Granted Patent B2

US 12,513,002 · App. 18/190,371 · Granted Dec 30, 2025

Inventors: Stuart Millar (Bangor, GB); Ralph McTeggart (Belfast, GB)

Assignee: Rapid7, Inc.

H04L9/3247G06N3/0455G06N3/08H04L9/3236H04L41/06H04L41/12H04L41/16H04L63/0876H04L63/10H04L63/20

Abstract

Claims (68)

1 . A method for verifying correctness of associations between assets related to events detected in at least one computer network and assets in an asset catalog for the at least one computer network, the asset catalog assets being addressable devices on the at least one computer network, the method comprising:

using at least one computer hardware processor to perform:

obtaining information specifying a first asset and a first set of one or more assets, in the asset catalog, with which the first asset was previously associated;

obtaining information about an event related to the first asset, the information specifying computer network addressing information for the first asset;

generating a signature of the first asset from the computer network addressing information;

generating, using the signature of the first asset, a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique to the signature of the first asset;

associating the first asset with a second set of one or more assets in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the one or more assets of the second set in the asset catalog;

determining whether the second set of assets includes the first set of assets; and

when it is determined that the second set of assets includes the first set of assets, outputting an indication that the first asset was correctly associated with the first set of assets.

2 . The method of claim 1 , further comprising:

when it is determined that at least one asset in the first set of assets is not part of the second set of assets, outputting an indication that the first asset was not correctly associated with the first set of assets.

3 . The method of claim 1 , wherein the computer network addressing information indicates at least one value for at least one network parameter, the at least one network parameter selected from the group consisting of: a hostname for the first asset on the at least one computer network, an IP address for the first asset on the at least one computer network, and/or a MAC address for the first asset.

4 . The method of claim 1 , wherein generating the signature of the first asset comprises generating a string representation of at least some of the computer network addressing information.

5 . The method of claim 1 , wherein generating the signature of the first asset comprises generating a numeric representation of at least some of the computer network addressing information using a character embedding technique.

6 . The method of claim 5 , wherein generating the numeric representation of the at least some of the computer network addressing information comprises:

generating an initial numeric representation by applying the character embedding technique to the at least some of the computer network addressing information; and

providing the initial numeric representation as input to at least one trained machine learning model to obtain the numeric representation,

wherein the numeric representation is a lower-dimensional representation than the initial numeric representation.

7 . The method of claim 1 , wherein applying the LSH technique to the signature of the first asset comprises applying a min-hash technique to the signature of the first asset.

8 . The method of claim 7 , wherein applying the min-hash technique to the signature of the first asset comprises:

generating a plurality of shingles from the signature of the first asset;

obtaining a plurality of hashes by hashing the plurality of shingles using one or more hashing functions;

permuting the plurality of hashes to obtain a permuted plurality of hashes;

selecting a first threshold number of hashes in the permuted plurality of hashes;

generating the hashed signature of the first asset using the selected hashes.

9 . The method of claim 8 , wherein the permuting comprises permuting the plurality hashing randomly.

10 . The method of claim 5 , wherein applying the LSH technique to the signature of the first asset comprises encoding the numeric representation using a plurality of randomized hyperplanes.

11 . The method of claim 10 , wherein encoding the numeric representation using the plurality of randomized hyperplanes, comprises:

generating the hashed signature of the first asset as a binary encoding of the numeric representation, the binary encoding specifying, for each particular hyperplane of the plurality of randomized hyperplanes, a side of the particular hyperplane on which the numeric representation falls.

12 . The method of claim 1 , wherein the at least one asset comprises multiple assets in the asset catalog, and wherein the associating comprises:

comparing the signature of the first asset with signatures of each of the multiple assets in the asset catalog; and

associating the first asset with a particular one of the multiple assets based on results of the comparing.

13 . A system for verifying correctness of associations between assets related to events detected in at least one computer network and assets in an asset catalog for the at least one computer network, the asset catalog assets being addressable devices on the at least one computer network, the system comprising:

at least one computer hardware processor; and

at least one non-transitory computer-readable storage medium storing processor executable instructions that, when executed by the at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:

obtaining information specifying a first asset and a first set of one or more assets, in the asset catalog, with which the first asset was previously associated;

obtaining information about an event related to the first asset, the information specifying computer network addressing information for the first asset;

generating a signature of the first asset from the computer network addressing information;

generating, using the signature of the first asset, a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique to the signature of the first asset;

associating the first asset with a second set of one or more assets in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the at one or more assets of the second set in the asset catalog;

determining whether the second set of assets includes the first set of assets; and

when it is determined that the second set of assets includes the first set of assets, outputting an indication that the first asset was correctly associated with the first set of assets.

14 . The system of claim 13 , wherein the method further comprises:

when it is determined that at least one asset in the first set of assets is not part of the second set of assets, outputting an indication that the first asset was not correctly associated with the first set of assets.

15 . The system of claim 13 , wherein applying the LSH technique to the signature of the first asset comprises applying a min-hash technique to the signature of the first asset.

16 . The system of claim 15 , wherein applying the min-hash technique to the signature of the first asset comprises:

generating a plurality of shingles from the signature of the first asset;

obtaining a plurality of hashes by hashing the plurality of shingles using one or more hashing functions;

permuting the plurality of hashes to obtain a permuted plurality of hashes;

selecting a first threshold number of hashes in the permuted plurality of hashes;

generating the hashed signature of the first asset using the selected hashes.

17 . At least one non-transitory computer-readable storage medium storing processor executable instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:

obtaining information specifying a first asset and a first set of one or more assets, in an asset catalog, with which the first asset was previously associated, the first asset and the assets of the asset catalog being addressable devices on at least one computer network;

obtaining information about an event related to the first asset, the information specifying computer network addressing information for the first asset;

generating a signature of the first asset from the computer network addressing information;

generating, using the signature of the first asset, a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique to the signature of the first asset;

associating the first asset with a second set of one or more assets in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the one or more assets of the second set in the asset catalog;

determining whether the second set of assets includes the first set of assets; and

when it is determined that the second set of assets includes the first set of assets, outputting an indication that the first asset was correctly associated with the first set of assets.

18 . The at least one non-transitory computer-readable storage medium of claim 17 , wherein the method further comprises:

when it is determined that at least one asset in the first set of assets is not part of the second set of assets, outputting an indication that the first asset was not correctly associated with the first set of assets.

19 . The at least one non-transitory computer-readable storage medium of claim 17 , wherein applying the LSH technique to the signature of the first asset comprises applying a min-hash technique to the signature of the first asset.

20 . The at least one non-transitory computer-readable storage medium of claim 19 , wherein applying the min-hash technique to the signature of the first asset comprises:

generating a plurality of shingles from the signature of the first asset;

obtaining a plurality of hashes by hashing the plurality of shingles using one or more hashing functions;

permuting the plurality of hashes to obtain a permuted plurality of hashes;

selecting a first threshold number of hashes in the permuted plurality of hashes;

generating the hashed signature of the first asset using the selected hashes.

Assignments (3)

Continuity (2)

References Cited (47)