Method for characterizing asset groups spanning multiple asset classes in a computer network

1 . A method comprising:

accessing a first set of objects, generated by a set of sources during a first time interval, representing attributes of a first set of assets comprising a first asset and a second asset;

partitioning the first set of objects into a first set of object groups, each object group in the first set of object groups representing an asset in the first set of assets;

for each object group in the set of object groups, aggregating attributes represented in objects in the object group into an asset container, in a set of asset containers, representing an asset in the first set of assets;

accessing a first set of attributes, from a first asset container in the set of asset containers, exhibited by the first asset during the first time interval;

identifying a first association between the first asset and the second asset based on the first set of attributes;

accessing a second set of attributes, from a second asset container in the set of asset containers, exhibited by the second asset during the first time interval;

based on the first association between the first asset and the second asset, associating the first asset with a first subset of attributes in the second set of attributes;

defining a first attribute category exhibiting a target combination of attributes;

identifying a first asset group, comprising the first asset group, exhibiting the target combination of attributes during the first time interval based on the target combination of attributes represented in:

the first set of attributes; and

the first subset of attributes, in the second set of attributes, associated with the first asset;

generating a first notification specifying the first asset group; and

serving the first notification at an operator portal.

2 . The method of claim 1 :

further comprising:

assigning a risk level to the first attribute category; and

calculating a first risk score to the first asset based on:

the risk level assigned to the first attribute category; and

the target combination of attributes represented in the first set of attributes and the first subset of attributes, in the second set of attributes, associated with the first asset; and

wherein generating the first notification comprises generating the first notification further specifying the first risk score.

3 . The method of claim 2 , further comprising:

assigning a first action to the first attribute category; and

in response to the first score exceeding a risk threshold, executing the first action, assigned to the first attribute category, on the first asset group.

4 . The method of claim 1 :

wherein defining the first attribute category comprises defining the first attribute category exhibiting the target combination of attributes comprising:

a first subcombination of attributes associated with assets characterized by the first asset class; and

a second subcombination of attributes associated with assets characterized by the second asset class; and

wherein identifying the first asset group comprises identifying the first asset group comprising the first asset based on:

the first set of attributes, exhibited by the first asset characterized by the first asset class, comprising a first subset of attributes corresponding to the first subcombination of attributes in the target combination of attributes; and

the first subset of attributes, in the second set of attributes exhibited by the second asset characterized by the second asset class, comprising a second subset of attributes corresponding to the second subcombination of attributes in the target combination of attributes.

5 . The method of claim 4 :

further comprising:

generating a first manifest of assets during the first time interval based on a first subset of asset containers in the set of asset containers, the first manifest of assets comprising a first subset of assets, in the first set of assets, characterized by the first asset class, the first subset of assets comprising the first asset; and

generating a second manifest of assets during the first time interval based on a second subset of asset containers in the set of asset containers, the second manifest of assets comprising a second subset of assets, in the first set of assets, characterized by the second asset class, the second subset of assets comprising the second asset; and

wherein identifying the first asset group further comprises:

identifying a third subset of assets, in the first manifest of assets, exhibiting the first subcombination of attributes during the first time interval;

identifying a fourth subset of assets, in the second manifest of assets, exhibiting the second subcombination of attributes during the first time interval; and

identifying the first asset group comprising the first asset in response to:

identifying the third subset of assets comprising the first asset;

identifying the fourth subset of assets comprising the second asset; and

identifying the first association between the first asset and the second asset.

6 . The method of claim 4 :

further comprising generating a first database query comprising:

a first operation representing the first subcombination of attributes; and

a second operation representing the second combination of attributes; and

wherein identifying the first asset group further comprises identifying the first asset group in response to executing the first database query.

