Systems and methods for determining subsystems of a computer environment that are in a mutual independence state can include a computing device obtaining information indicative of a group of assets of a subsystem of a computer environment. For each asset of the group of assets, the computing device can identify one or more first assets on which the asset depends and one or more second assets that depend on the asset, and determine whether the one or more first assets and the one or more second assets belong to the group of assets. The computing device can determine that the subsystem is in a mutual independence state upon determining, for each asset of the group of assets, that the first and second assets belong to the group of assets. The computing device can update a data record to indicate the determined state of subsystem of the computer environment.
Systems and methods for identifying and managing solution stacks integrated within a computer environment include one or more computing devices receiving information identifying one or more first assets as belonging to a solution stack integrated within a computer environment. The computing devices can iteratively identify additional assets of the computer environment related to, but not part of, the assets already identified as belonging to the solution stack, and determine, based on a comparison of attributes of the additional assets to attributes of the assets already identified as belonging to the solution stack, whether any of the additional assets belongs to the solution stack. The one or more computing devices can repeat these steps until no additional is identified as belonging to the solution stack. The computing devices can generate a current state of the solution stack defining at least a complete set of assets forming the solution stack.
Systems and methods for data abstraction can include a data abstraction system assigning to each data item of a plurality of data items a corresponding arbitrary identifier, and maintaining a mapping between each data item of the plurality of data items and the corresponding arbitrary identifier. The data abstraction system can determine information associated with a first data item of the plurality of data items for transmission to a computing device. The data abstraction system can identify, using the mapping, a first arbitrary identifier assigned to the first data item, and transmit the information with the first arbitrary identifier to the computing device.
Systems and methods for data abstraction can include a data abstraction system assigning to each data item of a plurality of data items a corresponding arbitrary identifier, and maintaining a mapping between each data item of the plurality of data items and the corresponding arbitrary identifier. The data abstraction system can determine information associated with a first data item of the plurality of data items for transmission to a computing device. The data abstraction system can identify, using the mapping, a first arbitrary identifier assigned to the first data item, and transmit the information with the first arbitrary identifier to the computing device.
Systems and methods for data access management can include one or more processors determining settings defining a workspace of a user responsive to a request to establish a session with the workspace, and identifying a set of data items of the workspace using the settings and one or more control access permissions of the user. The one or more processors can generate a database of the workspace using copies of the set of data items, and providing the user access to the database. The one or more processors may delete the database upon detecting closing of the workspace
Systems and methods for session-based collaboration can include a collaboration system detecting initiation of a session by a first user to share content of a workspace with a second user. The collaboration system can identify, based at least on the initiation of the session, settings defining the workspace, and generate a database of the specific to the second user using the settings and one or more access control permissions of the second user. The database can include copies of data items of the workspace to which the second user has permission to access. The collaboration system can provide the second user access to the database during the session. The collaboration system may delete the database upon detecting ending of the session.
Systems and methods for data access management can include one or more processors determining settings defining a workspace of a user responsive to a request to establish a session with the workspace, and identifying a set of data items of the workspace using the settings and one or more control access permissions of the user. The one or more processors can generate a database of the workspace using copies of the set of data items, and providing the user access to the database. The one or more processors may delete the database upon detecting closing of the workspace
Systems and methods for session-based collaboration can include a collaboration system detecting initiation of a session by a first user to share content of a workspace with a second user. The collaboration system can identify, based at least on the initiation of the session, settings defining the workspace, and generate a database of the specific to the second user using the settings and one or more access control permissions of the second user. The database can include copies of data items of the workspace to which the second user has permission to access. The collaboration system can provide the second user access to the database during the session. The collaboration system may delete the database upon detecting ending of the session.
