Resource classification using resource requests

• US 10,122,722 B2
• Filed: 06/20/2013
• Issued: 11/06/2018
• Est. Priority Date: 06/20/2013
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Manadhata, Pratyusa Kumar, Rao, Prasad V, Home, William G
• Primary Examiner(s): Lesniewski, Victor
• Application Number:
  US14/899,640
• Publication Number:
  US 20160142432A1
• Time in Patent Office: 1,965 Days
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

In one implementation, a resource classification system identifies a plurality of resource requests and generates a plurality of resource access measures based on the plurality of resource requests. Each resource request from the plurality of resource requests is associated with a resource from a plurality of resources by a resource identifier of that resource. Each resource access measure from the plurality of resource access measures is associated with a resource from the plurality of resources. The resource classification system applies a classifier to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure, and assign a security classification to each resource from the plurality of resources based on the classification result for that resource.

Claims

1. A processor-readable medium storing code representing instructions that when executed by a processor cause the processor to:

identify a plurality of resource requests, each resource request from the plurality of resource requests associated with a resource from a plurality of resources by a resource identifier of that resource;

determine whether a plurality of resource access measures were previously generated for the plurality of resource requests;

update the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures;

generate the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource requests, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure from the plurality of resource access measures is associated with the resource from the plurality of resources, and each resource access measure is a value that describes an average number of resource requests associated with the plurality of resource requests;

apply the classifier for the resource access measures to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure; and

assign a security classification to each resource from the plurality of resources based on the classification result for that resource.

2. The processor-readable medium of claim 1, wherein the plurality of resource requests include Domain Name System requests and Hypertext Transfer Protocol requests.

3. The processor-readable medium of claim 1, wherein

the plurality of resource requests is a first plurality of resource requests,

the plurality of resource access measures is generated at a first time, and

the security classification assigned to each resource from the plurality of resources is a first security classification assigned to that resource before a second time,

the processor-readable medium further storing code representing instructions that when executed at the processor cause the processor to:

update, at the second time after the first time, the plurality of resource access measures based on a second plurality of resource requests and not based on the first plurality of resource requests;

apply, after the second time, the classifier for the resource access measures to each resource access measure from the plurality of resource access measures; and

assign a second security classification to each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures, after the second time, to the resource access measure from the plurality of resource access measures associated with that resource.

4. The processor-readable medium of claim 1, wherein

the plurality of resource requests is a first plurality of resource requests,

the plurality of resource access measures is generated at a first time, and

the security classification assigned to each resource from the plurality of resources is a first security classification assigned to that resource before a second time,

the processor-readable medium further storing code representing instructions that when executed at the processor cause the processor to:

update, at the second time after the first time, the plurality of resource access measures based on a second plurality of resource requests and not based on the first plurality of resource requests;

modify the classifier for the resource access measures using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications;

apply, after the second time, the classifier for the resource access measures to each resource access measure from the plurality of resource access measures; and

assign a second security classification to each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures, after the second time, to the resource access measure from the plurality of resource access measures associated with that resource.

5. The processor-readable medium of claim 1, wherein the code representing instructions that when executed at the processor cause the processor to generate the plurality of resource access measures includes code representing instructions that when executed at the processor cause the processor to:

determine a sub-resource access measure for that resource from the plurality of resource requests.

6. The processor-readable medium of claim 1, wherein the code representing instructions that when executed at the processor cause the processor to generate the plurality of resource access measures includes code representing instructions that when executed at the processor cause the processor to:

determine a host access measure for that resource, a group access measure for that resource, a sub-resource access measure for that resource, or a combination thereof from the plurality of resource requests.

7. A resource classification method, comprising:

accessing a plurality of resource request records representing resource requests for a plurality of resources, each resource request record from the plurality of resource request records associated with a resource from the plurality of resources by a resource identifier of that resource;

determining whether a plurality of resource access measures were previously generated for the plurality of resource request records;

updating the plurality of resource access measures based on the plurality of resource request records responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures;

generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource request records, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure is a value that describes a ratio of a number of the resource request records associated with the plurality of resource request records;

applying the classifier for the resource access measures to the plurality of resource access measures for each resource from the plurality of resources; and

assigning a security classification to the plurality of resources for each resource from the plurality of resources based on a classification result from application of the classifier for the resource access measures to the plurality of resource access measures associated with that resource.

8. The method of claim 7, wherein:

the plurality of resource request records include Domain Name System request records and Hypertext Transfer Protocol request records.

9. The method of claim 7, wherein generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources includes determining a sub-resource access measure for that resource.

10. The method of claim 7, wherein generating the plurality of resource access measures from the resource request records for each resource from the plurality of resources includes determining a host access measure for that resource, a group access measure for that resource, a sub-resource access measure for that resource, or a combination thereof from the plurality of resource request records.

11. The method of claim 7, further comprising:

modifying the classifier for the resource access measures, using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications.

12. A resource classification system comprising:

a hardware processor to identify a plurality of resource requests, each resource request from the plurality of resource requests associated with a resource from a plurality of resources by a resource identifier of that resource;

the hardware processor to determine whether a plurality of resource access measures were previously generated for the plurality of resource requests;

the hardware processor to update the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were previously generated, wherein a classifier for the previously generated plurality of resource access measures is modified and utilized as the classifier for the resource access measures;

a resource access measurement hardware processor to generate the plurality of resource access measures based on the plurality of resource requests responsive to the determination that the plurality of resource access measures were not previously generated for the plurality of resource requests, and define a new classifier from the plurality of generated resource access measures to be utilized as the classifier for the resource access measures, wherein each resource access measure from the plurality of resource access measures is associated with the resource from the plurality of resources;

a classifier hardware processor to define the classifier for the resource access measures using resource access measures from the plurality of resource access measures associated with resources from the plurality of resources having known security classifications, and to apply the classifier for the resource access measures to each resource access measure from the plurality of resource access measures to generate a classification result for the resource from the plurality of resources associated with that resource access measure, wherein each resource access measure is a value that describes a number of unique clients that have requested access to the resource; and

a security hardware processor to assign a security classification to each resource from the plurality of resources based on the classification result for that resource.

13. The system of claim 12, further comprising:

a resource request processor to receive the plurality of resource request records associated with the plurality of resource requests from a plurality of resource authorities.

14. The system of claim 12, wherein:

the plurality of resource requests is a first plurality of resource requests;

the plurality of resource access measures is a first plurality of resource access measures generated at the resource access measurement processor a first time;

the resource access measurement processor is configured to update at a second time a second plurality of resource access measures based on a second plurality of resource requests, each resource access measure from the second plurality of resource access measures associated with the resource from the plurality of resources; and

the classifier hardware processor is configured to update the classifier for the resource access measures using resource access measures from the second plurality of resource access measures associated with the resources from the plurality of resources having known security classifications.

15. The system of claim 12, wherein:

the resource access measurement processor is configured to determine from the plurality of resource requests at least one of a host access measure for each resource from the plurality of resources, a group access measure each resource from the plurality of resources, or a sub-resource access measure for each resource from the plurality of resources to generate the plurality of resource access measures.