# US 9,438,615 B2 · Security risk management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,615 B2 - Document ID: US9438615B2 - Status: Granted - Kind: B2 - Application number: 14/021,585 - Filed: 2013-09-09 - Published: 2015-03-12 - Granted: 2016-09-06 - Earliest claimed: 2013-09-09 - Assignees: BitSight Technologies, Inc. - Applicants: BitSight Technologies, Inc. - Inventors: Philip John Steuart Gladstone; Alan Joseph Kirby; John Matthew Truelove; David Feinzeig; Nagarjuna Venna; Stephen Boyer - Web page: https://patentgrep.com/patent/US9438615B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range - G06Q 10/40: Business processes related to social networking or social networking services - G06Q 30/0277: {Online advertisement} - H04L 61/4511: using domain name system [DNS] - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Among other things, traces are received of activities of an online user who is associated with an entity. By analysis of the traces a security state of the entity is inferred. Also, a map is generated between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets. At least part of the generating of the map is done automatically. A user can be engaged to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities. ## Claims ### Claim 1 A method comprising: generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, generating of the map comprising online discovery of information about the technical assets; and enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities, the technical assets comprising network-related information, and in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or Regional Internet Registry. ### Claim 2 (depends on 1) The method of claim 1 in which the technical assets comprise network-related information. ### Claim 3 (depends on 2) The method of claim 2 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements. ### Claim 4 (depends on 2) The method of claim 2 in which generating the map comprises online discovery of information about the technical assets. ### Claim 5 (depends on 4) The method of claim 4 in which the information about the technical assets is discovered through passive DNS queries. ### Claim 6 (depends on 5) The method of claim 5 comprising identifying from the passive DNS queries associations between domain names and network addresses. ### Claim 7 (depends on 6) The method of claim 6 comprising tracking changes over time in the network addresses that are associated with a given domain name. ### Claim 8 (depends on 6) The method of claim 6 in which identifying from the passive DNS queries associations between domain names and network addresses comprises: receiving a first domain name for an entity from the entities; sending a first passive DNS query to identify first name servers for the first domain name; receiving a list of the first name servers for the first domain; sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative; receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative; sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names; receiving a list of the host names and the Internet Protocol addresses for the host names; and mapping each of the Internet Protocol addresses to an attribute for the entity. ### Claim 9 (depends on 1) The method of claim 1 comprising presenting to the user non-technical-asset information through the user interface. ### Claim 10 (depends on 9) The method of claim 9 in which the non-technical-asset information comprises information about the entities. ### Claim 11 (depends on 10) The method of claim 10 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts. ### Claim 12 (depends on 1) The method of claim 1 in which the tool enables the user to assign a technical asset to an entity. ### Claim 13 (depends on 1) The method of claim 1 comprising invoking external crowd-sourced services to aid in generating the map. ### Claim 14 (depends on 1) The method of claim 1 comprising enabling a separate review and approval of entities proposed to be included in the map. ### Claim 15 (depends on 1) The method of claim 1 comprising providing the map to an application for joining to event data or scoring the security state of the entities. ### Claim 16 (depends on 1) The method of claim 1 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map. ### Claim 17 (depends on 1) The method of claim 1 comprising generating graphs of relationships among entities based on their associations with technical assets. ### Claim 18 A method comprising: generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, the technical assets comprising network-related information, the generating of the map comprising online discovery of information about the technical assets, the information about the technical assets being discovered through passive DNS queries; and enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities. ### Claim 19 (depends on 18) The method of any of claim 18 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements. ### Claim 20 (depends on 18) The method of claim 18 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry. ### Claim 21 (depends on 18) The method of claim 18 comprising identifying from the passive DNS queries associations between domain names and network addresses. ### Claim 22 (depends on 21) The method of claim 21 comprising tracking changes over time in the network addresses that are associated with a given domain name. ### Claim 23 (depends on 21) The method of claim 21 in which identifying from the passive DNS queries associations between domain names and network addresses comprises: receiving a first domain name for an entity from the entities; sending a first passive DNS query to identify first name servers for the first domain name; receiving a list of the first name servers for the first domain; sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative; receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative; sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names; receiving a list of the host names and the Internet Protocol addresses for the host names; and mapping each of the Internet Protocol addresses to an attribute for the entity. ### Claim 24 (depends on 18) The method of claim 18 comprising presenting to the user non-technical-asset information through the user interface. ### Claim 25 (depends on 24) The method of claim 24 in which the non-technical-asset information comprises information about the entities. ### Claim 26 (depends on 25) The method of claim 25 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts. ### Claim 27 (depends on 18) The method of claim 18 in which the tool enables the user to assign a technical asset to an entity. ### Claim 28 (depends on 18) The method of claim 18 comprising invoking external crowd-sourced services to aid in generating the map. ### Claim 29 (depends on 18) The method of claim 18 comprising enabling a separate review and approval of entities proposed to be included in the map. ### Claim 