Systems and methods for improving a security profile of an entity based on peer security profiles

• US 10,764,298 B1
• Filed: 02/26/2020
• Issued: 09/01/2020
• Est. Priority Date: 02/26/2020
• Status: Active Grant

• Current Assignee: BitSight Technologies, Inc.
• Original Assignee: BitSight Technologies, Inc.
• Inventors: Light, Marc Noel, Lin, Liwei, Montroy, Thomas Erhardt, Pinto, Miguel
• Primary Examiner(s): Won, Michael
• Application Number:
  US16/802,232
• Time in Patent Office: 188 Days
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer-implemented method is provided for comparing the security profile of a particular entity to peer entities. The method can include receiving, for a particular entity, (i) a value for at least one feature and (ii) a number of security records of one or more security risk types. The method can include determining peer entities based on the value of the features; obtaining, for each peer entity, a number of security records; and adjusting the number of peer security records based on the number of entity security records. The method can further include comparing, for one or more security risk types, the received number of security records for the particular entity to the respective adjusted number of security records for each peer entity; and comparing a security profile of the particular entity to security profiles of the population of peer entities based on the comparison for the security risk types.

Claims

1. A computer-implemented method comprising:

receiving, for a particular entity, (i) a value for at least one feature of the entity and (ii) a number of security records for the entity, each security record being of a security risk type;

determining a population of peer entities based on the value of the at least one feature;

obtaining, for each peer entity, a number of security records;

adjusting the number of peer security records based on the number of entity security records;

comparing, for at least one security risk type, the received number of security records for the particular entity to the respective adjusted number of security records for each peer entity;

comparing a security profile of the particular entity to security profiles of the population of peer entities based on the comparison for the at least one security risk type; and

presenting the comparison of the security profiles in a user interface.

2. The method of claim 1, further comprising:

determining an impact of each security risk type on an entity security profile; and

presenting at least one security risk type based on the determined impact.

3. The method of claim 2, wherein presenting the at least one security risk type based on the determined impact comprises:

determining a rank of each security risk type for improving the entity security profile; and

presenting a ranking of at least two security risk types based on the determined rank of each security risk type.

4. The method of claim 2, wherein determining the impact of each security risk type on the entity security profile comprises:

determining a temporal decay for the security risk type; and

adjusting the impact of the security risk type based on the temporal decay.

5. The method of claim 1, wherein determining the population of peer entities based on the value of the at least one feature comprises:

determining the population of peer entities based on a value of a weighted combination of at least two features.

6. The method of claim 1, wherein the at least one feature comprises:

an industry of an entity;

a security rating of an entity;

a software platform utilized by an entity;

a geographical location of an entity;

or

a size of an entity.

7. The method of claim 6, wherein the industry of an entity comprises at least one of:

an industry name or a sector name.

8. The method of claim 6, wherein the geographical location of an entity is based on at least one of:

a physical location or an Internet Protocol (IP) address.

9. The method of claim 6, wherein the software platform utilized by an entity is for least one of:

a server system of the entity, a user base of the entity, or a web site of the entity.

10. The method of claim 6, wherein the size of an entity is based on at least one of:

a number of employees of the entity or a number of services provided by the entity.

11. The method of claim 1, wherein the population of peer entities comprises at least 100 peer entities.

12. A system comprising:

one or more computer systems programmed to perform operations comprising;

receiving, for a particular entity, (i) a value for at least one feature of the entity and (ii) a number of security records for the entity, each security record being of a security risk type;

determining a population of peer entities based on the value of the at least one feature;

obtaining, for each peer entity, a number of security records;

adjusting the number of peer security records based on the number of entity security records;

comparing, for at least one security risk type, the received number of security records for the particular entity to the respective adjusted number of security records for each peer entity;

comparing a security profile of the particular entity to security profiles of the population of peer entities based on the comparison for the at least one security risk type; and

presenting the comparison of the security profiles in a user interface.

13. The system of claim 12, wherein the operations further comprise:

determining an impact of each security risk type on an entity security profile; and

presenting at least one security risk type based on the determined impact.

14. The system of claim 13, wherein presenting the at least one security risk type based on the determined impact comprises:

determining a rank of each security risk type for improving the entity security profile; and

presenting a ranking of at least two security risk types based on the determined rank of each security risk type.

15. The system of claim 13, wherein determining the impact of each security risk type on the entity security profile comprises:

determining a temporal decay for the security risk type; and

adjusting the impact of the security risk type based on the temporal decay.

16. The system of claim 12, wherein determining the population of peer entities based on the value of the at least one feature comprises:

determining the population of peer entities based on a value of a weighted combination of at least two features.

17. The system of claim 12, wherein the at least one feature comprises:

an industry of an entity;

a security rating of an entity;

a software platform utilized by an entity;

a geographical location of an entity;

or

a size of an entity.

18. The system of claim 17, wherein the industry of an entity comprises at least one of:

an industry name or a sector name.

19. The system of claim 17, wherein the geographical location of an entity is based on at least one of:

a physical location or an Internet Protocol (IP) address.

20. The system of claim 17, wherein the software platform utilized by an entity is for least one of:

a server system of the entity, a user base of the entity, or a web site of the entity.

21. The system of claim 17, wherein the size of an entity is based on at least one of:

a number of employees of the entity or a number of services provided by the entity.

22. The system of claim 12, wherein the population of peer entities comprises at least 100 peer entities.