Granted Patent B2

US 12,244,616 · App. 17/986,661 · Granted Mar 4, 2025

Inventors: Travis Nathan Sugarbaker (Seattle, WA); Srivatsa Shripathi Modambu (Karnataka, IN)

Assignee: Cisco Technology, Inc.

H04L63/1416H04L63/0236H04L63/105H04L63/1425H04L63/1433H04L63/20

Abstract

Claims (64)

1. A method, comprising:

exchanging, by a first asset, first data traffic during a time period;

determining a number of hosts that exchanged the first data traffic with the first asset during the time period;

determining a first security metric of the first asset based on the number of the hosts, the first security metric indicating a vulnerability to attack associated with the first asset;

determining a second security metric of a second asset comprising a nearest neighbor of the first asset, the nearest neighbor of the first asset being directly connected to the first asset in a network, and the second security metric indicating a vulnerability to attack associated with the second asset;

determining a third security metric indicating the vulnerability to attack associated with the first asset based on the first security metric and the second security metric, and based on the second security metric comprising a nearest neighbor of the first asset;

adjusting a security policy of the first asset based on the third security metric; and

exchanging, by the first asset, second data traffic based at least in part on the security policy.

2. The method of claim 1 , wherein determining the number of the hosts that exchanged the first data traffic with the first asset comprises:

identifying, based on network data, addresses of the hosts;

generating shortened addresses by extracting a subset of most significant digits of the addresses, the shortened addresses being shorter than the addresses; and

determining the number of the hosts based on a number of the shortened addresses.

3. The method of claim 1 , wherein the time period is greater than or equal to 7 days and less than or equal to 31 days.

4. The method of claim 1 , the hosts being first hosts, wherein the first asset comprises at least one of an application, a port, or a second host.

5. The method of claim 1 , wherein the nearest neighbor comprises a graph neighbor of the first asset.

6. The method of claim 1 , wherein determining the third security metric of the first asset comprises adding the first security metric and a product of the second security metric and a propagation factor associated with the second asset.

7. The method of claim 1 , wherein the nearest neighbor of the first asset is connected to the first asset without any intermediary nodes being disposed between the nearest neighbor of the first asset and the first asset in the network.

8. The method of claim 1 , wherein determining the second security metric of the second asset comprising the nearest neighbor of the first asset comprises determining the second security metric based on data traffic transmitted between the nearest neighbor of the first asset and the first asset.

9. The method of claim 1 , wherein the third security metric is a function of an exposure associated with the first asset and an exploitation risk associated with the first asset.

10. A system, comprising:

at least one processor; and

one or more non-transitory media storing instructions that, when executed by the system, cause the system to perform operations comprising:

determining a number of hosts that exchanged first data traffic with a first asset;

determining a first security metric of the first asset based on the number of the hosts, the first security metric indicating a vulnerability to attack associated with the first asset;

determining a second security metric of a second asset comprising a nearest neighbor of the first asset, the nearest neighbor of the first asset being directly connected to the first asset in a network, and the second security metric indicating a vulnerability to attack assoicated with the second asset;

determining a third security metric indicating the vulnerability to attack associated with the first asset based on the first security metric and the second security metric, and further based on the second security metric comprising a nearest neighbor of the first asset;

causing an external entity configured to adjust a security policy of the first asset based on the third security metric; and

causing the first asset to exchange second data traffic based at least in part on the security policy.

11. The system of claim 10 , wherein determining the number of the hosts that exchanged the first data traffic with the first asset comprises:

identifying addresses of the hosts;

generating shortened addresses by extracting a subset of most significant digits of the addresses, the shortened addresses being shorter than the addresses; and

determining the number of the hosts based on a number of the shortened addresses.

12. The system of claim 10 , wherein the nearest neighbor comprises a graph neighbor of the first asset.

13. The system of claim 10 , wherein determining the third security metric of the first asset comprises adding the first security metric and a product of the second security metric and a propagation factor associated with the second asset.

14. The system of claim 10 , wherein the security policy comprises a multi-factor authentication (MFA) interval or a firewall policy of the first asset.

15. The system of claim 10 , wherein:

the operations further comprise determining a number of locations of the hosts, and

determining the first security metric of the first asset is further based on the number of locations.

16. The system of claim 10 , wherein:

the operations further comprise determining a number of users of the hosts, and

determining the first security metric of the first asset is further based on the number of users.

17. A system, comprising:

at least one processor; and

one or more non-transitory media storing instructions that, when executed by the system, cause the system to perform operations comprising:

determining a number of hosts that exchanged first data traffic with a first asset;

generating a first security metric of the first asset based on the number of the hosts;

determining second security metrics of n second assets, the n second assets respectively comprising nearest neighbors of the first asset, n being a positive integer;

determining propagation factors of the n second assets based on the second security metrics;

determining a third security metric of the first asset based on a following equation:

S+Σ 1 n f prop ( n ),

wherein S is the first security metric and f prop (n) is a propagation factor contributed by an nth second asset;

causing an external entity configured to adjust a security policy of the first asset based on the third security metric; and

causing the first asset to exchange second data traffic based at least in part on the security policy.

18. The system of claim 17 , wherein determining the number of the hosts that exchanged first data traffic with the first asset comprises:

identifying Internet Protocol (IP) addresses of the hosts;

generating binary addresses by converting the IP addresses to a binary form;

generating shortened addresses that are a predetermined number of leftmost digits of the binary addresses; and

determining the number of the hosts by determining a number of the shortened addresses.

19. The system of claim 17 , wherein the nearest neighbors are directly adjacent to the first asset.

20. The system of claim 17 , wherein:

the operations further comprise:

determining a number of locations of the hosts; and

determining a number of users of the hosts, and

generating the first security metric is further based on the number of locations and the number of users.

Assignments (1)

Priority Claims (1)

Continuity (2)

References Cited (33)