Systems and methods for assessing cybersecurity state of entities based on computer network characterization

• US 10,791,140 B1
• Filed: 01/29/2020
• Issued: 09/29/2020
• Est. Priority Date: 01/29/2020
• Status: Active Grant

• Current Assignee: BitSight Technologies, Inc.
• Original Assignee: BitSight Technologies, Inc.
• Inventors: Dahlberg, Daniel, Allshouse, Austin Payne
• Primary Examiner(s): Avery, Jeremiah L
• Application Number:
  US16/775,840
• Time in Patent Office: 244 Days
• Field of Search: None
• CPC Class Codes: G06F 40/279 Recognition of textual entities
• CPC Class Codes: G06F 40/295 Named entity recognition
• CPC Class Codes: G06F 40/40 Processing or translation of natural language natural language analysis G06F40/20; semantic analysis G06F40/30
• CPC Class Codes: H04L 12/28 characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks] wireless communication networks H04W ; arrangements for dividing the transmission path H04W40/00
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Computer-implemented methods are provided for assessing the cybersecurity state of entities based on computer network characterization. The exemplary method can include obtaining, for one or more computer networks of a plurality of computer networks associated with an entity, a network dataset including a service set identifier (SSID); and obtaining a plurality of Internet Protocol (IP) addresses associated with the entity. The method can further include determining whether each of the plurality of computer networks includes a public network or a private network based on the network dataset; and assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses attributed to the private network, excluding security characteristics of the IP addresses attributed to the public network.

Claims

1. A computer-implemented method comprising:

obtaining, for at least one computer network of a plurality of computer networks associated with an entity, a network dataset comprising a service set identifier (SSID);

obtaining a plurality of Internet Protocol (IP) addresses associated with the entity;

determining whether each of the plurality of computer networks comprises a public network or a private network based on the network dataset; and

assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses attributed to the private network, excluding security characteristics of the IP addresses attributed to the public network.

2. The method of claim 1, wherein determining whether each of the computer networks comprises a public network or a private network based on the network dataset comprises:

determining whether the SSID includes a term comprising at least one of;

“

guest”

, “

public”

, “

visit”

, “

byod”

, “

free”

, “

customer”

, or “

personal”

, wherein the term is in a natural language.

3. The method of claim 1, further comprising:

obtaining, for at least one computer network of the plurality of computer networks of the entity, a plurality of network datasets including the network dataset, wherein each network dataset comprises an SSID and is from a unique time,

wherein the determining whether each of the computer networks comprises a public network or a private network based on the network dataset is performed for at least two network datasets of the plurality of network datasets.

4. The method of claim 3, wherein the time corresponds to a day and wherein the determining whether each of the computer networks comprises a public network or a private network based on the network dataset is performed for at least three network datasets of the plurality of network datasets.

5. The method of claim 1, further comprising:

obtaining one or more SSIDs of common public networks; and

blacklisting the SSIDs of the common public networks such that at least one IP address is not attributed to one or more of the common public networks.

6. The method of claim 1, further comprising:

obtaining, for each device of a plurality of devices, a device dataset comprising at least one of;

(a) cookies, (b) device fingerprints, or (c) a device identifier; and

determining whether each of the computer networks comprises a public network or a private network based on at least one device dataset.

7. The method of claim 6, wherein determining whether each of the computer networks comprises a public network or a private network based on at least one device dataset comprises:

determining whether the at least one device has connected to at least one computer network of the plurality of computer networks.

8. The method of claim 7, wherein, if the device has connected to the at least one computer network, the determining whether each of the computer networks comprises a public network or a private network based on at least one device dataset comprises:

determining a connection duration and/or connection frequency of the device connected to the at least one computer network in a given time period.

9. The method of claim 7, further comprising:

comparing (i) a first number of devices of the plurality of devices that has connected to the at least one computer network to (ii) a second number of devices typically associated with the at least one computer network; and

determining that the at least one computer network comprises a public network if the first number is greater than the second number.

10. The method of claim 6, wherein the determining whether each of the computer networks comprises a public network or a private network based on the at least one device dataset comprises:

for a given network of the plurality of computer networks, determining that the given computer network is a public network based on a connection record of the device, the connection record indicating whether the device previously connected to a different computer network (i) for a longer duration than connecting to the given computer network and/or (ii) more frequently than connecting to the given computer network.

11. The method of claim 1, further comprising:

obtaining, for each user of a plurality of users, an email dataset comprising at least one of;

(i) an indication that the user opened or read an email from an email service provider and network information associated with a client with which the user opened or read the email, or

(ii) a user identifier comprising at least one of a user email address or web account information; and

determining whether each of the computer networks comprises a public network or a private network based on at least one email dataset.

12. The method of claim 11, wherein the network information indicates a first computer network in which the client was used to open or read the email, the method further comprising:

comparing (i) the first computer network to (ii) at least a second computer network to which the user belongs; and

if the first computer network is not the second computer network, determining that the computer network is a public network.

