IP Library Granted Patent US 10,848,382
Granted Patent B1
US 10,848,382 · App. 16/583,991 · Granted Nov 24, 2020

Systems and methods for network asset discovery and association thereof with entities

Inventors: Austin Allshouse (Raleigh, NC); Daniel Dahlberg (Somerville, MA)
Assignee: BitSight Technologies, Inc.
H04L41/0853H04L41/12H04L43/0876H04L67/22H04W40/24
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,848,382
App. No.
16/583,991
Granted
Nov 24, 2020
Kind
B1
Abstract

A system for discovering digital assets and determining an association between the assets and an entity analyzes publicly available information about entities of interest and dataset(s) generated via network observations from devices using the digital assets. Additional attributes included in the network observations dataset(s) and metadata from such observations may be used to enhance the correctness of the identified entity-asset associations. Network observations dataset(s) may be monitored on an on-going basis to provide current entity-asset associations.

Claims (83)

1. A method for identifying networking assets of an entity, the method comprising the steps of:

accessing a dataset of network observations that comprise network access information derived from a plurality of devices, wherein the dataset comprises a plurality of tuples, each tuple comprising a service set identifier (SSID) identifying a network accessed by a device and a network observation parameter;

evaluating from each tuple the corresponding SSID using a specified entity name;

identifying one or more SSIDs that match with the specified entity name;

filtering the one or more SSIDs according to the network observation parameter; and

designating the filtered SSIDs as networking assets of the entity.

2. The method of claim 1 , wherein the evaluating step with respect to a particular SSID comprises:

transforming the specified entity name into a plurality of distinct sub strings; and

comparing each substring with that particular SSID.

3. The method of claim 1 , wherein:

the evaluating step with respect to a particular SSID comprises scoring the particular SSID based on a degree of match between that particular SSID and the specified entity name; and

the step of identifying the one or more SSIDs comprises selecting SSIDs having a score at least equal to a specified threshold.

4. The method of claim 1 , wherein:

in each tuple, a respective network observation parameter comprises a respective location of a device accessing a network indicated by the corresponding SSID; and

the filtering step comprises removing from the identified one or more SSIDs, an SSID wherein a location of a device accessing a network indicated by that SSID does not match with any location of the entity.

5. The method of claim 1 , wherein in each tuple, a respective network observation parameter comprises a respective location of a device accessing a network indicated by the corresponding SSID, the method further comprising:

designating locations of the devices included in the tuples corresponding to the designated SSIDs as locations of the entity.

6. The method of claim 1 , wherein:

in each tuple, a respective network observation parameter comprises a respective network address of a device accessing a network indicated by the corresponding SSID; and

the filtering step comprises removing from the identified one or more SSIDs, an SSID wherein a network address of a device accessing a network indicated by that SSID does not match with any network address belonging to the entity.

7. The method of claim 1 , wherein in each tuple, a respective network observation parameter comprises a respective network address of a device accessing a network indicated by the corresponding SSID, the method further comprising:

designating the network addresses of the devices included in the tuples corresponding to the designated SSIDs as network addresses of the entity.

8. The method of claim 1 , wherein each tuple comprises a timestamp indicating time at which network access by the corresponding device was observed, the method further comprising:

dividing a specified time window into a specified number of time partitions;

identifying all tuples comprising a particular SSID;

identifying all time partitions corresponding to the respective timestamps included in the identified tuples;

determining that a total number of the identified partitions is less than a specified observation-count threshold; and

discarding, prior to the evaluating, selecting, or designating steps, the identified tuples.

9. A method for identifying networking assets of an entity, the method comprising the steps of:

accessing a dataset of network access information derived from a plurality of devices, wherein the dataset comprises a plurality of tuples, each tuple comprising: (a) a location of a device, and (b)(i) a service set identifier (SSID) representing a network accessed by the device, or (ii) a basic service set identifier (BSSID) corresponding to an access point of the network accessed by the device, or (iii) a network address designated to the device;

selecting one or more tuples wherein the location of the one or more devices associated with the one or more tuples matches with a location of a specified entity; and

designating: (i) the SSIDs in the tuple, or (ii) the BSSIDs in the tuple, or (iii) the network addresses in the tuple as networking assets of the entity.

10. The method of claim 9 , further comprising:

translating the location of a device from a tuple into a latitude-longitude location representation; or

translating the location of the specified entity into a latitude-longitude location representation.

11. The method of claim 10 , further comprising:

when a respective horizontal positioning error (HPE) value associated with a respective device location in a set of tuples is greater than a location-error threshold,

omitting from the dataset the set of tuples, prior to the selecting step.