7 . The method of claim 1 , further comprising:

accessing a second set of objects, generated by the set of sources during a second time interval succeeding the first time interval, representing attributes of a second set of assets comprising the first asset and the second asset;

partitioning the second set of objects into a second set of object groups, each object group in the second set of object groups representing an asset in the second set of assets;

for each object group in the set of object groups, aggregating attributes represented in objects in the object group into an asset container, in the set of asset containers, representing an asset in the second set of assets;

accessing a third set of attributes, from the first asset container, exhibited by the first asset during the second time interval;

removing the first association between the first asset and the second asset based on the third set of attributes;

identifying a second asset group, excluding the first asset, exhibiting the target combination of attributes during the second time interval based on the third set of attributes excluding the target combination of attributes;

generating a second notification specifying the second asset group excluding the first asset; and

serving the second notification at an operator portal.

8 . The method of claim 7 :

wherein accessing the first set of attributes comprises accessing the first set of attributes exhibited by the first asset, the first asset comprising a first device, the first set of attributes comprising a first attribute representing a first set of applications installed on the first device, the first set of applications comprising the second asset, the second asset comprising a first application;

wherein identifying the first association comprises identifying the first association between the first asset and the second asset based on the first attribute;

wherein accessing the second set of attributes comprises accessing the second set of attributes exhibited by the second asset, the second set of attributes comprising a second attribute representing presence of a known vulnerability associated with the first application;

further comprising removing the first application from the first device in response to identifying the first asset group comprising the first asset;

wherein accessing the third set of attributes comprises accessing the third set of attributes comprising a third attribute representing a second set of applications installed on the first device, the second set of applications excluding the first application; and

wherein removing the first association comprises removing the first association between the first asset and the second asset in response to the second set of applications excluding the first application.

9 . The method of claim 1 , wherein aggregating attributes comprises:

aggregating a second subset of attributes, in the first set of attributes, into a first table in the first asset container, each attribute in the second subset of attributes exhibiting a string data type; and

aggregating a third subset of attributes, in the first set of attributes, into a second table in the first asset container, each attribute in the third subset of attributes exhibiting an integer data type.

10 . The method of claim 9 :

wherein defining the first attribute category comprises receiving a search query, from the operator portal, specifying the target combination of attributes;

further comprising generating a first database query comprising a first operation representing a first attribute, in the target combination of attributes, exhibiting the string data type; and

wherein identifying the first asset group further comprises identifying the first asset group comprising the first asset in response to executing the first database query on the first table.

11 . The method of claim 1 :

wherein accessing the first set of objects comprises accessing the first set of objects representing attributes of the first set of assets affiliated with a first organization exhibiting a first organization type; and

wherein defining the first attribute category comprises:

aggregating a corpus of search queries, received from a set of organizations exhibiting the first organization type, specifying combinations of attributes;

calculating a first quantity of search queries, in the corpus of search queries, specifying the target combination of attributes; and

defining the first attribute category exhibiting the target combination of attributes in response to the first quantity of search queries exceeding a first threshold quantity.

12 . The method of claim 11 , further comprising:

in response to the first quantity of search queries exceeding a first threshold, generating a recommended search query specifying the target combination of attributes;

generating a second notification specifying the recommended search query; and

serving the second notification to the operator portal.

13 . The method of claim 1 , further comprising:

defining a second attribute category exhibiting a second target combination of attributes;

identifying a set of actions to cause assets, in the first asset group, to exhibit the second target combination of attributes during a second time interval succeeding the first time interval;

generating a second notification specifying the set of actions; and

serving the second notification to the operator portal.

14 . The method of claim 13 :

wherein defining the first attribute category comprises defining the first attribute exhibiting the target combination of attributes comprising:

a first attribute representing a first application type; and

a second attribute representing presence of a known vulnerability;

wherein defining the second attribute category comprises defining the first attribute exhibiting the second target combination of attributes:

comprising the first attribute representing the first application type; and

excluding the second attribute representing presence of the known vulnerability; and

wherein identifying the set of actions comprises identifying the set of actions comprising:

removing the second asset, comprising a first application exhibiting the first application type and exhibiting the known vulnerability, from the first asset comprising a first device exhibiting the first application installed thereon; and

installing a third asset, in the set of assets, on the first device, the third asset comprising a second application exhibiting the first application type and excluding the known vulnerability.