Systems and methods for reconnaissance of computer environments can include performing, by one or more processors, a hierarchical process to discover information of a computer environment. The one or more processors can discover a plurality of assets and a plurality of features of the computer environment, responsive to performing the hierarchical process. The one or more processors can generate, using the plurality of assets and the plurality of features of the computer environment, a representation of an architecture of the computer environment. The one or more processors can generate, based at least on the representation of the architecture of the computer environment, one or more attack vectors of the computer environment.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 21/56 - Computer malware detection or handling, e.g. anti-virus arrangements
Systems and methods for asset fingerprinting can include probing, by one or more processors, each of a plurality of assets associated with a computer environment, and receiving, responsive to the probe, parameters for the plurality of assets. The one or more processors can cluster, using the parameters, each of the plurality of assets into respective cluster of a plurality of clusters of assets. The one or more processors can determine a profile of a cluster of the plurality of clusters. The profile can define one or more common features of assets of the cluster. The one or more processors can assign the profile of the cluster an unidentified asset of the cluster.
Systems and methods for threat response in computer environments can include detecting, by one or more processors, using performance data of a computer environment, an event that occurred and that is indicative of abnormal performance of the computer environment. The one or more processors can identify, among a plurality of assets of the computer environment, a subset of assets associated with the event, and determine from a predefined set of resolutions a plurality of resolutions executable to address a cause of the event. The one or more processors can execute, for each resolution of the plurality of resolutions, a trained model to simulate the resolution for the subset of assets, and select, based at least on results of simulation of each resolution, a resolution among the plurality of resolutions to be implemented.
Systems and methods for reconnaissance of computer environments can include performing, by one or more processors, a hierarchical process to discover information of a computer environment. The one or more processors can discover a plurality of assets and a plurality of features of the computer environment, responsive to performing the hierarchical process. The one or more processors can generate, using the plurality of assets and the plurality of features of the computer environment, a representation of an architecture of the computer environment. The one or more processors can generate, based at least on the representation of the architecture of the computer environment, one or more attack vectors of the computer environment.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
13.
SYSTEMS AND METHODS FOR MONITORING RISK SCORES BASED ON DYNAMIC ASSET CONTEXT
Systems and methods for managing asset risk in computer environment can include receiving, by one or more processors, data indicative of attributes of an asset of the computer environment. The one or more processors can determine a risk context based on the data indicative of the attributes of the asset. The one or more processors can update a risk score of the asset based at least on the risk context. The one or more processors can adjust, responsive to the risk score of the asset, a configuration parameter of at least one of the asset or another asset to mitigate a security risk associated with the asset.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
14.
SYSTEMS AND METHODS FOR ASSET FINGERPRINTING CROSS REFERENCE TO RELATED APPLICATIONS
Systems and methods for asset fingerprinting can include probing, by one or more processors, each of a plurality of assets associated with a computer environment, and receiving, responsive to the probe, parameters for the plurality of assets. The one or more processors can cluster, using the parameters, each of the plurality of assets into respective cluster of a plurality of clusters of assets. The one or more processors can determine a profile of a cluster of the plurality of clusters. The profile can define one or more common features of assets of the cluster. The one or more processors can assign the profile of the cluster an unidentified asset of the cluster.
Systems and methods for managing asset risk in computer environment can include receiving, by one or more processors, data indicative of attributes of an asset of the computer environment. The one or more processors can determine a risk context based on the data indicative of the attributes of the asset. The one or more processors can update a risk score of the asset based at least on the risk context. The one or more processors can adjust, responsive to the risk score of the asset, a configuration parameter of at least one of the asset or another asset to mitigate a security risk associated with the asset.
Systems and methods for threat response in computer environments can include detecting, by one or more processors, a threat to the computer environment, and identifying a subset of assets of the plurality of assets associated with the threat. The one or more processors can determine from a predefined set of resolutions a plurality of resolutions executable to resolve the threat for the subset of assets. The one or more processors can execute, for each resolution of the plurality of resolutions, a trained model to simulate the resolution for the subset of assets. The one or more processors can select, based at least on results of execution of each resolution, a resolution among the plurality of resolutions to be implemented.
