Rating organization cybersecurity using probe-based network reconnaissance techniques
AssigneeQomplx LLC
InventorsJason Crabtree, Andrew Sellers
Life of this patent
Estimating the term…
Abstract
A system and methods for cybersecurity rating using active and passive external reconnaissance, comprising a web crawler that send message prompts to external hosts and receives responses from external hosts, a time-series data store that produces time-series data from the message responses, and a directed computational graph module that probes, scans, and fingerprints devices within a cyber-physical graph and analyzes the results as time-series data to produce a weighted score representing the overall cybersecurity state of an organization.
Claims8
A system for probe-based active network reconnaissance, comprising:
- a time-series data store comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the first computing device to:
- receive a plurality of response messages from external hosts connected via a network;
- produce time-series data based on at least a portion of a received response message;
- a directed computational graph module comprising a second plurality of programming instructions stored in a memory of, and operating on a processor of, a second computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the second computing device to:
- receive traffic data from the multi-dimensional time series data server;
- identify a connection attempt from a third computing device;
- transmit a plurality of probe packets to the third computing device;
- receive a plurality of response packets from the third computing device;
- perform a plurality of analysis and transformation operations on at least a portion of the plurality of response packets;
- store the results of the plurality of analysis and transformation operations as time-series data in the time-series data store;
- and
- produce a weighted score based at least in part on the output of at least a portion of the analysis and transformation operations.
A method for probe-based active network reconnaissance, comprising the steps of:
- identifying, using a directed computational graph module, a connection attempt from a computing device;
- transmitting a plurality of probe packets to the computing device;
- receiving a plurality of response packets from the computing device;
- performing a plurality of analysis and transformation operations on at least a portion of the plurality of response packets;
- storing the results of the plurality of analysis and transformation operations as time-series data in a time-series data store;
- and
- producing a weighted score based at least in part on the output of at least a portion of the analysis and transformation operations.
Dependencies are inferred from the claim text.