13. The method of claim 11, wherein the user identifier indicates a first computer network, the method further comprising:

comparing (i) the first computer network to (ii) at least a second computer network to which the user belongs; and

if the first computer network is not the second computer network, determining that the computer network is a public network.

14. The method of claim 1, wherein determining whether each of the plurality of computer networks comprises a public network or a private network based on the network dataset further comprises:

providing at least a portion of the network dataset as input to a trained classifier to determine whether the network is a public network or a private network.

15. A computer-implemented method comprising:

obtaining, for each device of a plurality of devices, a device dataset comprising at least one of;

(a) cookies, (b) device fingerprints, or (c) a device identifier;

obtaining a plurality of Internet Protocol (IP) addresses associated with the entity;

determining, for a plurality of computer networks associated with the entity, whether each of the computer networks comprises a public network or a private network based on the device datasets; and

assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses attributed to the private network, excluding security characteristics of the IP addresses attributed to the public network.

16. The method of claim 15, wherein determining whether each of the computer networks comprises a public network or a private network based on the device datasets comprises:

determining whether the device of the plurality of devices has connected to the computer network based on the device datasets.

17. The method of claim 16, wherein, if the device has connected to the at least one computer network, the determining whether each of the computer networks comprises a public network or a private network based on the device datasets comprises:

determining a connection duration and/or connection frequency of the device connecting to the computer network in a given time period.

18. The method of claim 16, further comprising:

comparing (i) a first number of devices of the plurality of devices that has connected to the computer network to (ii) a second number of devices typically associated with the computer network; and

determining that the computer network comprises a public network if the first number is greater than the second number.

19. The method of claim 15, further comprising:

obtaining, for at least one computer network of an entity, a network dataset comprising at least one service set identifier (SSID); and

determining whether each of the computer networks comprises a public network or a private network based on the network dataset.

20. The method of claim 19, wherein determining whether each of the computer networks comprises a public network or a private network based on the at least one SSID comprises:

determining whether the SSID includes a term comprising at least one of;

“

guest”

, “

public”

, “

visit”

, “

byod”

, “

free”

, “

customer”

, or “

personal”

, wherein the term is in a natural language.

21. The method of claim 15, wherein the determining whether each of the computer networks comprises a public network or a private network based on the device datasets comprises:

for a given network of the plurality of computer networks, determining that the given computer network is a public network based on a connection record of the device, the connection record indicating whether the device previously connected to a different computer network (i) for a longer duration than connecting to the given computer network and/or (ii) more frequently than connecting to the given computer network.

22. A computer-implemented method comprising:

obtaining, for each user of a plurality of users, an email dataset comprising at least one of;

(i) an indication that the user opened or read an email from an email service provider and network information associated with a client with which the user opened or read the email, or

(ii) a user identifier comprising at least one of a user email address or web account information;

obtaining a plurality of Internet Protocol (IP) addresses associated with the entity;

determining, for a plurality of computer networks associated with the entity, whether each computer network comprises a public network or a private network based on the email datasets; and

assessing a cybersecurity state of the entity based on an evaluation of security characteristics of the IP addresses attributed to the private network, excluding security characteristics of the IP addresses attributed to the public network.

23. The method of claim 22, further comprising:

obtaining, for at least one of a plurality of computer networks associated with an entity, a network dataset comprising at least one service set identifier (SSID); and

determining whether each of the computer networks comprises a public network or a private network based on the network dataset.

24. The method of claim 23, wherein determining whether each of the computer networks comprises a public network or a private network based on the network dataset comprises:

determining whether the SSID includes a term comprising at least one of;

“

guest”

, “

public”

, “

visit”

, “

byod”

, “

free”

, “

customer”

, or “

personal”

, wherein the term is in a natural language.

25. The method of claim 22, wherein the user identifier indicates a first computer network, the method further comprising:

comparing (i) the first computer network to (ii) at least a second computer network to which the user belongs; and

if the first computer network is not the second computer network, determining that the computer network is a public network.

26. The method of claim 22, wherein the network information indicates a first computer network in which the client was used to open or read the email, the method further comprising:

comparing (i) the first computer network to (ii) at least a second computer network to which the user belongs; and

if the first computer network is not the second computer network, determining that the at least one computer network comprises a public network.

27. The method of claim 22, further comprising:

obtaining, for each device of a plurality of devices, a device dataset comprising at least one of;

(a) cookies, (b) device fingerprints, or (c) a device identifier; and

determining whether each of the computer networks comprises a public network or a private network based on at least one device dataset.

28. The method of claim 27, wherein the determining whether each of the computer networks comprises a public network or a private network based on the at least one device dataset comprises:

for a given network of the plurality of computer networks, determining that the given computer network is a public network based on a connection record of the device, the connection record indicating whether the device previously connected to a different computer network (i) for a longer duration than connecting to the given computer network and/or (ii) more frequently than connecting to the given computer network.