Systems and methods for threat response in computer environments can include detecting, by one or more processors, a threat to the computer environment, and identifying a subset of assets of the plurality of assets associated with the threat. The one or more processors can determine from a predefined set of resolutions a plurality of resolutions executable to resolve the threat for the subset of assets. The one or more processors can execute, for each resolution of the plurality of resolutions, a trained model to simulate the resolution for the subset of assets. The one or more processors can select, based at least on results of execution of each resolution, a resolution among the plurality of resolutions to be implemented.
Systems and methods for threat response in computer environments can include detecting, by one or more processors, using performance data of a computer environment, an event that occurred and that is indicative of abnormal performance of the computer environment. The one or more processors can identify, among a plurality of assets of the computer environment, a subset of assets associated with the event, and determine from a predefined set of resolutions a plurality of resolutions executable to address a cause of the event. The one or more processors can execute, for each resolution of the plurality of resolutions, a trained model to simulate the resolution for the subset of assets, and select, based at least on results of simulation of each resolution, a resolution among the plurality of resolutions to be implemented.
Systems and methods for determining subsystems of a computer environment that are in a mutual independence state can include a computing device obtaining information indicative of a group of assets of a subsystem of a computer environment. For each asset of the group of assets, the computing device can identify one or more first assets on which the asset depends and one or more second assets that depend on the asset, and determine whether the one or more first assets and the one or more second assets belong to the group of assets. The computing device can determine that the subsystem is in a mutual independence state upon determining, for each asset of the group of assets, that the first and second assets belong to the group of assets. The computing device can update a data record to indicate the determined state of subsystem of the computer environment.
Systems and methods for generating and rendering dynamic 3D representations of subsystems of a computer ecosystem can include a computing device receiving data indicative of importance parameters of a subset of assets of a plurality of assets of a computer environment. Each asset of the subset of assets can be associated with a respective importance parameter. The computing device can determine, for each asset of the subset of assets, a respective visual depth using the respective importance parameter of the asset. The computing device can construct a visual representation of a 3D model of the subset of assets. Each asset can be depicted according to the respective visual depth in the visual representation of the 3D model. The computing device can include causing display of the visual representation of the 3D model on a display device.
Systems and methods for segmenting computer environment data can include a computer system obtaining data of a computer environment including a plurality of assets. The computer system can filter, using the data and one or more first criteria, the plurality of assets to identify a set of filtered assets. The computer system can determine, using the data, a state of each asset of the set of filtered assets, and identify one or more asset clusters within the set of filtered assets, using one or more slicing criteria. Each asset cluster can include assets of the set of filtered assets identified based on corresponding values of the one or more slicing criteria. The computer system can generate a visual representation of an asset cluster of the one or more asset clusters, and assign the visual representation to a user account or a computing device associated with a user profile.
Systems and methods for segmenting computer environment data can include a computer system obtaining data of a computer environment including a plurality of assets. The computer system can filter, using the data and one or more first criteria, the plurality of assets to identify a set of filtered assets. The computer system can determine, using the data, a state of each asset of the set of filtered assets, and identify one or more asset clusters within the set of filtered assets, using one or more slicing criteria. Each asset cluster can include assets of the set of filtered assets identified based on corresponding values of the one or more slicing criteria. The computer system can generate a visual representation of an asset cluster of the one or more asset clusters, and assign the visual representation to a user account or a computing device associated with a user profile.
Systems and methods for determining subsystems of a computer environment that are in a mutual independence state can include a computing device obtaining information indicative of a group of assets of a subsystem of a computer environment. For each asset of the group of assets, the computing device can identify one or more first assets on which the asset depends and one or more second assets that depend on the asset, and determine whether the one or more first assets and the one or more second assets belong to the group of assets. The computing device can determine that the subsystem is in a mutual independence state upon determining, for each asset of the group of assets, that the first and second assets belong to the group of assets. The computing device can update a data record to indicate the determined state of subsystem of the computer environment.
