Estimating asset sensitivity using information associated with users

Patent metadata

Field	Value
Publication number	US-10984322-B2
Application number	US-201313939402-A
Country	US
Kind code	B2
Filing date	Jul 11, 2013
Priority date	Apr 9, 2013
Publication date	Apr 20, 2021
Grant date	Apr 20, 2021

Abstract

Automatically estimating a sensitivity level of an information technology (IT) asset in one aspect may obtain information about an asset. Characteristics of the asset assigned based on the information may be compared with stored characteristics of known sensitive assets. A sensitivity level of the asset may be determined based on the comparing.

First claim

We claim:

1. A method for automatically estimating a sensitivity level of an information technology asset, comprising:
obtaining information about an asset, the asset comprising a computer network and the obtaining the information comprises identifying Internet Protocol (IP) address from which the computer network is accessed, identifying a user associated with the IP address and determining user attributes of the user and entropy of user accesses of the computer network, the obtaining performed without having to access the asset such that privacy of the computer network is preserved;
assigning characteristics to the asset based on the information comprising at least the user attributes and the entropy of user accesses to the asset comprising a computer network;
comparing, by a processor, the characteristics of the asset with stored characteristics of known sensitive assets; and
determining, by the processor, a sensitivity level of the asset based on the comparing,
the sensitivity level determined without having to access the asset and privileged knowledge of the asset,
the characteristics comprising features and wherein a machine learning algorithm is trained based on the features to predict the sensitivity level,
the determining performed by executing the trained machine learning algorithm,
wherein the features can be uniformly used for different asset types in training the machine learning algorithm to predict a sensitivity level for a respective different asset type,
wherein the method identifies sensitivity levels for multiple assets respectively, the method facilitating computer security protection by automatically identifying a target asset among the multiple assets based on a corresponding determined sensitivity for providing security protection.

2. The method of claim 1 , wherein the obtaining information about an asset comprises obtaining one or more meta-level features of the asset.

3. The method of claim 1 , wherein the obtaining information about an asset comprises one or more of identifying user features comprising an identity of a user associated with the asset and user attributes associated with the user, identifying usage features associated with the asset, or identifying external content features from published data available outside the asset, or combinations thereof.

4. The method of claim 3 , wherein the characteristics of the asset are assigned by normalizing one or more of said user features associated with the asset, said usage features associated with the asset, or said external content features from published data available outside the asset, or combinations thereof.

5. The method of claim 1 , wherein the obtaining information about an asset comprises at least one of extracting access information from access logs, or performing Internet Protocol address-to-user mapping.

6. The method of claim 1 , wherein the obtaining information about an asset comprises identifying at least one of a job role or rank in an organization, or member type.

7. The method of claim 1 , wherein the obtaining information about an asset comprises at least identifying user features, and wherein the identifying user features comprises determining likely users of an asset.

8. The method of claim 1 , wherein the obtaining information about an asset comprises at least identifying usage features, and wherein the identifying usage features comprises obtaining at least one of usage frequency, usage patterns, access times, access duration, and number of users accessing the asset.

9. The method of claim 1 , wherein the obtaining information about an asset comprises at least identifying external data content features, and wherein the identifying external data content features comprises at least obtaining source information comprising at least one of titles, summaries, user documents, user data sources, patents, publications, file names, project groups, blogs, wiki sites, user web pages, and tags of user-related content.

10. The method of claim 9 , wherein the source information is used to generate a document representation of an asset.

11. The method of claim 10 , wherein the source information is aggregated for a plurality of document representations for the asset.

12. The method of claim 11 , further comprising applying one of topic modeling and clustering to the document representations to obtain content features for the asset.

13. The method of claim 1 , wherein a machine learning algorithm performs the comparing and the determining.

14. The method of claim 13 , wherein the machine learning algorithm comprises a k nearest neighbor based algorithm, wherein the sensitivity level of the asset is determined using

V
⁡

(
A
)

=

∑

i
=
1

k

⁢

ⅇ

-

d
⁡

(

A
,

S
i

)

·

V
⁡

(

S
i

)

wherein for
sensitivity of a new asset A, V(A) is then defined as a weighted average score of its k-nearest neighbors among known sensitive assets, {S 1 , . . . , S k },
and V(S i ) is a sensitivity value of S i , and e −d(A,S i ) is a weight function where d(A,S i ) is the Euclidean distance of two assets A and S i .

15. The method of claim 13 , wherein the machine learning algorithm comprises a clustering-based algorithm wherein the sensitivity level of the asset wherein the stored characteristics of known sensitive assets are clustered into subgroups and the sensitivity level of the asset is determined from using a subgroup having characteristics related to the asset.

16. The method of claim 13 , wherein the machine learming comprsies a k nearest neighbor method with at least one distance metric learning algorithm.

17. The method of claim 1 , further comprising allowing intelligently backing up of the asset based on the determined sensitivity level.

Assignees

• IBM

Inventors

• Chari Suresh N
• Gates Christopher
• Gates Stephen C
• Park Youngja
• Teiken Wilfried

Classifications

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06N5/02 Primary

  Knowledge representation; Symbolic representation · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title