SYSTEM AND METHOD OF IDENTIFYING INTERNET-FACING ASSETS

• US 20160112284A1
• Filed: 10/21/2014
• Published: 04/21/2016
• Est. Priority Date: 10/21/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: RiskIQ, Inc. (Microsoft Corporation)
• Inventors: Kiernan, Chris, Pon, David K., Manousos, Elias, Adams, Ben, Chiu, Megan, Edgeworth, Jonas
• Granted Patent: US 10,171,318 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method includes receiving a seed at a computing device. The method further includes identifying, based on first domain name system (DNS) data, first border gateway protocol (BGP) data, first whois data, or a combination thereof, a plurality of first internet-facing assets related to the seed. The method further includes identifying, based on second DNS data, second BGP data, second whois data, or a combination thereof, a plurality of second internet-facing assets related to at least one of the first internet-facing assets. The method further includes generating a graphical user interface (GUI) that includes a list of internet-facing assets related to the seed, where the list includes the plurality of first internet-facing assets and the plurality of second internet-facing assets.

Claims

1. A method comprising:

receiving a seed at a computing device, wherein the seed identifies a domain name system (DNS) name server, a whois contact, an autonomous system number (ASN), a domain name, or a combination thereof;

identifying, based on first DNS data retrieved from a DNS database based on the seed, first border gateway protocol (BGP) data retrieved from a BGP database based on the seed, first whois data retrieved from a whois database based on the seed, or a combination thereof, a plurality of first internet-facing assets related to the seed;

identifying, based on second DNS data retrieved from the DNS database based on at least one of the plurality of first internet-facing assets, second BGP data retrieved from the BGP database based on the at least one first internet-facing asset, second whois data retrieved from the whois database based on the at least one first internet-facing asset, or a combination thereof, a plurality of second internet-facing assets related to the at least one first internet-facing asset; and

generating a graphical user interface (GUI) that includes a list of internet-facing assets related to the seed, wherein the list includes the plurality of first internet-facing assets and the plurality of second internet-facing assets.

2. The method of claim 1, wherein the seed is generated by a discovery application executing at the computing device during identification of internet-facing assets related to a previously received seed, and wherein the seed is received by the discovery application via an iterative feedback process.

3. The method of claim 1, wherein the seed is associated with a particular user or business entity, and wherein the internet-facing assets of the list are indicated as being owned by or affiliated with the particular user or business entity.

4. The method of claim 1, further comprising identifying a DNS name server associated with a particular internet-facing asset and identifying domains for which the DNS name server is an authoritative name server.

5. The method of claim 1, wherein the seed is associated with information including an e-mail address, a physical address, a contact name, or a combination thereof, and wherein identifying the plurality of first internet-facing assets includes searching a database based on the information.

6. The method of claim 1, wherein identifying the plurality of second internet-facing assets includes identifying DNS name servers associated with the plurality of first internet-facing assets.

7. The method of claim 6, further comprising identifying additional internet-facing assets associated with the DNS name servers.

8. The method of claim 7, further comprising identifying hosts associated with the additional internet-facing assets.

9. The method of claim 7, wherein identifying the plurality of second internet-facing assets further includes identifying at least one internet-facing asset based on a canonical name (CNAME) record.

10. The method of claim 1, wherein the GUI is configured to receive user input indicating that a particular internet-facing asset is to be added to a scanning list, wherein internet-facing assets in the scanning list are scanned continuously, periodically, randomly, in response to user input, or any combination thereof.

11. The method of claim 10, further comprising scanning the particular internet-facing asset to gather additional information regarding the particular internet-facing asset.

12. The method of claim 11, wherein the additional information indicates a language that the particular internet-facing asset is associated with, whether particular the internet-facing asset performs redirects, whether the particular internet-facing asset supports secure sockets layer (SSL), whether a SSL certificate associated with the particular internet-facing asset is valid, how many media files are associated with the particular internet-facing asset, whether the particular internet-facing asset is associated with malware, or a combination thereof.

13. The method of claim 11, further comprising generating an alert in response to determining, based on scanning the particular internet-facing asset, that the particular internet-facing asset violates a policy.

14. The method of claim 11, wherein the scanning is performed based on one or more proxy servers to simulate requests from different geographic regions, different domains, different user agents, or a combination thereof.

15. The method of claim 1, wherein the GUI is configured to receive user input dismissing a particular internet-facing asset, and further comprising refraining from including the dismissed internet-facing asset from a subsequently generated list of internet-facing assets.

16. The method of claim 13, further comprising initiating a mitigation workflow responsive to the alert that the particular internet-facing asset violates the policy.

17. The method of claim 1, further comprising determining, based on DNS records, whether a particular internet-facing asset includes a mail server, a DNS name server, or both.

18. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations including:

receiving a seed at a computing device;

identifying, based on first domain name system (DNS) data, first border gateway protocol (BGP) data, first whois data, or a combination thereof, a plurality of first internet-facing assets related to the seed;

identifying, based on second DNS data, second BGP data, second whois data, or a combination thereof, a plurality of second internet-facing assets related to at least one of the plurality of first internet-facing assets;

generating a graphical user interface (GUI) that includes a list of internet-facing assets related to the seed, wherein the list includes the plurality of first internet-facing assets and the plurality of second internet-facing assets;

receiving input via the GUI, the input indicating that a particular internet-facing asset is to be added to a scanning list;

scanning the particular internet-facing asset; and

generating an alert in response to determining, based on scanning the particular internet-facing asset, that the particular internet-facing asset violates a policy.

21. The computer-readable storage device of claim 18, wherein at least one internet-facing asset is scanned using an anonymous request that originates from outside a domain of the internet-facing asset.

19. (canceled)

20. An apparatus comprising:

a processor; and

memory storing instructions that, when executed by the processor, cause the processor to perform operations including;

receiving a seed at a computing device;

identifying, based on first domain name system (DNS) data, first border gateway protocol (BGP) data, first whois data, or a combination thereof, a plurality of first internet-facing assets related to the seed;

identifying, based on second DNS data, second BGP data, second whois data, or a combination thereof, a plurality of second internet-facing assets related to at least one of the plurality of first internet-facing assets;

generating a graphical user interface (GUI) that includes a list of internet-facing assets related to the seed, wherein the list includes the plurality of first internet-facing assets and the plurality of second internet-facing assets; and

accessing at least one of the plurality of first internet-facing assets or the plurality of second internet-facing assets based on one or more proxy servers to simulate requests from different geographic regions, different domains, different user agents, or a combination thereof.