G06F 21/55 - Detecting local intrusion or implementing counter-measures
H04L 12/24 - Arrangements for maintenance or administration
H04L 29/06 - Communication control; Communication processing characterised by a protocol
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
24.
SYSTEMS AND METHODS FOR GENERATING DYNAMIC 3D MODELS OF COMPUTER SYSTEMS
Systems and methods for generating and rendering dynamic 3D representations of subsystems of a computer ecosystem can include a computing device receiving data indicative of importance parameters of a subset of assets of a plurality of assets of a computer environment. Each asset of the subset of assets can be associated with a respective importance parameter. The computing device can determine, for each asset of the subset of assets, a respective visual depth using the respective importance parameter of the asset. The computing device can construct a visual representation of a three-dimensional (3D) model of the subset of assets. Each asset can be depicted according to the respective visual depth in the visual representation of the 3D model. The computing device can include causing display of the visual representation of the 3D model on a display device.
Systems and methods for identifying and managing solution stacks integrated within a computer environment include one or more computing devices receiving information identifying one or more first assets as belonging to a solution stack integrated within a computer environment. The computing devices can iteratively identify additional assets of the computer environment related to, but not part of, the assets already identified as belonging to the solution stack, and determine, based on a comparison of attributes of the additional assets to attributes of the assets already identified as belonging to the solution stack, whether any of the additional assets belongs to the solution stack. The one or more computing devices can repeat these steps until no additional is identified as belonging to the solution stack. The computing devices can generate a current state of the solution stack defining at least a complete set of assets forming the solution stack.
G06F 9/50 - Allocation of resources, e.g. of the central processing unit [CPU]
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
26.
Systems and methods for computer environment situational awareness
Systems and methods for monitoring states of operation of a computer environment can include one or more computer servers identifying a target asset of the computer environment and establishing a communication link with a computing device associated with the target asset. The one or more computer servers can determine a first set of parameters for profiling the target asset, transmit a first query for the first set of parameters to the computing device via the communication link, and receive one or more first parameter values corresponding to the first set of parameters responsive to the query. The one or more computer servers can compare the one or more first parameter values to one or more first criteria or threshold values, an determine a state of operation of the target asset based on the comparison. The state of operation can be indicative of an abnormal behavior associated with the target asset.
H04L 43/0817 - Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
G06F 21/55 - Detecting local intrusion or implementing counter-measures
H04L 41/0853 - Retrieval of network configurationTracking network configuration history by actively collecting configuration information or by backing up configuration information
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
27.
Systems and methods for multi-tier cache visual system and visual modes
Systems and methods for displaying computer environment monitoring data can include a multi-tier cache memory associated with a processor of a first device. The multi-tier cache memory can include a first cache layer, and a second cache layer having a higher data access rate than the first cache layer. The first device can receive, from a second device, a data block including monitoring data selected based on user profile information associated with a user of the first device. The first device can store the data block in the first cache layer, and generate a first data sub-block using data from the data block having a higher priority for display as compared to other data of the data block. The first device can store the first data sub-block in the second cache layer, and provide the first data sub-block for display on a display device from the second cache layer.
H04L 29/06 - Communication control; Communication processing characterised by a protocol
G06F 12/0868 - Data transfer between cache memory and other subsystems, e.g. storage devices or host systems
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 7/24 - Sorting, i.e. extracting data from one or more carriers, re-arranging the data in numerical or other ordered sequence, and re-recording the sorted data on the original carrier or on a different carrier or set of carriers
G06F 12/0811 - Multiuser, multiprocessor or multiprocessing cache systems with multilevel cache hierarchies
G06F 12/0813 - Multiuser, multiprocessor or multiprocessing cache systems with a network or matrix configuration
28.