30 (depends on 18) The method of claim 18 comprising providing the map to an application for joining to event data or scoring the security state of the entities. ### Claim 31 (depends on 18) The method of claim 18 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map. ### Claim 32 (depends on 18) The method of claim 18 comprising generating graphs of relationships among entities based on their associations with technical assets. ### Claim 33 A method comprising: generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, invoking external crowd-sourced services to aid in generating the map; and enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities. ### Claim 34 (depends on 33) The method of claim 33 in which the technical assets comprise network-related information. ### Claim 35 (depends on 34) The method of any of claim 34 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements. ### Claim 36 (depends on 34) The method of claim 34 in which generating the map comprises online discovery of information about the technical assets. ### Claim 37 (depends on 36) The method of claim 36 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry. ### Claim 38 (depends on 36) The method of claim 36 in which the information about the technical assets is discovered through passive DNS queries. ### Claim 39 (depends on 38) The method of claim 38 comprising identifying from the passive DNS queries associations between domain names and network addresses. ### Claim 40 (depends on 39) The method of claim 39 comprising tracking changes over time in the network addresses that are associated with a given domain name. ### Claim 41 (depends on 39) The method of claim 39 in which identifying from the passive DNS queries associations between domain names and network addresses comprises: receiving a first domain name for an entity from the entities; sending a first passive DNS query to identify first name servers for the first domain name; receiving a list of the first name servers for the first domain; sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative; receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative; sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names; receiving a list of the host names and the Internet Protocol addresses for the host names; and mapping each of the Internet Protocol addresses to an attribute for the entity. ### Claim 42 (depends on 33) The method of claim 33 comprising presenting to the user non-technical-asset information through the user interface. ### Claim 43 (depends on 42) The method of claim 42 in which the non-technical-asset information comprises information about the entities. ### Claim 44 (depends on 43) The method of claim 43 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts. ### Claim 45 (depends on 33) The method of claim 33 in which the tool enables the user to assign a technical asset to an entity. ### Claim 46 (depends on 33) The method of claim 33 comprising enabling a separate review and approval of entities proposed to be included in the map. ### Claim 47 (depends on 33) The method of claim 33 comprising providing the map to an application for joining to event data or scoring the security state of the entities. ### Claim 48 (depends on 33) The method of claim 33 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map. ### Claim 49 (depends on 33) The method of claim 33 comprising generating graphs of relationships among entities based on their associations with technical assets. ### Claim 50 A method comprising: generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, enabling a separate review and approval of entities proposed to be included in the map, and enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities. ### Claim 51 (depends on 50) The method of claim 50 in which the technical assets comprise network-related information. ### Claim 52 (depends on 51) The method of any of claim 51 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements. ### Claim 53 (depends on 50) The method of claim 50 in which generating the map comprises online discovery of information about the technical assets. ### Claim 54 (depends on 53) The method of claim 53 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry. ### Claim 55 (depends on 53) The method of claim 53 in which the information about the technical assets is discovered through passive DNS queries. ### Claim 56 (depends on 55) The method of claim 55 comprising identifying from the passive DNS queries associations between domain names and network addresses. ### Claim 57 (depends on 56) The method of claim 56 comprising tracking changes over time in the network that are associated with a given domain name. ### Claim 58 (depends on 56) The method of claim 56 in which identifying from the passive DNS queries associations between domain names and network addresses comprises: receiving a first domain name for an entity from the entities; sending a first passive DNS query to identify first name servers for the first domain name; receiving a list of the first name servers for the first domain; sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative; receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative; sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names; receiving a list of the host names and the Internet Protocol addresses for the host names; and mapping each of the Internet Protocol addresses to an attribute for the entity. ### Claim 59 (depends on 50) The method of claim 50 comprising presenting to the user non-technical-asset information through the user interface. ### Claim 60 (depends on 59) The method of claim 59 in which the non-technical-asset information comprises information about the entities. ### Claim 61 (depends on 60) The method of claim 60 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts. ### Claim 62 (depends on 50) The method of claim 50 in which the tool enables the user to assign a technical asset to an entity. ### Claim 63 (depends on 50) The method of claim 50 comprising invoking external crowd-sourced services to aid in generating the map. ### Claim 64 (depends on 50) The method of claim 50 comprising providing the map to an application for joining to event data or scoring the security state of the entities. ### Claim 65 (depends on 50) The method of claim 50 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map. ### Claim 66 (depends on 50) The method of claim 50 comprising generating graphs of relationships among entities based on their associations with technical assets. ### Claim 67 A method comprising: generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, providing the map to an application for joining to event data or scoring the security state of the entities; and enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities. ### Claim 68 (depends on 67) The method of claim 67 in which the technical assets comprise network-related information. ### Claim 69 (depends on 68) The method of any of claim 68 