Enhanced risk assessment

Patent metadata

Field	Value
Publication number	US-2022103592-A1
Application number	US-202017039009-A
Country	US
Kind code	A1
Filing date	Sep 30, 2020
Priority date	Sep 30, 2020
Publication date	Mar 31, 2022
Grant date	—

Abstract

Systems, methods, and related technologies for determining a risk score or value are described. The risk score determination may include accessing network traffic from a network, where the network traffic is associated with a plurality of entities. One or more values associated with one or more properties associated with an entity are determined. The one or more values may be based on the network traffic. At least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity are determined. A risk value for the entity is determined based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity.

First claim

What is claimed is:

1 . A method comprising:
accessing network traffic from a network, wherein the network traffic is associated with a plurality of entities; determining one or more values associated with one or more properties associated with an entity, wherein the one or more values are based on the network traffic; determining at least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity, wherein at least one of the functional risk value, the configurational risk value, or the behavioral risk value associated with the entity is based at least one of the values associated with the one or more properties associate with the entity; determining a risk value for the entity based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity; and storing the risk value for the entity.

2 . The method of claim 1 further comprising:
performing an action based on the risk value.

3 . The method of claim 1 , wherein the functional risk value is associated with at least one of asset criticality or asset acquittance associated with the entity.

4 . The method of claim 1 , wherein the configurational risk value is associated with at least one of a vulnerability, an end of life proximity, an open port, a credential, or an open share.

5 . The method of claim 1 , wherein the behavioral risk value is associated with at least one of Internet exposure, traffic posture, anomaly detection, encryption analysis, traffic reputation, or malicious activity.

6 . The method of claim 1 , wherein the risk value associated with the entity is based on at least one of a weight associated with the functional risk value, a weight associated with the configurational risk value, or a weight associated with the behavioral risk value.

7 . The method of claim 1 , wherein the risk value for the entity is determined based on at least one of an observed activity or a potential for compromise.

8 . A system comprising:
a memory; and a processing device, operatively coupled to the memory, to:
access network traffic from a network, wherein the network traffic is associated with a plurality of entities;
determine one or more values associated with one or more properties associated with an entity, wherein the one or more values are based on the network traffic;
determine at least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity, wherein at least one of the functional risk value, the configurational risk value, or the behavioral risk value associated with the entity is based at least one of the values associated with the one or more properties associate with the entity;
determine, by the processing device, a risk value for the entity based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity; and
store the risk value for the entity.

9 . The system of claim 8 , wherein the processing device further to:
perform an action based on the risk value.

10 . The system of claim 8 , wherein the functional risk value is associated with at least one of asset criticality or asset acquittance associated with the entity.

11 . The system of claim 8 , wherein the configurational risk value is associated with at least one of a vulnerability, an end of life proximity, an open port, a credential, or an open share.

12 . The system of claim 8 , wherein the behavioral risk value is associated with at least one of Internet exposure, traffic posture, anomaly detection, encryption analysis, traffic reputation, or malicious activity.

13 . The system of claim 8 , wherein the risk value associated with the entity is based on at least one of a weight associated with the functional risk value, a weight associated with the configurational risk value, or a weight associated with the behavioral risk value.

14 . The system of claim 8 , wherein the risk value for the entity is determined based on at least one of an observed activity or a potential for compromise.

15 . A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access network traffic from a network, wherein the network traffic is associated with a plurality of entities; determine one or more values associated with one or more properties associated with an entity, wherein the one or more values are based on the network traffic; determine at least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity, wherein at least one of the functional risk value, the configurational risk value, or the behavioral risk value associated with the entity is based at least one of the values associated with the one or more properties associate with the entity; determine, by the processing device, a risk value for the entity based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity; and store the risk value for the entity.

16 . The non-transitory computer readable medium of claim 15 , wherein the instructions encoded thereon that, when executed by the processing device, cause the processing device to:
perform an action based on the risk value.

17 . The non-transitory computer readable medium of claim 15 , wherein the functional risk value is associated with at least one of asset criticality or asset acquittance associated with the entity.

18 . The non-transitory computer readable medium of claim 15 , wherein the configurational risk value is associated with at least one of a vulnerability, an end of life proximity, an open port, a credential, or an open share.

19 . The non-transitory computer readable medium of claim 15 , wherein the behavioral risk value is associated with at least one of Internet exposure, traffic posture, anomaly detection, encryption analysis, traffic reputation, or malicious activity.

20 . The non-transitory computer readable medium of claim 15 , wherein the risk value associated with the entity is based on at least one of a weight associated with the functional risk value, a weight associated with the configurational risk value, or a weight associated with the behavioral risk value.

Assignees

• Forescout Tech Inc

Inventors

• Semel Keren Mina
• Kalbo Naor

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04W12/67

  Risk-dependent, e.g. selecting a security level depending on risk profiles · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title