# US 9,882,925 B2 · Systems for network risk assessment including processing of user access rights associated with a network of devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,925 B2 - Document ID: US9882925B2 - Status: Granted - Kind: B2 - Application number: 15/267,589 - Filed: 2016-09-16 - Published: 2017-03-09 - Granted: 2018-01-30 - Earliest claimed: 2014-12-29 - Assignees: Palantir Technologies Inc. - Applicants: Palantir Technologies Inc. - Inventors: Miles Seiver; Charles Rosenblum - Web page: https://patentgrep.com/patent/US9882925B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 41/12: Discovery or management of network topologies - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and apparatus, including computer programs encoded on computer storage media, for network risk assessment. One of the methods includes obtaining information describing network traffic between a plurality of network devices within a network. A network topology of the network is determined based on the information describing network traffic, with the network topology including nodes connected by an edge to one or more other nodes, and with each node being associated with one or more network devices. Indications of user access rights of users are associated to respective nodes included in the network topology. User interface data associated with the network topology is generated. ## Claims ### Claim 1 A computerized method comprising: by a computing device having one or more computer processors and a non-transitory computer readable storage device storing software instruction for execution by the one or more computer processors, obtaining information describing network traffic between a plurality of network devices within a network; determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with indications of user access rights of a plurality of user accounts to respective nodes included in the network topology; determining, for each of the plurality of user accounts, a risk associated with the user account being compromised with respect to the network, the risk being based on: user access rights of the user account to nodes included in the network topology, and information informing vulnerability of the user account being compromised; and generating user interface data describing the risks associated with the user accounts, the user interface data including indications of user accounts organized according to respective risk. ### Claim 2 (depends on 1) The computerized method of claim 1, wherein an indication of user access rights of a particular user account to a particular node comprises one or more of: information indicating that a user associated with the particular user account is permitted access to a space that includes at least one network device associated with the particular node, information indicating that the particular user account can provide information to, or receive information from, at least one network device associated with the particular node, or information indicating that the particular user account is permitted to access, or has actually attempted to access, at least one network device associated with the particular node. ### Claim 3 (depends on 1) The method of claim 1, wherein information informing vulnerability of a particular user account being compromised comprises one or more of a complexity of a password associated with the particular user account, a location from which a user associated with the particular user account logs in, a length of time the user has been associated with the network, or information associated with an importance of the particular user account. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining, for each of the plurality of nodes, a risk associated with the node being compromised, wherein the risk associated with each user account being compromised is based, at least in part, on risks associated with nodes that are associated with user access rights of the user account. ### Claim 5 (depends on 4) The method of claim 4, further comprising: receiving information identifying nodes indicated as being important, wherein the risk associated with each user account is based, at least in part, on user access rights of the user account that are associated with the indicated nodes. ### Claim 6 (depends on 1) The method of claim 1, wherein a generated user interface is configured to receive a selection of a user account, and wherein upon receiving a selection of a particular user account the generated user interface is configured to present the network topology with particular nodes that are associated with user access rights of the particular user account being shaded or colored. ### Claim 7 (depends on 6) The method of claim 6, wherein the generated user interface is configured to present a total risk associated with the particular nodes that are associated with user access rights of the particular user account, the total risk being determined based on risks associated with each of the particular nodes. ### Claim 8 A system comprising one or more computer systems and one or more computer storage media storing instructions that when executed by the system of one or more computers cause the one or more computers to perform operations comprising: obtaining information describing network traffic between a plurality of network devices within a network; determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with indications of user access rights of a plurality of user accounts to respective nodes included in the network topology; determining, for each of the plurality of user accounts, a risk associated with the user account being compromised with respect to the network, the risk being based on: user access rights of the user account to nodes included in the network topology, and information informing vulnerability of the user account being compromised; and generating user interface data describing the risks associated with the user accounts, the user interface data including indications of user accounts organized