Hashing techniques for associating assets related to events with addressable computer network assets
Techniques for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network. The techniques include: while monitoring activity on the at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset; generating a signature of the first asset from the computer network addressing information; generating a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique to the signature; associating the first asset with at least one asset in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the at least one asset in the asset catalog; and outputting information identifying the at least one asset with which the first asset was associated.
1 . A method for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network, the asset catalog assets being addressable on the at least one computer network, the method comprising:
using at least one computer hardware processor to perform:
while monitoring activity on the at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset;
generating, based on the computer network addressing information for the first asset, a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique;
associating the first asset with at least one asset in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the at least one asset in the asset catalog; and
outputting information identifying the at least one asset with which the first asset was associated.
2 . The method of claim 1 , wherein the computer network addressing information indicates at least one value for at least one network parameter, the at least one network parameter selected from the group consisting of: a hostname for the first asset on the at least one computer network, an IP address for the first asset on the at least one computer network, and a MAC address for the first asset.
3 . The method of claim 1 ,
wherein applying the LSH technique comprises applying the LSH technique to a string representation of network parameter values of the computer network addressing information.
4 . The method of claim 1 , further comprising:
generating a numeric representation of at least some of the computer network addressing information using a character embedding technique, wherein applying the LSH technique comprises applying the LSH technique to the numeric representation.
5 . The method of claim 4 , wherein generating the numeric representation of the at least some of the computer network addressing information comprises:
generating an initial numeric representation by applying the character embedding technique to the at least some of the computer network addressing information; and
providing the initial numeric representation as input to at least one trained machine learning model to obtain the numeric representation,
wherein the numeric representation is a lower-dimensional representation than the initial numeric representation,
wherein the at least one trained machine learning model comprises at least one autoencoder.
6 . The method of claim 1 , wherein applying the LSH technique to the computer network addressing information for the first asset comprises applying a min-hash technique to the computer network addressing information for the first asset.
7 . The method of claim 6 , wherein applying the min-hash technique to the computer network addressing information for the first asset comprises:
generating a plurality of shingles from the computer network addressing information for the first asset;
obtaining a plurality of hashes by hashing the plurality of shingles using one or more hashing functions;
permuting the plurality of hashes to obtain a permuted plurality of hashes;
selecting a first threshold number of hashes in the permuted plurality of hashes;
generating the hashed signature of the first asset using the selected hashes.
8 . The method of claim 4 , wherein applying the LSH technique to the computer network addressing information for the first asset comprises encoding the numeric representation using a plurality of randomized hyperplanes.
9 . The method of claim 8 , wherein encoding the numeric representation using the plurality of randomized hyperplanes, comprises:
generating the hashed signature of the first asset as a binary encoding of the numeric representation, the binary encoding specifying, for each particular hyperplane of the plurality of randomized hyperplanes, a side of the particular hyperplane on which the numeric representation falls.
10 . The method of claim 1 , wherein the at least one asset consists of a single asset in the asset catalog.
11 . The method of claim 1 , wherein the at least one asset comprises multiple assets in the asset catalog, and wherein the associating comprises:
comparing the computer network addressing information for the first asset with computer network addressing information of each of the multiple assets in the asset catalog; and
associating the first asset with a particular one of the multiple assets based on results of the comparing.
12 . The method of claim 11 , further comprising:
generating a first numeric representation of at least some of the computer network addressing information, and
wherein the comparing comprises comparing the first numeric representation with numeric representations of the multiple assets.
13 . The method of claim 12 , wherein generating the first numeric representation comprises:
generating an initial numeric representation by applying a character embedding technique to the at least some of the computer network addressing information; and
providing the initial numeric representation as input to at least one trained machine learning model to obtain the numeric representation,
wherein the numeric representation is a lower-dimensional representation than the initial numeric representation.
14 . The method of claim 1 , wherein the event related to the first asset comprises:
a communication from the first asset, a communication directed to the first asset, or a communication identifying the first asset.
15 . The method of claim 1 , wherein the first asset is a physical device addressable on the at least one computer network or a virtual device addressable on the at least one computer network.
16 . The method of claim 1 , further comprising:
identifying a policy associated with the identified at least one asset; and
processing the event related to the first asset in accordance with the identified policy.
17 . The method of claim 16 , wherein the event comprises a request to access the first asset, the method further comprising:
determining whether access to the first asset is permitted under the identified policy; and
when access to the first asset is to be granted under the identified policy, permitting access to the first asset, and
when access to the first asset is to be denied under the identified policy, blocking access to the first asset.
18 . The method of claim 16 , wherein the event is a communication from the first asset, the method further comprising:
determining an identifier associated with the first asset; and
blocking the communication when the identifier is inconsistent with the identifier dictated by the identified policy.
19 . A system for associating assets related to events detected in at least one computer network with respective assets in an asset catalog for the at least one computer network, the asset catalog assets being addressable on the at least one computer network, the system comprising:
at least one computer hardware processor; and
at least one non-transitory computer-readable storage medium storing processor executable instructions that, when executed by the at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:
while monitoring activity on the at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset;
generating, based on the computer network addressing information for the first asset, a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique;
associating the first asset with at least one asset in the asset catalog using the hashed signature of the first asset and at least one hashed signature of the at least one asset in the asset catalog; and
outputting information identifying the at least one asset with which the first asset was associated.
20 . At least one non-transitory computer-readable storage medium storing processor executable instructions that, when executed by at least one computer hardware processor, cause the at least one computer hardware processor to perform a method comprising:
while monitoring activity on at least one computer network, obtaining information about an event related to a first asset, the information specifying computer network addressing information for the first asset;
generating, based on the computer network addressing information for the first asset, a hashed signature of the first asset by applying a locality sensitive hashing (LSH) technique;
associating the first asset with at least one asset in an asset catalog of the at least one computer network using the hashed signature of the first asset and at least one hashed signature of the at least one asset in the asset catalog; and
outputting information identifying the at least one asset with which the first asset was associated.