Enhanced risk assessment
AssigneeForescout Technologies, Inc.
InventorsKeren Mina Semel, Naor Kalbo
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for determining a risk score or value are described. The risk score determination may include accessing network traffic from a network, where the network traffic is associated with a plurality of entities. One or more values associated with one or more properties associated with an entity are determined. The one or more values may be based on the network traffic. At least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity are determined. A risk value for the entity is determined based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity.
Claims20
A method comprising:
- accessing network traffic from a network, wherein the network traffic is associated with a plurality of entities;
- determining one or more values associated with one or more properties associated with an entity, wherein the one or more values are based on the network traffic;
- determining at least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity, wherein at least one of the functional risk value, the configurational risk value, or the behavioral risk value associated with the entity is based at least one of the values associated with the one or more properties associate with the entity;
- determining a risk value for the entity based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity;
- and
- storing the risk value for the entity.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, to:
- access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
- determine one or more values associated with one or more properties associated with an entity, wherein the one or more values are based on the network traffic;
- determine at least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity, wherein at least one of the functional risk value, the configurational risk value, or the behavioral risk value associated with the entity is based at least one of the values associated with the one or more properties associate with the entity;
- determine, by the processing device, a risk value for the entity based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity;
- and
- store the risk value for the entity.
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
- determine one or more values associated with one or more properties associated with an entity, wherein the one or more values are based on the network traffic;
- determine at least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity, wherein at least one of the functional risk value, the configurational risk value, or the behavioral risk value associated with the entity is based at least one of the values associated with the one or more properties associate with the entity;
- determine, by the processing device, a risk value for the entity based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity;
- and
- store the risk value for the entity.
Dependencies are inferred from the claim text.