US 8,997,234 B2 · System and method for network-based asset operational dependence scoring

Abstract

A system and method in one embodiment includes modules for identifying an asset with a vulnerability risk, identifying a service running on a port on the asset, identifying a connection to the port, calculating an operational dependence role of the asset as a function of the service and the connection, and modifying the vulnerability risk based on the operational dependence role. Other embodiments include identifying a protocol of a data packet at the port, classifying the protocol into a protocol category with a protocol importance score, calculating a connection average for the asset, classifying the connection average into a connection category with a connection score, and calculating a service dependence score. Other embodiments include calculating a host dependence score, assigning a data importance score to data communicated by the asset, and calculating the operational dependence role as a function of the host dependence score and data importance score.

Claims20

Dependent claims

A method performed by a scoring engine in a network environment, the method comprising:

identifying an asset with at least one vulnerability risk;
identifying at least one service running on at least one port on the asset;
identifying at least one connection to the at least one port;
calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection, wherein the operational dependence role indicates a relative importance of the asset in the network environment, wherein calculating the operational dependence role comprises calculating at least (i) a service dependence score for each of one or more ports on the asset as a weighted sum of an average of connections to the service running on the port and a protocol importance of a protocol associated with the port (ii) a host dependence score for the asset as a function of the one or more service dependence scores calculated for each of the one or more ports and (iii) a data importance score representing an importance of data communicated by the asset, wherein the operational dependence role is a function of a summation of the host dependence score and a multiplication of the host dependence score by the data importance score;
and
modifying the vulnerability risk based on the operational dependence role.

3 more elements

Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying an asset with at least one vulnerability risk;
identifying at least one service running on at least one port on the asset;
identifying at least one connection to the at least one port;
calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection, wherein the operational dependence role indicates a relative importance of the asset in the network environment, wherein calculating the operational dependence role comprises calculating at least (i) a service dependence score for each of one or more ports on the asset as a weighted sum of an average of connections to the service running on the port and a protocol importance of a protocol associated with the port (ii) a host dependence score for the asset as a function of the one or more service dependence scores calculated for each of the one or more ports and (iii) a data importance score representing an importance of data communicated by the asset, wherein the operational dependence role is a function of a summation of the host dependence score and a multiplication of the host dependence score by the data importance score;
and
modifying the vulnerability risk based on the operational dependence role.

3 more elements

An apparatus comprising:

a memory element configured to store data;
and
a computing processor operable to execute instructions associated with the data, including:
identifying an asset with at least one vulnerability risk;
identifying at least one service running on at least one port on the asset;
identifying at least one connection to the at least one port;
calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection, wherein the operational dependence role indicates a relative importance of the asset in the network environment, wherein calculating the operational dependence role comprises calculating at least (i) a service dependence score for each of one or more ports on the asset as a weighted sum of an average of connections to the service running on the port and a protocol importance of a protocol associated with the port (ii) a host dependence score for the asset as a function of the one or more service dependence scores calculated for each of the one or more ports and (iii) a data importance score representing an importance of data communicated by the asset, wherein the operational dependence role is a function of a summation of the host dependence score and a multiplication of the host dependence score by the data importance score;
and
modifying the vulnerability risk based on the operational dependence role.

6 more elements

Dependencies are inferred from the claim text.

System and method for network-based asset operational dependence scoring

Life of this patent

System and method for network-based asset operational dependence scoring

Life of this patent

Abstract

Claims20