Systems and methods for assessing cybersecurity state of entities based on computer network characterization

Patent metadata

Field	Value
Publication number	US-11050779-B1
Application number	US-202017018587-A
Country	US
Kind code	B1
Filing date	Sep 11, 2020
Priority date	Jan 29, 2020
Publication date	Jun 29, 2021
Grant date	Jun 29, 2021

Abstract

Computer-implemented methods are provided for assessing the cybersecurity state of entities based on computer network characterization. The exemplary method can include obtaining, for one or more computer networks of a plurality of computer networks associated with an entity, a network dataset including a service set identifier (SSID); and obtaining a plurality of Internet Protocol (IP) addresses associated with the entity. The method can further include determining whether each of the plurality of computer networks includes a public network or a private network based on the network dataset; and assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses attributed to the private network, excluding security characteristics of the IP addresses attributed to the public network.

First claim

What is claimed is:

1. A computer-implemented method comprising:
obtaining, for at least one computer network of a plurality of computer networks associated with an entity, a dataset indicating at least one network characteristic, wherein the dataset comprises
a network dataset comprising a service set identifier (SSID);

obtaining a plurality of Internet Protocol (IP) addresses associated with the entity;
obtaining one or more SSIDs of common public networks;
blacklisting the SSIDs of the common public networks such that at least one IP address of the plurality of IP addresses is not attributed to one or more of the common public networks; and
determining whether each of the plurality of computer networks comprises a public network or a private network based on the dataset.

2. The method of claim 1 , wherein determining whether each of the computer networks comprises a public network or a private network based on the dataset comprises:
determining whether the SSID includes a term comprising at least one of: “guest”, “public”, “visit”, “byod”, “free”, “customer”, or “personal”, wherein the term is in a natural language.

3. The method of claim 1 , wherein the dataset comprises a plurality of network datasets including the network dataset, wherein each network dataset comprises an SSID and is from a unique time,
wherein the determining whether each of the computer networks comprises a public network or a private network based on the dataset is performed for at least two network datasets of the plurality of network datasets.

4. The method of claim 3 , wherein the time corresponds to a day and wherein the determining whether each of the computer networks comprises a public network or a private network based on the dataset is performed for at least three network datasets of the plurality of network datasets.

5. The method of claim 1 , wherein the determining whether each of the computer networks comprises a public network or a private network based on the dataset comprises:
for a given network of the plurality of computer networks, determining that the given computer network is a public network based on a connection record of the device, the connection record indicating whether the device previously connected to a different computer network (i) for a longer duration than connecting to the given computer network and/or (ii) more frequently than connecting to the given computer network.

6. The method of claim 1 , wherein the dataset further comprises at least one of:
(a) for each device of a plurality of devices coupled to the at least one computer network, a device dataset comprising at least one of: cookies, device fingerprints, or a device identifier; or
(b) for each user of a plurality of users of the at least one computer network, an email dataset comprising at least one of:
(i) an indication that the user opened or read an email from an email service provider and network information associated with a client with which the user opened or read the email, or
(ii) a user identifier comprising at least one of a user email address or web account information.

7. The method of claim 6 , wherein the dataset comprises the device dataset for each device, and wherein determining whether each of the computer networks comprises a public network or a private network based on the dataset comprises:
determining whether the at least one device has connected to at least one computer network of the plurality of computer networks.

8. The method of claim 7 , wherein, if the device has connected to the at least one computer network, the determining whether each of the computer networks comprises a public network or a private network based on the dataset comprises:
determining a connection duration and/or connection frequency of the device connected to the at least one computer network in a given time period.

9. The method of claim 7 , further comprising:
comparing (i) a first number of devices of the plurality of devices that has connected to the at least one computer network to (ii) a second number of devices typically associated with the at least one computer network; and
determining that the at least one computer network comprises a public network if the first number is greater than the second number.

10. The method of claim 6 , wherein the dataset comprises the email dataset for each user, and wherein the user identifier indicates a first computer network, the method further comprising:
comparing (i) the first computer network to (ii) at least a second computer network to which the user belongs; and
if the first computer network is not the second computer network, determining that the computer network is a public network.

11. The method of claim 6 , wherein the dataset comprises at least two of (a) the network dataset, (b) the device dataset for each device, or (c) the email dataset for each user.

12. The method of claim 6 , wherein the dataset comprises the email dataset for each user, and wherein the network information indicates a first computer network in which the client was used to open or read the email, the method further comprising:
comparing (i) the first computer network to (ii) at least a second computer network to which the user belongs; and
if the first computer network is not the second computer network, determining that the computer network is a public network.

13. The method of claim 1 , further comprising:
assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses attributed to the private network, excluding security characteristics of the IP addresses attributed to the public network.

14. The method of claim 1 , wherein the determining whether each of the plurality of computer networks comprises a public network or a private network based on the dataset further comprises:
providing at least a portion of the network dataset as input to a machine learning model to determine whether the network is a public network or a private network.

15. A system comprising:
at least one memory storing computer-executable instructions; and
at least one processor for executing the instructions stored on the memory, wherein execution of the instructions programs the at least one processor to perform operations comprising:
obtaining, for at least one computer network of a plurality of computer networks associated with an entity, a dataset indicating at least one network characteristic, wherein the dataset comprises
a network dataset comprising a service set identifier (SSID);

obtaining a plurality of Internet Protocol (IP) addresses associated with the entity;
obtaining one or more SSIDs of common public networks;
blacklisting the SSIDs of the common public networks such that at least one IP address of the plurality of IP addresses is not attributed to one or more of the common public networks; and
determining whether each of the plurality of computer networks comprises a public network or a private network based on the dataset.

16. The system of claim 15 , wherein the dataset comprises a plurality of network datasets including the network dataset, wherein each network dataset comprises an SSID and is from a unique time,
wherein the determining whether each of the computer networks comprises a public network or a private network based on the dataset is performed for at least two network datasets of the plurality of network datasets.

17. The system of claim 15 , wherein the determining whether each of the computer networks comprises a public network or a private network based on the dataset co

Assignees

• Bitsight Tech Inc

Inventors

• Dahlberg Daniel
• Allshouse Austin Payne

Classifications

• G06F40/295 Primary

  Named entity recognition · CPC title

• H04L61/5007

  Internet protocol [IP] addresses · CPC title

• H04L51/42

  Mailbox-related aspects, e.g. synchronisation of mailboxes · CPC title

• H04L51/234

  for tracking messages · CPC title

• H04L12/28

  characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks] (wireless communication networks H04W {; arrangements for dividing the transmission path H04W40/00}) · CPC title