Resource classification using resource requests

Patent metadata

Field	Value
Publication number	US-10122722-B2
Application number	US-201314899640-A
Country	US
Kind code	B2
Filing date	Jun 20, 2013
Priority date	Jun 20, 2013
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

In one implementation, a resource classification system identifies a plurality of resource requests and generates a plurality of resource access measures based on the plurality of resource requests. Each resource request from the plurality of resource requests is associated with a resource from a plurality of resources by a resource identifier of that resource. Each resource access measure from the plurality of resource access measures is associated with a resource from the plurality of resources. The resource classification system applies a classifier to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure, and assign a security classification to each resource from the plurality of resources based on the classification result for that resource.

First claim

What is claimed is:

1. A processor-readable medium storing code representing instructions that when executed by a processor cause the processor to:
identify a plurality of resource requests, each resource request from the plurality of resource requests associated with a resource from a plurality of resources by a resource identifier of that resource;
determine whether a plurality of resource access measures were previously generated for the plurality of resource requests;
update the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures;
generate the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource requests, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure from the plurality of resource access measures is associated with the resource from the plurality of resources, and each resource access measure is a value that describes an average number of resource requests associated with the plurality of resource requests;
apply the classifier for the resource access measures to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure; and
assign a security classification to each resource from the plurality of resources based on the classification result for that resource.

2. The processor-readable medium of claim 1 , wherein the plurality of resource requests include Domain Name System requests and Hypertext Transfer Protocol requests.

3. The processor-readable medium of claim 1 , wherein
the plurality of resource requests is a first plurality of resource requests,
the plurality of resource access measures is generated at a first time, and
the security classification assigned to each resource from the plurality of resources is a first security classification assigned to that resource before a second time,

the processor-readable medium further storing code representing instructions that when executed at the processor cause the processor to:
update, at the second time after the first time, the plurality of resource access measures based on a second plurality of resource requests and not based on the first plurality of resource requests;
apply, after the second time, the classifier for the resource access measures to each resource access measure from the plurality of resource access measures; and
assign a second security classification to each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures, after the second time, to the resource access measure from the plurality of resource access measures associated with that resource.

4. The processor-readable medium of claim 1 , wherein
the plurality of resource requests is a first plurality of resource requests,
the plurality of resource access measures is generated at a first time, and
the security classification assigned to each resource from the plurality of resources is a first security classification assigned to that resource before a second time,

the processor-readable medium further storing code representing instructions that when executed at the processor cause the processor to:
update, at the second time after the first time, the plurality of resource access measures based on a second plurality of resource requests and not based on the first plurality of resource requests;
modify the classifier for the resource access measures using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications;
apply, after the second time, the classifier for the resource access measures to each resource access measure from the plurality of resource access measures; and
assign a second security classification to each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures, after the second time, to the resource access measure from the plurality of resource access measures associated with that resource.

5. The processor-readable medium of claim 1 , wherein the code representing instructions that when executed at the processor cause the processor to generate the plurality of resource access measures includes code representing instructions that when executed at the processor cause the processor to:
determine a sub-resource access measure for that resource from the plurality of resource requests.

6. The processor-readable medium of claim 1 , wherein the code representing instructions that when executed at the processor cause the processor to generate the plurality of resource access measures includes code representing instructions that when executed at the processor cause the processor to:
determine a host access measure for that resource, a group access measure for that resource, a sub-resource access measure for that resource, or a combination thereof from the plurality of resource requests.

7. A resource classification method, comprising:
accessing a plurality of resource request records representing resource requests for a plurality of resources, each resource request record from the plurality of resource request records associated with a resource from the plurality of resources by a resource identifier of that resource;
determining whether a plurality of resource access measures were previously generated for the plurality of resource request records;
updating the plurality of resource access measures based on the plurality of resource request records responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures;
generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource request records, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure is a value that describes a ratio of a number of the resource request records associated with the plurality of resource request records;
applying the classifier for the resource access measures to the plurality of resource access measures for each resource from the plurality of resources; and
assigning a security classification to the plurality of resources for each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures to the plurality of resource access measures associated with that resource.

8. The method of claim 7 , wherein:
the plurality of resource request records include Domain Name System request records and Hypertext Transfer Protocol request records.

9. The method of

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Manadhata Pratyusa Kumar
• Rao Prasad V
• Home William G

Classifications

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title