Threat exposure management system using large language models
A system and method of using generative AI to identify exposures of computing devices on computing networks to actual and/or potential threats. The method includes collecting a plurality of responses from a plurality of devices to a target device on a private network. The method includes providing the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data. The method includes assigning, by the processing device using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions. The method includes generating, based on the plurality of device descriptions, a status report comprising a list of network addresses associated with a group of devices having access to the target device.
1 . A method comprising:
collecting a plurality of responses from a plurality of devices to a target device on a private network by performing a port scanning across a plurality of communication protocols to discover a plurality of online devices that are connected to at least one of a public network or the private network;
providing the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data;
assigning, by a processing device using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions;
ranking a plurality of customer departments based on which customer departments are most likely to be associated with the target device; and
generating, based on the plurality of device descriptions, a status report comprising both a list of network addresses associated with a group of devices having access to the target device and an indication of one or more customer departments of the plurality of customer departments most likely to be associated with the target device, wherein generating the status report further comprises identifying, based on the port scanning, a first offline device using a first communication protocol to provide a first response of the plurality of responses and a second offline device using a second communication protocol that is different from the first communication protocol to provide a second response of the plurality of responses.
2 . The method of claim 1 , wherein a first device of the plurality of devices communicates with the target device via the private network and a second device of the plurality of devices communicates with the target device via a public network.
3 . The method of claim 1 , wherein the plurality of responses are gathered by one or more sensors that monitor communication between the target device and the plurality of devices.
4 . The method of claim 1 , wherein generating, based on the plurality of device descriptions, the status report further comprises: excluding one or more network addresses of the one or more offline devices from the list of network addresses.
5 . The method of claim 1 , further comprising:
maintaining, in a database, a plurality of historical device descriptions associated with a plurality of historical responses from a plurality of sending devices to a plurality of receiving devices on the private network and a public network, each historical response of the plurality of historical responses is respectively associated with one or more historical device descriptions of the plurality of device descriptions and one or more device descriptions of the plurality of device descriptions.
6 . The method of claim 1 , wherein at least one of:
the classification model corresponds to a large language model (LLM); or
the plurality of device descriptions indicate at least one of a company name, a business vertical, a device type, or a department name.
7 . The method of claim 1 , wherein the status report further comprises at least one or more of:
an indication of one or more customers most likely to be associated with the target device; or
an indication of one or more customer devices most likely belonging to the one or more customers.
8 . The method of claim 1 , further comprising:
receiving a request for information indicating exposures of the target device on the private network; and
providing the status report to a different device on the private network.
9 . The method of claim 1 , further comprising:
generating one or more natural language strings comprising the one or more device descriptions of the plurality of device descriptions; and
including the one or more natural language strings in the status report.
10 . A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
collect a plurality of responses from a plurality of devices to a target device on a private network by performing a port scanning across a plurality of communication protocols to discover a plurality of online devices that are connected to at least one of a public network or the private network;
provide the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data;
assign, using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions;
rank a plurality of customer departments based on which customer departments are most likely to be associated with the target device; and
generate, based on the plurality of device descriptions, a status report comprising both a list of network addresses associated with a group of devices having access to the target device and an indication of one or more customer departments of the plurality of customer departments most likely to be associated with the target device, wherein to generate the status report, the processing is further to identify, based on the port scanning, a first offline device using a first communication protocol to provide a first response of the plurality of responses and a second offline device using a second communication protocol that is different from the first communication protocol to provide a second response of the plurality of responses.
11 . The system of claim 10 , wherein a first device of the plurality of devices communicates with the target device via the private network and a second device of the plurality of devices communicates with the target device via a public network.
12 . The system of claim 10 , wherein the plurality of responses are gathered by one or more sensors that monitor communication between the target device and the plurality of devices.
13 . The system of claim 10 , wherein to generate, based on the plurality of device descriptions, the status report, the processing device is further to: exclude one or more network addresses of the one or more offline devices from the list of network addresses.
14 . The system of claim 10 , wherein the processing device is further to:
maintain, in a database, a plurality of historical device descriptions associated with a plurality of historical responses from a plurality of sending devices to a plurality of receiving devices on the private network and a public network, each historical response of the plurality of historical responses is respectively associated with one or more historical device descriptions of the plurality of device descriptions and one or more device descriptions of the plurality of device descriptions.
15 . The system of claim 10 , wherein at least one of:
the classification model corresponds to a large language model (LLM); or
the plurality of device descriptions indicate at least one of a company name, a business vertical, a device type, or a department name.
16 . The system of claim 10 , wherein the status report further comprises at least one or more of:
an indication of one or more customers most likely to be associated with the target device; or
an indication of one or more customer devices most likely belonging to the one or more customers.
17 . The system of claim 10 , wherein the processing device is further to at least one of:
receive a request for information indicating exposures of the target device on the private network, and provide the status report to a different device on the private network; or
generate one or more natural language strings comprising the one or more device descriptions of the plurality of device descriptions, and include the one or more natural language strings in the status report.
18 . A non-transitory computer-readable medium storing instructions that, when execute by a processing device, cause the processing device to:
collect a plurality of responses from a plurality of devices to a target device on a private network by performing a port scanning across a plurality of communication protocols to discover a plurality of online devices that are connected to at least one of a public network or the private network;
provide the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data;
assign, by the processing device using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions;
rank a plurality of customer departments based on which customer departments are most likely to be associated with the target device; and
generate, based on the plurality of device descriptions, a status report comprising both a list of network addresses associated with a group of devices having access to the target device and an indication of one or more customer departments of the plurality of customer departments most likely to be associated with the target device, wherein generating the status report further comprises identifying, based on the port scanning, a first offline device using a first communication protocol to provide a first response of the plurality of responses and a second offline device using a second communication protocol that is different from the first communication protocol to provide a second response of the plurality of responses.