Computer-based systems configured for network characterization and management based on automated key terrain identification and methods of use thereof
A method includes scanning a network having a first and second host, obtaining, via the scanning, a first and second type information of the first and second host, respectively, the first or second type information including a device category the first or second host belongs to, obtaining, via the scanning, a first and second scaling factor of the first and second host, respectively, calculating, a first criticality score of the first host based on the first type information and the first scaling factor, calculating a second criticality score of the second host based on the second type information and the second scaling factor, and facilitating to apply a security patch on the first host prior to the second host when the first criticality score is higher than the second criticality score.
1. A computer-implemented method comprising:
scanning, by a computing device, a network having at least a first and second host;
obtaining, by the computing device via the scanning, a first type information of the first host, and second type information of the second host, the first type information comprising a first device category associated with the first host, the second type information comprising a second device category associated with the second host, wherein the first or second type information comprise a criticality range with a minimum and maximum value for each device category;
obtaining, by the computing device via the scanning, a first scaling factor of the first host, and a second scaling factor of the second host, wherein the first scaling factor or the second scaling factor is determined based on one or more of a plurality of component-specific scaling functions, comprising:
a first component-specific scaling function associated with a number of services running on the respective host,
a second component-specific scaling function associated with a functionality of the respective host, and
a third component-specific scaling function associated with a use case of the respective host;
calculating, by the computing device, a first criticality score of the first host based on the first type information and the first scaling factor, wherein the first criticality score is a product of multiplying the first type information and the first scaling factor;
calculating, by the computing device, a second criticality score of the second host based on the second type information and the second scaling factor, wherein the second criticality score is a product of multiplying the second type information and the second scaling factor; and
facilitating, by the computing device, to apply a security patch on the first host prior to the second host when the first criticality score is higher than the second criticality score.
2. The method of claim 1 , wherein the first or second device category is one of workstation, router, server, printer, camera or a combination thereof.
3. The method of claim 1 , wherein the minimum value for the device category of the first or second host is determined by a machine learning model.
4. The method of claim 1 , wherein calculating the first or second criticality score comprises using, as a multiplication factor, the minimum value for the device category of the first or second type information.
5. The method of claim 1 , wherein the functionality of the first or second host is identified based on a network map.
6. The method of claim 1 , wherein the functionality of the first or second host is inferred by network traffic and interactions.
7. The method of claim 1 , wherein the use case of the first or second host is determined by a location of the respective host.
8. The method of claim 1 , wherein the network scanning and calculating the criticality scores are conducted repeatedly at a predetermined frequency.
9. A computer-implemented method comprising:
scanning, by a computing device, a network having at least a first and second host;
obtaining, by the computing device via the scanning, a first type information of the first host, and second type information of the second host, the first type information comprising a first device category associated with the first host, the second type information comprising a second device category associated with the second host, wherein the first or second type information comprise a criticality range with a minimum and maximum value for each device category;
obtaining, by the computing device via the scanning, a first scaling factor of the first host, and a second scaling factor of the second host, wherein the first scaling factor or the second scaling factor is determined based on one or more of a plurality of component-specific scaling functions, comprising:
a first component-specific scaling function associated with a number of services running on the respective host,
a second component-specific scaling function associated with a functionality of the respective host, and
a third component-specific scaling function associated with a use case of the respective host;
calculating, by the computing device, a first criticality score of the first host by multiplying the first type information and the first scaling factor, wherein the first criticality score is a product of multiplying the first type information and the first scaling factor;
calculating, by the computing device, a second criticality score of the second host by multiplying the second type information and the second scaling factor, wherein the second criticality score is a product of multiplying the second type information and the second scaling factor; and
facilitating, by the computing device, to apply a security patch on the first host prior to the second host when the first criticality score is higher than the second criticality score.
10. The method of claim 9 , wherein the first or second device category is one of workstation, router, server, printer, camera or a combination thereof.
11. The method of claim 9 , wherein the minimum value for the device category of the first or second host is determined by a machine learning model.
12. The method of claim 9 , wherein calculating the first or second criticality score comprises using, as a multiplication factor, the minimum value for the device category of the first or second type information.
13. The method of claim 9 , wherein the functionality of the first or second host is identified based on a network map.
14. The method of claim 9 , wherein the functionality of the first or second host is inferred by network traffic and interactions.
15. The method of claim 9 , wherein the use case of the first or second host is determined by a location of the first or second host.
16. The method of claim 9 , wherein the network scanning and calculating the criticality scores are conducted repeatedly at a predetermined frequency.
17. A system, comprising:
one or more processors; and
a memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, cause the one or more processors to:
scan a network having at least a first and second host;
obtain, via the scanning, a first type information of the first host, and second type information of the second host, the first type information comprising a first device category associated with the first host, the second type information comprising a second device category associated with the second host, wherein the first or second type information comprise a criticality range with a minimum and maximum value for each device category;
obtain, via the scanning, a first and second scaling factor of the first and second host, respectively, wherein the first scaling factor or the second scaling factor is determined based on one or more of a plurality of component-specific scaling functions, comprising:
a first component-specific scaling function associated with a number of services running on the respective host,
a second component-specific scaling function associated with a functionality of the respective host, and
a third component-specific scaling function associated with a use case of the respective host;
calculate a first criticality score of the first host based the first type information and the first scaling factor, wherein the first criticality score is a product of multiplying the first type information;
calculate a second criticality score of the second host based on the second type information and the second scaling factor, wherein the second criticality score is a product of multiplying the second type information and the second scaling factor; and
facilitate to apply a security patch on the first host prior to the second host when the first criticality score is higher than the second criticality score.
18. The system of claim 17 , wherein the first or second device category is one of workstation, router, server, printer, camera or a combination thereof.
19. The system of claim 17 , wherein calculating the first or second criticality score comprises using, as a multiplication factor, the minimum value for the device category of the first or second type information.
20. The system of claim 17 , wherein the functionality of the first or second host is identified based on a network map.
21. The system of claim 17 , wherein the functionality of the first or second host is inferred by network traffic and interactions.
22. The system of claim 17 , wherein the use case of the first or second host is determined by a location of the respective host.
23. A system, comprising:
one or more processors; and
a memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, cause the one or more processors to:
scan a network having at least a first and second host;
obtain, via the scanning, a first type information of the first host, and second type information of the second host, the first type information comprising a first device category associated with the first host, the second type information comprising a second device category associated with the second host, wherein the first or second type information comprise a criticality range with a minimum and maximum value for each device category;
obtain, via the scanning, a first scaling factor of the first host, and a second scaling factor of the second host, wherein the first scaling factor or the second scaling factor is determined based on one or more of a plurality of component-specific scaling functions, comprising:
a first component-specific scaling function associated with a number of services running on the respective host,
a second component-specific scaling function associated with a functionality of the respective host, and
a third component-specific scaling function associated with a use case of the respective host;
calculate a first criticality score of the first host by multiplying the first type information and the first scaling factor;
calculate a second criticality score of the second host by multiplying the second type information and the second scaling factor; and
facilitate to apply a security patch on the first host prior to the second host when the first criticality score is higher than the second criticality score.
24. The system of claim 23 , wherein the first or second device category is one of workstation, router, server, printer, camera or a combination thereof.
25. The system of claim 23 , wherein the calculating the first or second criticality score comprises using, as a multiplication factor, the minimum value for the device category of the first or second type information.