15 . The method of claim 13 , further comprising:

assigning a first risk level to the first attribute category;

assigning a second risk level to the second attribute category, the second risk level falling below the first risk level;

calculating a first risk score to the first asset based on the first risk level assigned to the first attribute category;

autonomously executing the set of actions on the first asset;

identifying a second asset group exhibiting the second target combination of attributes during the second time interval, the second asset group comprising the first asset; and

calculating a second risk score to the first asset based on the second risk level assigned to the second attribute category.

16 . A non-transitory computer readable medium storing instructions that, when executed by a processor, cause the processor to:

access a first set of objects, generated by a set of sources during a first time interval, representing attributes of a first set of assets comprising a first asset and a second asset;

partition the first set of objects into a first set of object groups, each object group in the first set of object groups representing an asset in the first set of assets;

for each object group in the set of object groups, aggregate attributes represented in objects in the object group into an asset container, in a set of asset containers, representing an asset in the first set of assets;

access a first set of attributes, from a first asset container in the set of asset containers, exhibited by the first asset during the first time interval;

identify a first association between the first asset and the second asset based on the first set of attributes;

access a second set of attributes, from a second asset container in the set of asset containers, exhibited by the second asset during the first time interval;

based on the first association between the first asset and the second asset, associate the first asset with a first subset of attributes in the second set of attributes;

define a first attribute category exhibiting a target combination of attributes;

identify a first asset group, comprising the first asset group, exhibiting the target combination of attributes during the first time interval based on the target combination of attributes represented in:

the first set of attributes; and

the first subset of attributes, in the second set of attributes, associated with the first asset;

generate a first notification specifying the first asset group; and

serve the first notification at an operator portal.

17 . The non-transitory computer readable medium of claim 16 , wherein the non-transitory computer readable medium stores instructions that, when executed by the processor, cause the processor to:

assign a risk level to the first attribute category;

calculate a first risk score to the first asset based on:

the risk level assigned to the first attribute category; and

the target combination of attributes represented in the first set of attributes and the first subset of attributes, in the second set of attributes, associated with the first asset; and

generate the first notification further specifying the first risk score.

18 . The non-transitory computer readable medium of claim 17 , wherein the non-transitory computer readable medium stores instructions that, when executed by the processor, cause the processor to:

assign a first action to the first attribute category; and

in response to the first score exceeding a risk threshold, execute the first action, assigned to the first attribute category, on the first asset group.

19 . The non-transitory computer readable medium of claim 16 , wherein the non-transitory computer readable medium stores instructions that, when executed by the processor, cause the processor to:

define the first attribute category exhibiting the target combination of attributes comprising:

a first subcombination of attributes associated with assets characterized by the first asset class; and

a second subcombination of attributes associated with assets characterized by the second asset class; and

identify the first asset group comprising the first asset based on:

the first set of attributes, exhibited by the first asset characterized by the first asset class, comprising a first subset of attributes corresponding to the first subcombination of attributes in the target combination of attributes; and

the first subset of attributes, in the second set of attributes exhibited by the second asset characterized by the second asset class, comprising a second subset of attributes corresponding to the second subcombination of attributes in the target combination of attributes.

20 . A system comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions that, when executed by the processor, cause the processor to:

access a first set of objects, generated by a set of sources during a first time interval, representing attributes of a first set of assets comprising a first asset and a second asset;

partition the first set of objects into a first set of object groups, each object group in the first set of object groups representing an asset in the first set of assets;

for each object group in the set of object groups, aggregate attributes represented in objects in the object group into an asset container, in a set of asset containers, representing an asset in the first set of assets;

access a first set of attributes, from a first asset container in the set of asset containers, exhibited by the first asset during the first time interval;

identify a first association between the first asset and the second asset based on the first set of attributes;

access a second set of attributes, from a second asset container in the set of asset containers, exhibited by the second asset during the first time interval;

based on the first association between the first asset and the second asset, associate the first asset with a first subset of attributes in the second set of attributes;

define a first attribute category exhibiting a target combination of attributes;

identify a first asset group, comprising the first asset group, exhibiting the target combination of attributes during the first time interval based on the target combination of attributes represented in:

the first set of attributes; and

the first subset of attributes, in the second set of attributes, associated with the first asset;

generate a first notification specifying the first asset group; and

serve the first notification at an operator portal.