asset information, whether the data chunk matches the asset entry in the asset database, comprises determining, based on the target asset information and using at least one fuzzy matching technique, whether the data chunk matches the asset entry in the asset database.

### Claim 18 (depends on 11)

The method of claim 11, wherein the target asset comprises at least one of a desktop workstation, a server, a laptop, a tablet, a mobile phone, and a virtual machine, or wherein the attribute comprises at least one of an IP address attribute, a DNS name attribute, a network attribute, an operating system attribute, a NetBIOS name attribute, agent identification, and instance identification.

### Claim 19

A method for identifying target assets, the method comprising:
accessing, using one or more computing device processors, a correlation metric, the correlation metric comprising:
attributes, wherein each attribute is associated with a particular attribute weight, and
exclusionary rules associated with the attributes;
receiving a data chunk associated with a target asset of a network;
parsing the data chunk to identify an attribute associated with the data chunk;
determining, using the one or more computing device processors, based on accessing the correlation metric, an attribute weight associated with the attribute;
generating, using the one or more computing device processors, based on the attribute weight associated with the attribute, a digital fingerprint for the target asset;
determining, using the one or more computing device processors, based on the digital fingerprint for the target asset, whether the data chunk matches an asset entry in an asset database, wherein the asset database is operable to store asset entries, wherein at least one asset entry in the asset database is associated with an asset; and
in response to determining the data chunk at least partially matches the asset entry in the asset database, associating, using the one or more computing device processors, the data chunk with the asset entry in the asset database.

### Claim 20 (depends on 19)

The method of claim 19, wherein the target asset comprises at least one of a desktop workstation, a server, a laptop, a tablet, a mobile phone, and a virtual machine, or wherein the attribute comprises at least one of an IP address attribute, a DNS name attribute, a network attribute, an operating system attribute, a NetBIOS name attribute, agent identification, and instance identification.