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements. ### Claim 70 (depends on 68) The method of claim 68 in which generating the map comprises online discovery of information about the technical assets. ### Claim 71 (depends on 70) The method of claim 70 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry. ### Claim 72 (depends on 70) The method of claim 70 in which the information about the technical assets is discovered through passive DNS queries. ### Claim 73 (depends on 72) The method of claim 72 comprising identifying from the passive DNS queries associations between domain names and network addresses. ### Claim 74 (depends on 73) The method of claim 73 comprising tracking changes over time in the network addresses that are associated with a given domain name. ### Claim 75 (depends on 73) The method of claim 73 in which identifying from the passive DNS queries associations between domain names and network addresses comprises: receiving a first domain name for an entity from the entities; sending a first passive DNS query to identify first name servers for the first domain name; receiving a list of the first name servers for the first domain; sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative; receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative; sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names; receiving a list of the host names and the Internet Protocol addresses for the host names; and mapping each of the Internet Protocol addresses to an attribute for the entity. ### Claim 76 (depends on 67) The method of claim 67 comprising presenting to the user non-technical-asset information through the user interface. ### Claim 77 (depends on 76) The method of claim 76 in which the non-technical-asset information comprises information about the entities. ### Claim 78 (depends on 77) The method of claim 77 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts. ### Claim 79 (depends on 67) The method of claim 67 in which the tool enables the user to assign a technical asset to an entity. ### Claim 80 (depends on 67) The method of claim 67 comprising invoking external crowd-sourced services to aid in generating the map. ### Claim 81 (depends on 67) The method of claim 67 comprising enabling a separate review and approval of entities proposed to be included in the map. ### Claim 82 (depends on 67) The method of claim 67 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map. ### Claim 83 (depends on 67) The method of claim 67 comprising generating graphs of relationships among entities based on their associations with technical assets. ### Claim 84 A method comprising: generating a map between (a) technical assets that contribute to security characteristics of respective entities and (b) the identities of the entities that are associated with the respective technical assets, at least part of the generating of the map being done automatically, generating graphs of relationships among entities based on their associations with technical assets; and enabling a user to assist in the generating of the map by presenting to the user through a user interface (a) data about the technical assets of entities and (b) an interactive tool for associating the technical assets with the identities of the entities. ### Claim 85 (depends on 84) The method of claim 84 in which the technical assets comprise network-related information. ### Claim 86 (depends on 85) The method of any of claim 85 in which the network-related information comprises at least one of Internet Protocol addresses, blocks of Internet Protocol addresses, mail server configurations, domain names, social media handles, third-party data hosting, internet service providers, Domain Name System services, Autonomous System numbers, and Border Gateway Protocol advertisements. ### Claim 87 (depends on 85) The method of claim 85 in which generating the map comprises online discovery of information about the technical assets. ### Claim 88 (depends on 85) The method of claim 85 in which the information about the technical assets is discovered from an Internet Assigned Numbers Authority or a Regional Internet Registry. ### Claim 89 (depends on 87) The method of claim 87 in which the information about the technical assets is discovered through passive DNS queries. ### Claim 90 (depends on 89) The method of claim 89 comprising identifying from the passive DNS queries associations between domain names and network addresses. ### Claim 91 (depends on 90) The method of claim 90 comprising tracking changes over time in the network addresses that are associated with a given domain name. ### Claim 92 (depends on 90) The method of claim 90 in which identifying from the passive DNS queries associations between domain names and network addresses comprises: receiving a first domain name for an entity from the entities; sending a first passive DNS query to identify first name servers for the first domain name; receiving a list of the first name servers for the first domain; sending a second passive DNS query, for each of the first name servers, to identify second domain names for which the name server is authoritative; receiving a list, for each of the first name servers, of the second domain names for which the name server is authoritative; sending a third passive DNS query, for each of the second domain names, to identify host names for the hosts of the second domain name and Internet Protocol addresses for the host names; receiving a list of the host names and the Internet Protocol addresses for the host names; and mapping each of the Internet Protocol addresses to an attribute for the entity. ### Claim 93 (depends on 84) The method of claim 84 comprising presenting to the user non-technical-asset information through the user interface. ### Claim 94 (depends on 93) The method of claim 93 in which the non-technical-asset information comprises information about the entities. ### Claim 95 (depends on 94) The method of claim 94 in which the information about the entities comprises at least one of descriptions of entities, industry classifications, and employee counts. ### Claim 96 (depends on 84) The method of claim 84 in which the tool enables the user to assign a technical asset to an entity. ### Claim 97 (depends on 84) The method of claim 84 comprising invoking external crowd-sourced services to aid in generating the map. ### Claim 98 (depends on 84) The method of claim 84 comprising enabling a separate review and approval of entities proposed to be included in the map. ### Claim 99 (depends on 84) The method of claim 84 comprising providing the map to an application for joining to event data or scoring the security state of the entities. ### Claim 100 (depends on 84) The method of claim 84 in which the part of the generating of the map that is done automatically comprises at least one of collecting information about technical assets and about entities, associating technical assets with entities, and approving proposed portions of the map.