Granted Patent B2

US 8,997,234 · App. 13/192,214 · Granted Mar 31, 2015

Abstract

Claims (68)

1. A method performed by a scoring engine in a network environment, the method comprising:

identifying an asset with at least one vulnerability risk;

identifying at least one service running on at least one port on the asset;

identifying at least one connection to the at least one port;

calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection, wherein the operational dependence role indicates a relative importance of the asset in the network environment, wherein calculating the operational dependence role comprises calculating at least (i) a service dependence score for each of one or more ports on the asset as a weighted sum of an average of connections to the service running on the port and a protocol importance of a protocol associated with the port (ii) a host dependence score for the asset as a function of the one or more service dependence scores calculated for each of the one or more ports and (iii) a data importance score representing an importance of data communicated by the asset, wherein the operational dependence role is a function of a summation of the host dependence score and a multiplication of the host dependence score by the data importance score; and

modifying the vulnerability risk based on the operational dependence role.

2. The method of claim 1 , wherein modifying the vulnerability risk comprises marking the vulnerability risk up by the operational dependence role.

3. The method of claim 1 , wherein modifying the vulnerability risk comprises marking the vulnerability risk down by the operational dependence role.

4. The method of claim 1 , wherein calculating the operational dependence role comprises:

identifying a protocol of a data packet at the at least one port;

determining a protocol importance score of the protocol, wherein the protocol importance score comprises a numerical score assigned to the protocol based on a relative importance of the protocol in the network environment;

calculating a connection average for the asset;

determining a connection score of the connection average; and

calculating a service dependence score for the at least one service as a function of the connection score and the protocol importance score.

5. The method of claim 4 , wherein the function of the connection score and the protocol importance score is a weighted sum of the connection score and the protocol importance score.

6. The method of claim 4 , wherein calculating a connection average comprises:

identifying a number of connections to the asset over time;

identifying a number of clients connected to the asset; and

dividing the number of connections by the number of clients.

7. The method of claim 4 , further comprising:

calculating a respective service dependence score for each service running on the asset; sorting the respective service dependence scores; and calculating the host dependence score as an iterative function of the respective service dependence scores.

8. The method of claim 7 , further comprising: assigning the data importance score to the data communicated by the asset; and calculating the operational dependence role as a function of the host dependence score and the data importance score.

9. The method of claim 8 , wherein assigning the data importance score comprises presenting to a user a pull-down menu with a plurality of data importance scores.

10. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying an asset with at least one vulnerability risk;

identifying at least one service running on at least one port on the asset;

identifying at least one connection to the at least one port;

calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection, wherein the operational dependence role indicates a relative importance of the asset in the network environment, wherein calculating the operational dependence role comprises calculating at least (i) a service dependence score for each of one or more ports on the asset as a weighted sum of an average of connections to the service running on the port and a protocol importance of a protocol associated with the port (ii) a host dependence score for the asset as a function of the one or more service dependence scores calculated for each of the one or more ports and (iii) a data importance score representing an importance of data communicated by the asset, wherein the operational dependence role is a function of a summation of the host dependence score and a multiplication of the host dependence score by the data importance score; and

modifying the vulnerability risk based on the operational dependence role.

11. The logic of claim 10 , wherein calculating the operational dependence role comprises:

identifying a protocol of a data packet at the at least one port;

determining a protocol importance score of the protocol, wherein the protocol importance score comprises a numerical score assigned to the protocol based on a relative importance of the protocol in the network environment;

calculating a connection average for the asset;

determining a connection score of the connection average, and

calculating a service dependence score for the at least one service as a function of the connection score and the protocol importance score.

12. The logic of claim 11 , wherein calculating a connection average comprises:

identifying a number of connections to the asset;

identifying a number of clients connected to the asset; and

dividing the number of connections by the number of clients.

13. The logic of claim 11 , the processor being operable to perform further instructions comprising:

calculating a respective service dependence score for each service running on the asset;

sorting the respective service dependence scores; and

calculating the host dependence score as an interactive function of the respective service dependence scores.

14. The logic of claim 13 , the processor being operable to perform further instructions comprising:

assigning the data importance score to the data communicated by the asset; and

calculating the operational dependence role as a function of the host dependence score and the data importance score.

15. An apparatus comprising:

a memory element configured to store data; and

a computing processor operable to execute instructions associated with the data, including:

identifying an asset with at least one vulnerability risk;

identifying at least one service running on at least one port on the asset;

identifying at least one connection to the at least one port;

calculating an operational dependence role of the asset as a function of the at least one service and the at least one connection, wherein the operational dependence role indicates a relative importance of the asset in the network environment, wherein calculating the operational dependence role comprises calculating at least (i) a service dependence score for each of one or more ports on the asset as a weighted sum of an average of connections to the service running on the port and a protocol importance of a protocol associated with the port (ii) a host dependence score for the asset as a function of the one or more service dependence scores calculated for each of the one or more ports and (iii) a data importance score representing an importance of data communicated by the asset, wherein the operational dependence role is a function of a summation of the host dependence score and a multiplication of the host dependence score by the data importance score; and

modifying the vulnerability risk based on the operational dependence role.

16. The apparatus of claim 15 , wherein the apparatus is connected to a network comprising the asset.

17. The apparatus of claim 16 , wherein the apparatus is configured to monitor network traffic on the network.

18. The apparatus of claim 15 , wherein calculating the operational dependence role comprises:

identifying a protocol of a data packet at the at least one port;

determining a protocol importance score of the protocol, wherein the protocol importance score comprises a numerical score assigned to the protocol based on a relative importance of the protocol in the network environment; calculating a connection average for the asset;

determining a connection score of the connection average; and

calculating a service dependence score for the at least one service as a function of the connection score and the protocol importance score.

19. The apparatus of claim 18 , the processor being operable to execute further instructions comprising:

calculating a respective service dependence score for each service running on the asset;

sorting the respective service dependence scores; and

calculating the host dependence score as an iterative function of the respective service dependence scores.

20. The apparatus of claim 19 , the processor being operable to execute further instructions comprising:

assigning the data importance score to the data communicated by the asset; and

calculating the operational dependence role as a function of the host dependence score and the data importance score.

Assignments (10)