Granted Patent B2

US 12,671,695 · App. 18/798,283 · Granted Jun 30, 2026

Inventors: Jeffrey J. Guy (Austin, TX); Greg Fitzgerald (Austin, TX); Jeremiah Clark (Austin, TX); Dean Mekkawy (Austin, TX); Nevins Bartolomeo (Austin, TX); Jim LoRusso (Austin, TX); Nick Murdock (Austin, TX); Allen Saunders (Austin, TX); Jacob Hackett (Austin, TX)

Assignee: Arctic Wolf Networks, Inc.

H04L63/104G06F9/45558H04L41/0893H04L41/12H04L63/102G06F2009/45587G06F2009/45595

Abstract

Claims (101)

1 . A method comprising:

accessing a set of device containers for a set of sources comprising a first source and a second source, each device container in the set of device containers comprising characteristics representing a device in a set of devices affiliated with a computer network during a first time interval;

identifying a first subset of devices, in the set of devices, represented by the first source and the second source based on correspondence between characteristics contained in a first subset of device containers associated with the first source and the second source;

identifying a second subset of devices, in the set of devices, represented by the first source and excluded by the second source based on absence of correspondence between characteristics contained in a second subset of device containers associated with the first source and the second source;

in response to selection of the first source and the second source, generating a visualization representing:

a first area corresponding to the first source; and

a second area corresponding to the second source and partially intersecting the first area;

annotating a first intersection of the first area and the second area with a first representation of the first subset of devices;

annotating the first area, outside of the second area, with a second representation of the second subset of devices;

rendering the visualization within an operator portal; and

in response to selection of the first area outside of the second area, rendering a list of identifiers of the second subset of devices within the operator portal.

2 . The method of claim 1 , further comprising generating the set of device containers by, for each source in the set of sources:

accessing a set of objects generated by the source during the first time interval and representing characteristics of a subset of devices in the set of devices;

grouping the set of objects into a set of object groups, each object group in the set of object groups representing characteristics of a device in the subset of devices during the first time interval; and

for each object group in the set of object groups, aggregating characteristics represented in objects in the object group into a device container, in the set of device containers, associated with the source.

3 . The method of claim 2 , wherein accessing the set of objects comprises accessing the set of objects representing characteristics of the subset of devices configured with the source.

4 . The method of claim 1 , wherein identifying the first subset of devices comprises:

accessing a first device container associated with the first source;

accessing a second device container associated with the second source;

calculating a first correspondence score for the first device container and the second device container based on similarities of characteristics stored in the first device container and the second device container; and

in response to the first correspondence score exceeding a threshold correspondence score, identifying the first device container and the second device container as corresponding to a first device in the first subset of devices.

5 . The method of claim 4 , wherein identifying the first subset of devices comprises, in response to the first correspondence score exceeding the threshold correspondence score, compiling fixed identifying data and variable status data contained in the first device container and the second device container into a first representation of the first device.

6 . The method of claim 4 , wherein identifying the first subset of devices comprises, in response to the first correspondence score exceeding the threshold correspondence score:

extracting a first value from the first device container;

extracting a second value from the second device container;

compiling the first value and the second value into a normalized value of the first device; and

compiling the normalized value into a first representation of the first device.

7 . The method of claim 1 :

further comprising identifying a third subset of devices, in the set of devices, represented by the first source, the second source, and a third source in the set of sources based on correspondence between characteristics contained in a third subset of device containers associated with the first source, the second source, and the third source;

wherein generating the visualization comprises generating the visualization representing:

the first area corresponding to the first source;

the second area corresponding to the second source and partially intersecting the first area; and

a third area corresponding to the third source, partially intersecting the first area, partially intersecting the second area, and partially intersecting the first intersection; and

further comprising annotating a center intersection of the first area, the second area, and the third area with a third representation of the third subset of devices.

8 . The method of claim 7 , further comprising:

identifying a fourth subset of devices, in the set of devices, represented by the first source and excluded by the second source and the third source based on absence of correspondence between characteristics contained in a fourth subset of device containers associated with the first source, the second source, and the third source; and

annotating the first area, outside of the second area and the third area, with a fourth representation of the fourth subset of devices.

9 . The method of claim 7 , further comprising:

identifying a fourth subset of devices, in the set of devices, represented by the first source, represented by the second source, and excluded by the third source based on:

correspondence between characteristics contained in a fourth subset of device containers associated with the first source and the second source; and

absence of correspondence between characteristics contained in the fifth subset of device containers and device containers associated with the third source; and

annotating a second intersection of the first area and the second area, excluding the third area, with a fourth representation of the fourth subset of devices.

10 . The method of claim 1 :

wherein accessing the set of device containers comprises accessing the set of device containers, each device container in the set of device containers comprising fixed identifying data and variable status data representing the device;

wherein identifying the first subset of devices comprises identifying the first subset of devices based on correspondence between fixed identifying data and variable status data contained in the first subset of device containers; and

wherein identifying the second subset of devices comprises identifying the second subset of devices based on absence of correspondence between fixed identifying data and variable status data contained in the second subset of device containers.

11 . The method of claim 1 :

wherein identifying the first subset of devices comprises identifying the first subset of devices configured with the first source comprising a first security technology and the second source comprising a second security technology; and

wherein identifying the second subset of devices comprises identifying the second subset of devices configured with the first source and excluding the second source.

