Systems and methods for assessing cybersecurity risk in a work from home environment

Patent metadata

Field	Value
Publication number	US-12079347-B2
Application number	US-202217710168-A
Country	US
Kind code	B2
Filing date	Mar 31, 2022
Priority date	Mar 31, 2021
Publication date	Sep 3, 2024
Grant date	Sep 3, 2024

Abstract

Methods and systems are provide for assessing the cybersecurity state of entities based on extended-computer network characteristics. A method can include obtaining, for a plurality of computer networks associated with an entity and not associated with the entity, a first and second network dataset. The first and second network datasets can be combined. A plurality of Internet Protocol (IP) addresses associated with the entity and associated with a plurality of entities can be obtained, where the entity and the plurality of entities each associated with a unique identifier (UID). The method can include determining whether each of the plurality of computer networks not associated with the entity comprises a remote office network. A cybersecurity state of the entity can be determined based on an evaluation of security characteristics of the IP addresses associated with the entity and of one or more IP addresses attributed to the remote office networks.

First claim

What is claimed is:

1. A computer-implemented method comprising:
obtaining, for at least one computer network of a plurality of computer networks associated with an entity, a first network dataset;
obtaining, for at least one computer network of a plurality of computer networks not associated with the entity and providing access to the at least one computer network of the plurality of computer networks associated with the entity, a second network dataset;
combining the first and second network datasets to form a combined dataset comprising a plurality of entries, wherein each entry comprises a device identifier, a network identifier, and a timestamp identifier;
obtaining a plurality of Internet Protocol (IP) addresses associated with the entity;
obtaining a plurality of IP addresses associated with a plurality of entities unrelated to the entity, wherein the entity and the plurality of entities unrelated to the entity are each associated with a unique identifier (UID);
for each of the plurality of entries, if the respective network identifier of the entry corresponds to a threshold number of associated UIDs, removing the entry from the combined dataset to form a filtered dataset;
determining, based in part on the IP addresses associated with the entity, whether each of the plurality of computer networks not associated with the entity comprises a remote office network of one or more remote office networks associated with the entity based on the filtered dataset; and
assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses associated with the entity and security characteristics of one or more IP addresses attributed to the one or more remote office networks.

2. The method of claim 1 , wherein each device identifier corresponds to a computing device, wherein each network identifier corresponds to a computer network of the plurality of computer networks associated with the entity or to a computer network of the plurality of computer networks not associated with the entity and providing access to the at least one computer network of the plurality of computer networks associated with the entity, and wherein each timestamp identifier corresponds to a timestamp at which the computing device accessed the computer network.

3. The method of claim 1 , wherein the plurality of entities unrelated to the entity comprises a plurality of proxy provider entities, further comprising:
for each of the plurality of entries, if the respective network identifier of the entry corresponds to one of the plurality of proxy provider entities, replacing the network identifier with an origin network identifier.

4. The method of claim 1 , further comprising:
for each of the plurality of entries, if the respective device identifier of the entry is associated with less than a threshold number of network identifiers from the plurality of entries, removing the entry from the plurality of entries of the combined dataset.

5. The method of claim 1 , further comprising:
mapping the plurality of IP addresses associated with the entity and with the plurality of entities unrelated to the entity to the combined dataset; and
based on the mapping, for each of the plurality of entries comprising a network identifier corresponding to one of the mapped plurality of IP addresses, assigning the respective UID associated with the entity or associated with one of the plurality of entities unrelated to the entity to the entry.

6. The method of claim 5 , wherein mapping the plurality of IP addresses associated with the entity and with the plurality of entities unrelated to the entity to the combined dataset comprises:
for each of the plurality of entries:
determining whether one of the plurality of IP addresses associated with the entity and with the plurality of entities unrelated to the entity corresponds to the network identifier of the entry; and
if one of the plurality of IP addresses associated with the entity or with the plurality of entities unrelated to the entity corresponds to the network identifier of the entry, identifying the respective UID associated with the corresponding entity or the corresponding one of the plurality of entities unrelated to the entity.

7. The method of claim 5 , further comprising:
generating, based on the plurality of entries, a pair dataset comprising a plurality of unique pairs, wherein each unique pair comprises a respective device identifier and a respective UID from one of the plurality of entries.

8. The method of claim 7 , wherein the plurality of entities unrelated to the entity comprises a plurality of service provider entities, further comprising:
for each of the plurality of unique pairs, if the unique pair corresponds to one of the plurality of service provider entities, removing the unique pair from the pair dataset.

9. The method of claim 8 , wherein removing the respective unique pair from the pair dataset comprises:
determining one of the respective UIDs associated with the plurality of service provider entities corresponds to the respective UID of the unique pair.

10. The method of claim 8 , further comprising:
identifying, based on respective device identifiers of both the combined dataset and the pair dataset, each respective UID of the plurality of pairs associated with the respective network identifiers from the plurality of entries; and
assigning the respective identified UIDs of the plurality of pairs to the plurality of entries of the combined dataset as the associated UIDs.

11. The method of claim 10 , wherein assigning the respective UIDs of the plurality of pairs to the plurality of entries as the associated UIDs comprises:
for each of the plurality of pairs:
determining whether the respective UID of the respective pair is associated with one or more of the respective network identifiers of the plurality of entries based on the respective device identifier of the respective pair and the respective device identifiers of the plurality of entries; and
if the respective UID of the respective pair is associated with one or more of the respective network identifiers of the plurality of entries, mapping the respective UID of the respective pair to the plurality of entries including the one or more of the respective network identifiers as one of the associated UIDs.

12. The method of claim 10 , further comprising:
for each network identifier of the plurality of entries, determining, based on the associated UIDs of the combined dataset, a first number of the respective device identifiers from the plurality of pairs that are associated with the respective network identifier, wherein the first number of the respective device identifiers from the plurality of pairs are each associated with a common associated UID.

13. The method of claim 12 , further comprising:
for each network identifier of the plurality of entries, determining a second number of respective device identifiers from the plurality of entries that are associated with the respective network identifier.

14. The method of claim 13 , wherein the plurality of entities unrelated to the entity comprises a plurality of non-service provider entities, further comprising:
for each of the plurality of entries, if the respective UID of the entry corresponds to one of the plurality of non-service provider entities, removing the entry from the plurality of entries of the combined dataset.

15. The method of claim 13 , further comprising:
for each network identifier of the plurality of entries:
determining a ratio of the first number to the second number; and
if the deter

Assignees

• Bitsight Tech Inc

Inventors

• Dahlberg Daniel
• Boyer Stephen
• Gladstone Philip John Steuart

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title