Methods and systems for ranking, filtering and patching detected vulnerabilities in a networked system
Systems and methods for determining priority levels to process vulnerabilities associated with a networked computer system can include a data collection engine receiving a plurality of specification profiles, each defining one or more specification variables of the networked computer system or a respective asset. The data collection engine can receive, from a vulnerability scanner, vulnerability data indicative of a vulnerability associated with the networked computer system. A profiling engine can interrogate a computing device of the networked computer system, and receive one or more respective profiling parameters from that computing device. A ranking engine can compute a priority ranking value of the computing device based on the profile specification variables, the vulnerability data and the profiling parameters. The priority ranking value associated with the computing device can be indicative of a priority level, compared to other computing devices of the computer network, for patching a vulnerability affecting that computing device.
H04L 29/06 - Communication control; Communication processing characterised by a protocol
G06F 7/24 - Sorting, i.e. extracting data from one or more carriers, re-arranging the data in numerical or other ordered sequence, and re-recording the sorted data on the original carrier or on a different carrier or set of carriers
29.
Systems and methods for computer environment situational awareness
Systems and methods for monitoring states of operation of a computer environment can include one or more computer servers identifying a target asset of the computer environment and establishing a communication link with a computing device associated with the target asset. The one or more computer servers can determine a first set of parameters for profiling the target asset, transmit a first query for the first set of parameters to the computing device via the communication link, and receive one or more first parameter values corresponding to the first set of parameters responsive to the query. The one or more computer servers can compare the one or more first parameter values to one or more first criteria or threshold values, an determine a state of operation of the target asset based on the comparison. The state of operation can be indicative of an abnormal behavior associated with the target asset.
G06F 21/55 - Detecting local intrusion or implementing counter-measures
H04L 12/24 - Arrangements for maintenance or administration
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
30.
Methods and systems for ranking, filtering and patching detected vulnerabilities in a networked system
Systems and methods for determining priority levels to process vulnerabilities associated with a networked computer system can include a data collection engine receiving a plurality of specification profiles, each defining one or more specification variables of the networked computer system or a respective asset. The data collection engine can receive, from a vulnerability scanner, vulnerability data indicative of a vulnerability associated with the networked computer system. A profiling engine can interrogate a computing device of the networked computer system, and receive one or more respective profiling parameters from that computing device. A ranking engine can compute a priority ranking value of the computing device based on the profile specification variables, the vulnerability data and the profiling parameters. The priority ranking value associated with the computing device can be indicative of a priority level, compared to other computing devices of the computer network, for patching a vulnerability affecting that computing device.
H04L 29/06 - Communication control; Communication processing characterised by a protocol
G06F 7/24 - Sorting, i.e. extracting data from one or more carriers, re-arranging the data in numerical or other ordered sequence, and re-recording the sorted data on the original carrier or on a different carrier or set of carriers
31.
Methods and systems for ranking, filtering and patching detected vulnerabilities in a networked system
Systems and methods for determining priority levels to process vulnerabilities associated with a networked computer system can include a data collection engine receiving a plurality of specification profiles, each defining one or more specification variables of the networked computer system or a respective asset. The data collection engine can receive, from a vulnerability scanner, vulnerability data indicative of a vulnerability associated with the networked computer system. A profiling engine can interrogate a computing device of the networked computer system, and receive one or more respective profiling parameters from that computing device. A ranking engine can compute a priority ranking value of the computing device based on the profile specification variables, the vulnerability data and the profiling parameters. The priority ranking value associated with the computing device can be indicative of a priority level, compared to other computing devices of the computer network, for patching a vulnerability affecting that computing device.
H04L 29/06 - Communication control; Communication processing characterised by a protocol
G06F 7/24 - Sorting, i.e. extracting data from one or more carriers, re-arranging the data in numerical or other ordered sequence, and re-recording the sorted data on the original carrier or on a different carrier or set of carriers
32.