12 . The method of claim 1 :

wherein identifying the first subset of devices comprises identifying the first subset of devices configured with the first source and the second source;

wherein identifying the second subset of devices comprises identifying the second subset of devices configured with the first source and excluding the second source; and

further comprising generating a prompt to selectively investigate devices in the second subset of devices for absence of the second source.

13 . The method of claim 1 :

wherein annotating the first intersection of the first area and the second area with the first representation comprises annotating the first intersection of the first area and the second area with a first quantity of devices in the first subset of devices; and

wherein annotating the first area, outside of the second area, with the second representation comprises annotating the first area, outside of the second area, with a second quantity of devices in the second subset of devices.

14 . The method of claim 1 , further comprising:

extracting a first set of device identifiers for the first subset of devices from the first subset of device containers;

extracting a second set of device identifiers for the second subset of devices from the second subset of device containers; and

compiling the first set of device identifiers, the second set of device identifiers into a manifest of devices connected to the computer network during the first time interval.

15 . A method comprising:

generating a set of device containers for a set of sources comprising a first source and a second source, each device container in the set of device containers comprising identifying data representing a device in a set of devices affiliated with a computer network during a first time interval;

identifying a first subset of devices, in the set of devices, represented by the first source and the second source based on correspondence between identifying data contained in a first subset of device containers associated with the first source and the second source;

identifying a second subset of devices, in the set of devices, represented by the first source and excluded by the second source based on absence of correspondence between identifying data contained in a second subset of device containers associated with the first source and the second source;

in response to selection of the first source and the second source, generating a visualization representing:

a first area corresponding to the first source; and

a second area corresponding to the second source and partially intersecting the first area;

annotating a first intersection of the first area and the second area with a first representation of the first subset of devices;

annotating the first area, outside of the second area, with a second representation of the second subset of devices;

wherein generating the set of device containers comprises, for each source in the set of sources:

accessing a set of objects generated by the source during the first time interval and representing characteristics of a subset of devices in the set of devices;

grouping the set of objects into a set of object groups, each object group in the set of object groups representing characteristics of a device in the subset of devices during the first time interval; and

for each object group in the set of object groups, aggregating characteristics represented in objects in the object group into a device container, in the set of device containers, associated with the source and comprising identifying data and status data representing a device in the subset of devices.

16 . The method of claim 15 , further comprising:

accessing a first device container associated with the first source;

calculating a set of correspondence scores for the first device container and a target subset of device containers, in the set of device containers, associated with the second source based on similarities of identifying data stored in the first device container and the target subset of device containers; and

in response to the set of correspondence scores falling below a threshold correspondence score, identifying the first device container as corresponding to a first device, in the second subset of devices, represented by the first source and excluded by the second source.

17 . The method of claim 15 :

wherein identifying the first subset of devices comprises identifying the first subset of devices configured with the first source and the second source; and

wherein identifying the second subset of devices comprises identifying the second subset of devices configured with the first source and excluding the second source;

further comprising rendering the visualization within an operator portal; and

further comprising rendering a list of identifiers of the second subset of devices within the operator portal.

18 . A method comprising:

accessing a set of device containers for a set of sources comprising a first source and a second source, each device container in the set of device containers comprising characteristics representing a device in a set of devices affiliated with a computer network during a first time interval;

identifying a first subset of devices, in the set of devices, configured with the first source and the second source based on correspondence between characteristics contained in a first subset of device containers associated with the first source and the second source;

identifying a second subset of devices, in the set of devices, configured with the first source and excluding the second source based on absence of correspondence between characteristics contained in a second subset of device containers associated with the first source and the second source;

in response to selection of the first source and the second source, generating a visualization representing:

a first area corresponding to the first source; and

a second area corresponding to the second source and partially intersecting the first area;

annotating a first intersection of the first area and the second area with a first representation of the first subset of devices; and

annotating the first area, outside of the second area, with a second representation of the second subset of devices;

wherein accessing the set of device containers comprises accessing the set of device containers, each device container in the set of device containers comprising fixed identifying data and variable status data representing the device;

wherein identifying the first subset of devices comprises identifying the first subset of devices based on correspondence between fixed identifying data and variable status data contained in the first subset of device containers; and

wherein identifying the second subset of devices comprises identifying the second subset of devices based on absence of correspondence between fixed identifying data and variable status data contained in the second subset of device containers.

19 . The method of claim 18 , further comprising generating the set of device containers by, for each source in the set of sources:

accessing a set of objects generated by the source during the first time interval and representing characteristics of a subset of devices in the set of devices;

grouping the set of objects into a set of object groups, each object group in the set of object groups representing characteristics of a device in the subset of devices during the first time interval; and

for each object group in the set of object groups, aggregating characteristics represented in objects in the object group into a device container, in the set of device containers, associated with the source.

20 . The method of claim 18 :

wherein identifying the first subset of devices comprises identifying the first subset of devices configured with the first source comprising a first security technology and the second source comprising a second security technology; and

wherein identifying the second subset of devices comprises identifying the second subset of devices configured with the first source and excluding the second source.

Assignments (4)

Continuity (5)

References Cited (33)