12. The method of claim 10 , wherein determining that the location of the device matches with the location of the specified entity comprises evaluating a continuous distance metric or a discrete distance metric.

13. The method of claim 12 , wherein the continuous distance metric or the discrete distance metric corresponds to a size of premise of the entity.

14. A method for identifying networking assets of an entity, the method comprising the steps of:

obtaining a dataset comprising network access information derived from a plurality of devices, wherein the dataset comprises a plurality of tuples, each tuple comprising: (a) a network address designated to a device, and (b)(i) a service set identifier (SSID) representing a network accessed by the device, or (ii) a basic service set identifier (BSSID) corresponding to an access point of the network accessed by the device;

selecting one or more tuples wherein the network address designated to the one or more respective devices associated with the one or more tuples matches with a set of network addresses associated with a specified entity; and

designating: (i) the SSIDs in the tuple, or (ii) the BSSIDs in the tuple as networking assets of the entity.

15. The method of claim 14 , wherein:

each tuple comprises a location of the device; and

the designating step comprises determining that the location of the device in the tuple matches with a location of the specified entity.

16. The method of claim 14 , wherein each tuple comprises a location of the device, the method further comprising:

designating the location of the device as a location of the entity.

17. A system for identifying networking assets of an entity, comprising:

a processor;

a network port in communication with the processor and adapted to receive or access a dataset of network observations that comprise network access information derived from a plurality of devices, wherein the dataset comprises a plurality of tuples, each tuple comprising a service set identifier (SSID) identifying a network accessed by a device and a network observation parameter; and

a memory coupled to the processor and comprising instructions, which when executed by the processor, program the processor to:

evaluate from each tuple the corresponding SSID using a specified entity name;

identify one or more SSIDs that match with the specified entity name;

filter the one or more SSIDs according to the network observation parameter; and

designate the filtered SSIDs as networking assets of the entity.

18. The system of claim 17 , wherein to evaluating a particular SSID the instructions program the processor to:

transform the specified entity name into a plurality of distinct sub strings; and

compare each substring with that particular SSID.

19. The system of claim 17 , wherein:

to evaluate a particular SSID the instructions program the processor to score the particular SSID based on a degree of match between that particular SSID and the specified entity name; and

to identify the one or more SSIDs the instructions program the processor to select SSIDs having a score at least equal to a specified threshold.

20. The system of claim 17 , wherein:

in each tuple, a respective network observation parameter comprises a respective location of a device accessing a network indicated by the corresponding SSID; and

to perform the filtering operation, the instructions program the processor to remove from the identified one or more SSIDs, an SSID wherein a location of a device accessing a network indicated by that SSID does not match with any location of the entity.

21. The system of claim 17 ,

wherein in each tuple, a respective network observation parameter comprises a respective location of a device accessing a network indicated by the corresponding SSID; and

the instructions program the processor to designate locations of the devices included in the tuples corresponding to the designated SSIDs as locations of the entity.

22. The system of claim 17 , wherein:

in each tuple, a respective network observation parameter comprises a respective network address of a device accessing a network indicated by the corresponding SSID; and

to perform the filtering operation, the instructions program the processor to remove from the identified one or more SSIDs, an SSID wherein a network address of a device accessing a network indicated by that SSID does not match with any network address belonging to the entity.

23. The system of claim 17 , wherein:

in each tuple, a respective network observation parameter comprises a respective network address of a device accessing a network indicated by the corresponding SSID; and

the instructions program the processor to designate the network addresses of the devices included in the tuples corresponding to the designated SSIDs as network addresses of the entity.

24. The system of claim 17 , wherein:

each tuple comprises a timestamp indicating time at which network access by the corresponding device was observed; and

the instructions program the processor to:

divide a specified time window into a specified number of time partitions;

identify all tuples comprising a particular SSID;

identify all time partitions corresponding to the respective timestamps included in the identified tuples;

determine that a total number of the identified partitions is less than a specified observation-count threshold; and

discard, prior to the evaluating, selecting, or designating steps, the identified tuples.

Assignments (3)
SECURITY INTEREST Recorded Nov 19, 2020
From: BITSIGHT TECHNOLOGIES, INC.
To: SILICON VALLEY BANK, AS ADMINISTRATIVE AND COLLATERAL AGENT
Reel/Frame 054481/0727 →
SECURITY INTEREST Recorded Nov 19, 2020
From: BITSIGHT TECHNOLOGIES, INC.
To: SILICON VALLEY BANK
Reel/Frame 054481/0739 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 25, 2019
From: ALLSHOUSE, AUSTIN; DAHLBERG, DANIEL
To: BITSIGHT TECHNOLOGIES, INC.
Reel/Frame 050822/0638 →
Cited By (1)
US 12,238,014