according to respective risk. ### Claim 9 (depends on 8) The system of claim 8, wherein an indication of user access rights of a particular user account to a particular node comprises one or more of: information indicating that a user associated with the particular user account is permitted access to a space that includes at least one network device associated with the particular node, information indicating that the particular user account can provide information to, or receive information from, at least one network device associated with the particular node, or information indicating that the particular user account is permitted to access, or has actually attempted to access, at least one network device associated with the particular node. ### Claim 10 (depends on 8) The system of claim 8, wherein information informing vulnerability of a particular user account being compromised comprises one or more of a complexity of a password associated with the particular user account, a location from which a user associated with the particular user account logs in, a length of time the user has been associated with the network, or information associated with an importance of the particular user account. ### Claim 11 (depends on 8) The system of claim 8, wherein the operations further comprise: determining, for each of the plurality of nodes, a risk associated with the node being compromised, wherein the risk associated with each user account being compromised is based, at least in part, on risks associated with nodes that are associated with user access rights of the user account. ### Claim 12 (depends on 11) The system of claim 11, wherein the operations further comprise: receiving information identifying nodes indicated as being important, wherein the risk associated with each user account is based, at least in part, on user access rights of the user account that are associated with the indicated nodes. ### Claim 13 (depends on 8) The system of claim 8, wherein a generated user interface is configured to receive a selection of a user account, and wherein upon receiving a selection of a particular user account the generated user interface is configured to present the network topology with particular nodes that are associated with user access rights of the particular user account being shaded or colored. ### Claim 14 Non-transitory computer storage media storing instructions that when executed by a system of one or more computers cause the one or more computers to perform operations comprising: obtaining information describing network traffic between a plurality of network devices within a network; determining, based on the information describing network traffic, a network topology of the network, the network topology comprising a plurality of nodes each connected to one or more of the plurality of nodes, wherein each node is associated with one or more network devices, and wherein the network topology is associated with indications of user access rights of a plurality of user accounts to respective nodes included in the network topology; determining, for each of the plurality of user accounts, a risk associated with the user account being compromised with respect to the network, the risk being based on: user access rights of the user account to nodes included in the network topology, and information informing vulnerability of the user account being compromised; and generating user interface data describing the risks associated with the user accounts, the user interface data including indications of user accounts organized according to respective risk. ### Claim 15 (depends on 14) The non-transitory computer storage media of claim 14, wherein an indication of user access rights of a particular user account to a particular node comprises one or more of: information indicating that a user associated with the particular user account is permitted access to a space that includes at least one network device associated with the particular node, information indicating that the particular user account can provide information to, or receive information from, at least one network device associated with the particular node, or information indicating that the particular user account is permitted to access, or has actually attempted to access, at least one network device associated with the particular node. ### Claim 16 (depends on 14) The non-transitory computer storage media of claim 14, wherein information informing vulnerability of a particular user account being compromised comprises one or more of a complexity of a password associated with the particular user account, a location from which a user associated with the particular user account logs in, a length of time the user has been associated with the network, or information associated with an importance of the particular user account. ### Claim 17 (depends on 14) The non-transitory computer storage media of claim 14, wherein the operations further comprise: determining, for each of the plurality of nodes, a risk associated with the node being compromised, wherein the risk associated with each user account being compromised is based, at least in part, on risks associated with nodes that are associated with user access rights of the user account. ### Claim 18 (depends on 17) The non-transitory computer storage media of claim 17, wherein the operations further comprise: receiving information identifying nodes indicated as being important, wherein the risk associated with each user account is based, at least in part, on user access rights of the user account that are associated with the indicated nodes. ### Claim 19 (depends on 14) The non-transitory computer storage media of claim 14, wherein a generated user interface is configured to receive a selection of a user account, and wherein upon receiving a selection of a particular user account the generated user interface is configured to present the network topology with particular nodes that are associated with user access rights of the particular user account being shaded or colored.