Techniques for detecting persistent digital assets on an external attack surface

1 . A method for detecting persistent digital assets in an attack surface of a networked computing environment, comprising:

continuously detecting digital asset information over a network interface from the networked computing environment;

updating a representation of a digital asset in a security database in response to determining that the digital asset information corresponds to a previously detected digital asset;

generating the representation of the digital asset in the security database in response to determining that the digital asset information corresponds to a new digital asset;

detecting a plurality of attribute values in the digital asset information;

determining that the digital asset information corresponds to the previously detected digital asset in response to determining that a portion of the plurality of attribute values match a stored portion of values of the previously detected digital asset; and

evicting the representation of the digital asset from the security database, in response to determining that the digital asset information does not include attribute values matching stored attribute values of the digital asset.

2 . The method of claim 1 , further comprising:

detecting a hash of a digital certificate in the digital asset information; and

determining that the digital asset information corresponds to the previously detected digital asset in response to determining that the detected hash matches a stored hash of the previously detected digital asset.

3 . The method of claim 1 , further comprising:

determining that an attribute value of the plurality of attribute values is a validated value in response to detecting the attribute value changes at a number of instances which exceed a predetermined threshold; and

determining that the attribute value is an unvalidated value in response to detecting the attribute value changes being at a number of instances less than the predetermined threshold.

4 . The method of claim 3 , further comprising:

determining statistical distribution of the attribute value; and

determining that the digital asset information corresponds to the previously detected digital asset in response to determining that the attribute value is an infrequent value based on the determined statistical distribution.

5 . The method of claim 1 , further comprising:

generating the representation of the digital asset based on the detected digital asset information.

6 . The method of claim 5 , wherein the detected digital asset information includes any one of: a network address, a subnet, an IP range, a communication port, a domain name, an operating system version, a hash of a certificate, an application version, a name from a namespace, a UUID, a MAC address, a known device identifier, a content, a website, a file, a filename, a network protocol banner, remote desktop address, a login page, and any combination thereof.

7 . The method of claim 1 , further comprising:

detecting a change in a domain name service (DNS) record associated with the networked computing environment; and

replacing a stored network address in the representation of the digital asset with a network address corresponding to the changed DNS record.

8 . The method of claim 1 , wherein the digital asset is any one of: a virtual machine, a software container, a serverless function, a personal computing device, an IoT device, a physical computing device, a firewall, a hypervisor, a load balancer, a container, a pod, a database system, and any combination thereof.

9 . The method of claim 1 , further comprising:

receiving an identifier of an organization;

detecting in a DNS record a plurality of network addresses, wherein the DNS record is associated with the organization;

sending a network protocol message to a destination based on a network address of the plurality of network addresses; and

receiving a reply to the network protocol message as part of the digital asset information.

10 . A non-transitory computer-readable medium storing a set of instructions for detecting persistent digital assets in an attack surface of a networked computing environment, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

continuously detect digital asset information over a network interface from the networked computing environment;

update a representation of a digital asset in a security database in response to determining that the digital asset information corresponds to a previously detected digital asset;

generate the representation of the digital asset in the security database in response to determining that the digital asset information corresponds to a new digital asset

detect a plurality of attribute values in the digital asset information;

determine that the digital asset information corresponds to the previously detected digital asset in response to determining that a portion of the plurality of attribute values match a stored portion of values of the previously detected digital asset; and

evict the representation of the digital asset, in response to determining that the digital asset information does not include attribute values matching stored attribute values of the digital asset.

11 . A system for detecting persistent digital assets in an attack surface of a networked computing environment comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

continuously detect digital asset information over a network interface from the networked computing environment;

update a representation of a digital asset in a security database in response to determining that the digital asset information corresponds to a previously detected digital asset; and

generate the representation of the digital asset in the security database in response to determining that the digital asset information corresponds to a new digital asset

detect a plurality of attribute values in the digital asset information;

determine that the digital asset information corresponds to the previously detected digital asset in response to determining that a portion of the plurality of attribute values match a stored portion of values of the previously detected digital asset and;

evict the representation of the digital asset, in response to determining that the digital asset information does not include attribute values matching stored attribute values of the digital asset.

12 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect a hash of a digital certificate in the digital asset information; and

determine that the digital asset information corresponds to the previously detected digital asset in response to determining that the detected hash matches a stored hash of the previously detected digital asset.

13 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine that an attribute value of the plurality of attribute values is a validated value in response to detecting the attribute value changes being a number of instances which exceed a predetermined threshold; and

determine that the attribute value is an unvalidated value in response to detecting that the attribute value changes at a number of instances less than the predetermined threshold.

14 . The system of claim 13 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

determine statistical distribution of the attribute value; and

determine that the digital asset information corresponds to the previously detected digital asset in response to determining that the attribute value is an infrequent value based on the determined statistical distribution.

15 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

generate the representation of the digital asset based on the detected digital asset information.

16 . The system of claim 15 , wherein the detected digital asset information includes any one of: a network address, a subnet, an IP range, a communication port, a domain name, an operating system version, a hash of a certificate, an application version, a name from a namespace, a UUID, a MAC address, a known device identifier, a content, a website, a file, a filename, a network protocol banner, remote desktop address, a login page, and any combination thereof.

17 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

detect a change in a domain name service (DNS) record associated with the networked computing environment; and

replace a stored network address in the representation of the digital asset with a network address corresponding to the changed DNS record.

18 . The system of claim 11 , wherein the digital asset is any one of:

a virtual machine, a software container, a serverless function, a personal computing device, an IoT device, a physical computing device, a firewall, a hypervisor, a load balancer, a container, a pod, a database system, and any combination thereof.

19 . The system of claim 11 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

receive an identifier of an organization;

detect in a DNS record a plurality of network addresses, wherein the DNS record is associated with the organization;

send a network protocol message to a destination based on a network address of the plurality of network addresses; and

receive a reply to the network protocol message as part of the digital asset information.