Asset anomaly detection based on cross organizational asset data modeling
Methods and systems for identifying assets for review. The methods described herein involve generating an organizational statistical model describing assets associated with a first organization and generating a report identifying a discrepancy between the organizational statistical model and an identified asset of the first type associated with the first organization.
1. A method comprising:
performing, by one or more computer systems:
receiving organizational asset data of a first organization, wherein the organizational asset data includes data regarding a plurality of assets of different types;
generating an organizational statistical model for the first organization by applying a clustering machine learning algorithm to the organizational asset data to cluster the plurality of assets into clusters according to respective types of the assets;
receiving cross-organizational asset data of a second organization, wherein the cross-organizational asset data includes data regarding a plurality of assets of different types associated with at least the second organization;
generating a cross-organizational statistical model associated with the second organization by applying the clustering machine learning algorithm to the cross-organizational asset data to cluster the plurality of assets of the second organization according to respective types of the assets of the second organization;
comparing the organizational statistical model with the cross-organizational statistical model to detect a discrepancy between a first asset of the first organization and a second asset of the second organization, wherein the second asset is in a second cluster associated with an asset type, and the first asset is in a first cluster associated with the same asset type; and
outputting a report summarizing the detected discrepancy.
2. The method of claim 1 , wherein
the discrepancy indicates that the second asset behaved in an unexpected or anomalous manner for assets of the asset type.
3. The method of claim 1 , wherein
the discrepancy is indicated as a security alert was observed for the second asset that is statistically unexpected or anomalous for assets of the asset type.
4. The method of claim 1 , wherein
the cross-organizational statistical model is generated based on statistical data of at least some of the organizational asset data of the first organization.
5. The method of claim 1 , further comprising the one or more computer systems:
receiving additional organizational asset data of the first organization, and in response:
updating the organizational statistical model based on the additional organizational asset data; and
updating the cross-organizational statistical model based on the additional organizational asset data.
6. The method of claim 1 , wherein
the cross-organizational statistical model is continuously updated based on additional organizational asset data of a plurality of organizations that are associated with a same industry.
7. The method of claim 1 , wherein
the asset type is a classification of assets based on one or more of:
whether a particular asset is a laptop,
whether a particular asset is a mobile device,
one or more types of software installed on the particular asset,
one or more configuration settings of the particular asset,
a connection history of the particular asset, and
one or more ports used by the particular asset, and
a packet count or bytes transmitted to or from the particular asset.
8. The method of claim 1 , wherein
the asset type is defined based on one or more golden standard assets of the asset type.
9. The method of claim 8 , wherein
the report is a security report outputted via a graphical user interface (GUI) of the security monitoring system, wherein the GUI is generated on a computer system remote from a first network of the first asset and a second network of the second asset.
10. The method of claim 1 , wherein
one or more computer systems are part of a security monitoring system configured to monitor respective security postures of a plurality of networks of a plurality of organizations.
11. The method of claim 10 , wherein
the discrepancy is indicated as a visual alert, and the method further includes performing one or more threat mitigation procedures on the second asset or the second network according to user input received via the GUI.
12. The method of claim 11 , further comprising display, via the GUI, a graphical representation of a set of clusters generated by the clustering machine learning algorithm including the first cluster and the second cluster, wherein the graphical representation indicates respective distances among the clusters determined using a distinct function.
13. The method of claim 10 , further comprising receiving, via the GUI, user feedback indicating to confirm the discrepancy or dismiss the discrepancy.
14. A system comprising:
one or more computer systems comprising one or more hardware processors, wherein the one or more hardware processors are configured to:
receive organizational asset data of a first organization, wherein the organizational asset data includes data regarding a plurality of assets of different types;
generate an organizational statistical model for the first organization by applying a clustering machine learning algorithm to the organizational asset data to cluster the plurality of assets into clusters according to respective types of the assets;
receive cross-organizational asset data of a second organization, wherein the cross-organizational asset data includes data regarding a plurality of assets of different types associated with at least the second organization;
generate a cross-organizational statistical model associated with the second organization by applying the clustering machine learning algorithm to the cross-organizational asset data to cluster the plurality of assets of the second organization according to respective types of the assets of the second organization;
compare the organizational statistical model with the cross-organizational statistical model to detect a discrepancy between a first asset of the first organization and a second asset of the second organization, wherein the second asset is in a second cluster associated with an asset type, and the first asset is in a first cluster associated with the same asset type; and
output a report summarizing the detected discrepancy.
15. The system of claim 14 , wherein
the discrepancy indicates that the second asset behaved in an unexpected or anomalous manner for assets of the asset type.
16. The system of claim 14 , wherein
the discrepancy is indicated as a security alert was observed for the second asset that is statistically unexpected or anomalous for assets of the asset type.
17. The system of claim 14 , wherein
the cross-organizational statistical model is generated based on statistical data of at least some of the organizational asset data of the first organization.
18. The system of claim 14 , wherein the one or more computer systems are configured to:
receive additional organizational asset data of the first organization, and in response:
updating the cross-organizational statistical model based on the additional organizational asset data.
19. The system of claim 14 , wherein the asset type is a classification of assets based on one or more of:
whether a particular asset is a laptop,
whether a particular asset is a mobile device,
one or more types of software installed on the particular asset,
one or more configuration settings of the particular asset,
a connection history of the particular asset, and
one or more ports used by the particular asset, and
a packet count or bytes transmitted to or from the particular asset.
20. The system of claim 14 , wherein
one or more computer systems are part of a security monitoring system configured to monitor respective security postures of a plurality of networks of a plurality of organizations.
21. The system of claim 20 , wherein
the report is a security report outputted via a graphical user interface (GUI) of the security monitoring system, wherein the GUI is generated on a computer system remote from a first network of the first asset and a second network of the second asset.