Tracking computer devices in extended detection and response systems
AssigneeCisco Technology, Inc.
InventorsTomas Jirsik, Cenek Skarda, David Sislak, Tomas Kuthan
Life of this patent
Estimating the term…
Abstract
This disclosure describes techniques for mapping local device identifiers used in monitoring data from different sources to a common global identifier to enable correlation of monitoring events related to the same device. The techniques can be used in the context of an Extended Detection and Response (XDR) system architecture for advanced threat detection and response in a computer system. In some cases, the XDR system ingests security data from various monitoring components like Endpoint Detection and Response (EDR), Intrusion Detection Systems (IDSs), Intrusion Prevention Systems (IPSs), firewall engines, and email security systems.
Claims20
A method comprising:
- receiving a first association graph representing links between nodes associated with computing device identifiers, wherein the nodes include a highest-order subset;
- determining that the highest-order subset comprises at least two nodes from the nodes;
- for each of a first node and a second node from the nodes, determining one or more most-proximate nodes from the highest-order subset;
- based on determining that the one or more most-proximate nodes associated with the first node comprise a single highest-order node, assigning a first global device identifier associated with the single highest-order node to the first node;
- based on determining that the one or more most-proximate nodes associated with the second node comprise two or more highest-order nodes, assigning a second global device identifier to the second node, wherein the second global device identifier is distinct from global device identifiers assigned to the two or more highest-order nodes;
- and
- determining mapping data associated with the computing device identifiers based on the first global device identifier and the second global device identifier.
A system comprising one or more processors and one or more computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving a first association graph representing links between nodes associated with computing device identifiers, wherein the nodes include a highest-order subset;
- determining that the highest-order subset comprises at least two nodes from the nodes;
- for each of a first node and a second node from the nodes, determining one or more most-proximate nodes from the highest-order subset;
- based on determining that the one or more most-proximate nodes associated with the first node comprise a single highest-order node, assigning a first global device identifier associated with the single highest-order node to the first node;
- based on determining that the one or more most-proximate nodes associated with the second node comprise two or more highest-order nodes, assigning a second global device identifier to the second node, wherein the second global device identifier is distinct from global device identifiers assigned to the two or more highest-order nodes;
- and
- determining mapping data associated with the computing device identifiers based on the first global device identifier and the second global device identifier.
One or more non-transitory computer-readable media storing instructions executable by one or more processors, wherein the instructions, when executed, cause the one or more processors to perform operations comprising:
- receiving a first association graph representing links between nodes associated with computing device identifiers, wherein the nodes include a highest-order subset;
- determining that the highest-order subset comprises at least two nodes from the nodes;
- for each of a first node and a second node from the nodes, determining one or more most-proximate nodes from the highest-order subset;
- based on determining that the one or more most-proximate nodes associated with the first node comprise a single highest-order node, assigning a first global device identifier associated with the single highest-order node to the first node;
- based on determining that the one or more most-proximate nodes associated with the second node comprise two or more highest-order nodes, assigning a second global device identifier to the second node, wherein the second global device identifier is distinct from global device identifiers assigned to the two or more highest-order nodes;
- and
- determining mapping data associated with the computing device identifiers based on the first global device identifier and the second global device identifier.
Dependencies are inferred from the claim text.