Systems and methods for multi-tier cache visual system and visual modes
Systems and methods for displaying computer environment monitoring data can include a multi-tier cache memory associated with a processor of a first device. The multi-tier cache memory can include a first cache layer, and a second cache layer having a higher data access rate than the first cache layer. The first device can receive, from a second device, a data block including monitoring data selected based on user profile information associated with a user of the first device. The first device can store the data block in the first cache layer, and generate a first data sub-block using data from the data block having a higher priority for display as compared to other data of the data block. The first device can store the first data sub-block in the second cache layer, and provide the first data sub-block for display on a display device from the second cache layer.
H04L 29/06 - Communication control; Communication processing characterised by a protocol
G06F 7/24 - Sorting, i.e. extracting data from one or more carriers, re-arranging the data in numerical or other ordered sequence, and re-recording the sorted data on the original carrier or on a different carrier or set of carriers
G06F 12/0811 - Multiuser, multiprocessor or multiprocessing cache systems with multilevel cache hierarchies
G06F 12/0813 - Multiuser, multiprocessor or multiprocessing cache systems with a network or matrix configuration
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 12/0868 - Data transfer between cache memory and other subsystems, e.g. storage devices or host systems
33.
Systems and methods for computer environment situational awareness
Systems and methods for monitoring states of operation of a computer environment can include one or more computer servers identifying a target asset of the computer environment and establishing a communication link with a computing device associated with the target asset. The one or more computer servers can determine a first set of parameters for profiling the target asset, transmit a first query for the first set of parameters to the computing device via the communication link, and receive one or more first parameter values corresponding to the first set of parameters responsive to the query. The one or more computer servers can compare the one or more first parameter values to one or more first criteria or threshold values, an determine a state of operation of the target asset based on the comparison. The state of operation can be indicative of an abnormal behavior associated with the target asset.
Systems and methods for determining priority levels to process vulnerabilities associated with a networked computer system can include a data collection engine receiving a plurality of specification profiles, each defining one or more specification variables of the networked computer system or a respective asset. The data collection engine can receive, from a vulnerability scanner, vulnerability data indicative of a vulnerability associated with the networked computer system. A profiling engine can interrogate a computing device of the networked computer system, and receive one or more respective profiling parameters from that computing device. A ranking engine can compute a priority ranking value of the computing device based on the profile specification variables, the vulnerability data and the profiling parameters. The priority ranking value associated with the computing device can be indicative of a priority level, compared to other computing devices of the computer network, for patching a vulnerability affecting that computing device.
Systems and methods for displaying computer environment monitoring data can include a multi-tier cache memory associated with a processor of a first device. The multi-tier cache memory can include a first cache layer, and a second cache layer having a higher data access rate than the first cache layer. The first device can receive, from a second device, a data block including monitoring data selected based on user profile information associated with a user of the first device. The first device can store the data block in the first cache layer, and generate a first data sub-block using data from the data block having a higher priority for display as compared to other data of the data block. The first device can store the first data sub-block in the second cache layer, and provide the first data sub-block for display on a display device from the second cache layer.
G06F 21/57 - Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
G06F 12/0811 - Multiuser, multiprocessor or multiprocessing cache systems with multilevel cache hierarchies
H04L 29/06 - Communication control; Communication processing characterised by a protocol
36.
SYSTEM AND METHOD FOR COMPUTER ENVIRONMENT SITUATIONAL AWARENESS
Systems and methods for monitoring states of operation of a computer environment can include one or more computer servers identifying a target asset of the computer environment and establishing a communication link with a computing device associated with the target asset. The one or more computer servers can determine a first set of parameters for profiling the target asset, transmit a first query for the first set of parameters to the computing device via the communication link, and receive one or more first parameter values corresponding to the first set of parameters responsive to the query. The one or more computer servers can compare the one or more first parameter values to one or more first criteria or threshold values, an determine a state of operation of the target asset based on the comparison. The state of operation can be indicative of an abnormal behavior associated with the target asset.
patents
