# US 9,438,616 B2 · Network asset information management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,616 B2 - Document ID: US9438616B2 - Status: Granted - Kind: B2 - Application number: 14/116,128 - Filed: 2011-10-31 - Published: 2014-03-13 - Granted: 2016-09-06 - Earliest claimed: 2011-10-31 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Anurag Singla; Robert Block; Dhiraj Sharan; Dilraba Ibrahim - Inventors: Anurag Singla; Robert Block; Dhiraj Sharan; Dilraba Ibrahim - Web page: https://patentgrep.com/patent/US9438616B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 41/0894: Policy-based network configuration management - H04L 43/065: related to network devices - H04L 43/50: Testing arrangements - H04L 63/0263: {Rule management} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 43/16: Threshold monitoring - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network asset information management system (101) may include an asset determination and event prioritization module (105) to generate real-time asset information based on network activity involving an asset (102). A rules module (109) may include a set of rules for monitoring the network activity involving the asset. An information analysis module (110) may evaluate the real-time asset information and the rules to generate a notification (111) related to the asset. The rules may include rules for determining vulnerabilities and risks associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold. The notification may include a level of risk associated with the asset. ## Claims ### Claim 1 A network asset information management system comprising a hardware processor of a computer, the hardware processor that: generates real-time asset information based on network activity involving an asset; performs rule-based monitoring of the network activity involving the asset based on rules; maintains an age of the asset based on last scan time and uses the age to calculate a) asset model information confidence for activity occurring on the asset, and b) priority of the activity occurring on the asset; and evaluates the real-time asset information and the rules to generate a notification related to the asset, wherein the rules for monitoring the network activity involving the asset include at least one rule for determining a level of risk associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold, and wherein the notification includes the level of risk associated with the asset. ### Claim 2 (depends on 1) The network asset information management system of claim 1, the hardware processor that: generates an asset model based on static information about the asset; and evaluates the asset model, the real-time asset information, and the rules to generate the notification related to the asset. ### Claim 3 (depends on 2) The network asset information management system of claim 2, wherein the static information about the asset is obtained from a scanner. ### Claim 4 (depends on 2) The network asset information management system of claim 2, wherein the static information about the asset is obtained from an external asset database. ### Claim 5 (depends on 1) The network asset information management system of claim 1, wherein the network activity involving the asset includes event data involving the asset, and wherein the event data includes asset logs, application logs, or network data. ### Claim 6 (depends on 1) The network asset information management system of claim 1, wherein the network activity involving the asset is obtained by a connector. ### Claim 7 (depends on 1) The network asset information management system of claim 1, wherein the rules for monitoring the network activity involving the asset include at least one rule for creation of an asset if the traffic identified to or from an IP address related to the asset exceeds a predetermined threshold amount of data or duration, and wherein the notification includes an indication for the creation of the asset. ### Claim 8 (depends on 1) The network asset information management system of claim 1, wherein the rules for monitoring the network activity involving the asset include at least one rule for deletion of an asset if the traffic has not been observed from the asset for a predetermined time-period, and wherein the notification includes an indication for the deletion of the asset. ### Claim 9 (depends on 1) The network asset information management system of claim 1, wherein the rules for monitoring the network activity involving the asset include at least one rule for updating of an asset if an event identifying an OS patch or application patch has been applied to the asset, and wherein the notification includes an indication for the updating of the asset. ### Claim 10 (depends on 1) The network asset information management system of claim 1, wherein the notification related to the asset includes services, applications, resource utilization, traffic assessment, attacks, viruses, worms, security compromises, rogue processes, rogue servers, operating system (OS) versions, patch levels, or web clients associated with the asset. ### Claim 11 (depends on 1) The network asset information management system of claim 1, wherein the notification related to the asset is used to generate statistics associated with the asset. ### Claim 12 A method for network asset information management, the method comprising: generating real-time asset information based on network activity involving an asset; performing rule-based monitoring of the network activity involving the asset; maintaining, by a hardware processor, an age of the asset based on last scan time; calculating, by the hardware processor, a) asset model information confidence for activity occurring on the asset, and b) priority of the activity occurring on the asset; evaluating, by the hardware processor, the real-time asset information and the monitored network activity; and generating a notification related to the asset based on the evaluation, wherein performing the rule-based monitoring of the network activity involving the asset includes determining a level of risk associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold, and wherein the notification includes the level of risk associated with the asset. ### Claim 13 (depends on 12) The method of claim 12, comprising: generating an asset model based on static information about the asset; evaluating the asset model, the real-time asset information, and the monitored network activity; and generating the notification related to the asset based on the evaluation. ### Claim 14 (depends on 12) The method of claim 12, wherein the network activity involving the asset includes event data involving the asset, and wherein the event data includes asset logs, application logs, or network data. ### Claim 15 (depends on 12) The method of claim 12, wherein the notification related to the asset includes services, applications, resource utilization, traffic assessment, attacks, viruses, worms, security compromises, rogue processes, rogue servers, operating system (OS) versions, patch levels, or web clients associated with the asset. ### Claim 16 (depends on 12) The method of claim 12, the method comprising: performing the rule-based monitoring of the network activity involving the asset based on rules, wherein the rules for monitoring the network activity involving the asset include at least one rule for creation of an asset if the traffic identified to or from an IP address related to the asset exceeds a predetermined threshold amount of data or duration, and wherein the notification includes an indication for the creation of the asset. ### Claim 17 A non-transitory computer readable medium storing machine readable instructions, that when executed by a computer system, perform a method for network asset information management, the method comprising: obtaining real-time asset information based on network activity involving an asset using a connector; performing rule-based monitoring of the network activity involving the asset; maintaining, by a hardware processor, an age of the asset based on last scan time; calculating, by the hardware processor, a) asset model information confidence for activity occurring on the asset, and b) priority of the activity occurring on the asset; and evaluating, by the hardware processor, the real-time asset information and the monitored network activity to generate a notification related to the asset, wherein performing the rule-based monitoring of the network activity involving the asset includes determining a level of risk associated with the asset based on comparison of a level of traffic identified to or from an IP address related to the asset to a predetermined threshold, and wherein the notification includes the level of risk associated with the asset. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the network activity involving the asset includes event data involving the asset, and wherein the event data includes asset logs, application logs, or network data. ### Claim 19 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the notification related to the asset includes services, applications, resource utilization, traffic assessment, attacks, viruses, worms, security compromises, rogue processes, rogue servers, operating system (OS) versions, patch levels, or web clients associated with the asset. ### Claim 20 (depends on 17) The non-transitory computer readable medium of claim 17, the method comprising: performing the rule-based monitoring of the network activity involving the asset based on rules, wherein the rules for monitoring the network activity involving the asset include at least one rule for creation of an asset if the traffic identified to or from an IP address related to the asset exceeds a predetermined threshold amount of data or duration, and wherein the notification includes an indication for the creation of the asset.