Systems and methods for identifying exposed assets in computing networks

Abstract

Systems and methods for managing one or more assets on a computer network are disclosed. A network agent determines at least one unique fingerprint for an asset based on asset-specific attributes. The asset-specific attributes are determined based on one or more transmission control protocol / internet protocol (TCP / IP) services associated with the asset. A scan of publicly-routable IP addresses is performed by the network agent and fingerprints for assets external to the computer network are calculated. The fingerprints for assets external to the computer network are compared to the at least one unique fingerprint. If a match is found, a vulnerability is identified and remediated.

Description

Attorney Docket No. RNZR-002W001SYSTEMS AND METHODS FOR IDENTIFYING EXPOSED ASSETS IN COMPUTING NETWORKSCROSS-REFERENCE TO RELATED APPLICATION(S)

[0001] This application claims the priority benefit, under 35 U.S.C. 119(e), of U.S. Application No. 63 / 713,685, which was filed on October 30, 2024, and is incorporated herein by reference in its entirety for all purposes.BACKGROUND

[0002] Modern computing devices are frequently networked in office settings to allow for improved information exchange and communication. These networks may include small intranets connecting a known group of computer assets such as desktop computers, work laptops, tablets, printers, and the like. It is often desirable to isolate these networks from the broader Internet to prevent malicious actors from gaining access to these networks and potentially stealing information, installing malware, disrupting or deleting information, causing damage to hardware, etc.

[0003] However, preventing network intrusions can be challenging and time consuming, particularly for users who may not have a background in information technology (IT) security. Further, an ever-expanding number of services and device types often leads to a corresponding increase in threat vectors that malicious actors can exploit. For organizations such as businesses, preventing these intrusions in a timely fashion is of paramount importance. However, no solution currently exists for quickly and easily identifying assets on a network that may have been exposed outside of that network.SUMMARY

[0004] The present technology is directed towards detecting instances of computing assets, or services operating on those computing assets, that have been exposed outside of an intended network on which they are hosted. A network may be a private network, an internal network for an organization (e.g., an office intranet, a research laboratory internal network, etc.), or the like. In particular, systems and methods in accordance with the present technology may analyze assets on a network using services accessible through the transmission control protocol / internet protocol (TCP / IP). These services include Secure Shell (SSH), Remote Desktop (RDP), Simple Network Management Protocol (SNMP, versions 1, 2, and 3), Common Internet FilesystemAttorney Docket No. RNZR-002W001(CIFS), Hypertext Transport Protocol (HTTP), Transport Layer Security (TLS), Internet Control Message Protocol (ICMP), Internet Message Access Protocol (IMAP), Simple Mail Transfer Protocol (SMTP), OpenVPN, Lightweight Directory Access Protocol (LDAP), or any suitable service that utilizes TCP / IP functionality. The present technology may detect instances of asset-based identifiers that are found at more than one IP address, where those identifiers are located within different security boundaries (e.g., within a first computer network controlled by an organization, but also the Internet or a guest network, etc.).

[0005] A network agent may query one or more of these TCP / IP services operating on an asset (such as a desktop computer, a laptop, a tablet, a smartphone, a printer, a wearable device, a scanner, an intemet-of-things (loT) device, or any suitable device) and utilize data received in response to the query to determine asset-specific attributes and generate a unique fingerprint for the asset. The unique fingerprint may be a combination of one or more data types, data structures, cryptographic keys (e.g., an SSH public key), non-cryptographic information, universally unique identifiers (UUIDs), globally unique identifiers (GUIDs), medium access control addresses (MAC Addresses), service or protocol fields, service-presented timestamps, activity counters, and other suitable information.

[0006] The network agent or other suitable device may then query services at selected IP addresses (e.g., all publicly routable IP addresses) to determine if the unique fingerprint for the asset is detectable at one or more publicly routable IP addresses (or any IP address other than an IP address of the asset). If the unique fingerprint for the asset is detectable beyond the IP address of the asset on the known computer network, this may indicate that the asset can be accessed by a malicious actor from a less trusted network, such as the public internet, or an internal guest network, and that remediation is necessary. An appropriate action may then be taken to ensure any related threat is mitigated or eliminated.

[0007] In some aspects, the techniques described herein relate to a method of managing an asset on a computer network, the method including: interrogating the asset from inside the computer network using a query associated with a transmission control protocol / internet protocol (TCP / IP) service; receiving asset-specific attributes from the asset in response to the query; creating a first fingerprint for the asset based on the asset-specific attributes; detecting the first fingerprint for the asset at one or more IP addresses based on a scan of publicly routable IP addresses; identifying a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the one or more IP addresses; and remediating the vulnerability of the computer network.Attorney Docket No. RNZR-002W001

[0008] In some aspects, the techniques described herein relate to a method, wherein the assetspecific attributes include at least one of a protocol type, a protocol field, the TCP / IP service, a media access control (MAC) address, a calculated hash, software information associated with the asset, or hardware information associated with the asset.

[0009] In some aspects, the techniques described herein relate to a method, wherein the TCP / IP service is selected from at least one of secure shell (SSH), simple network management protocol (SNMP), common internet filesystem (CIFS), hypertext transport protocol (HTTP), transport layer security (TLS), or remote desktop (RDP).

[0010] In some aspects, the techniques described herein relate to a method, wherein creating the first fingerprint for the asset includes generating a unique hash based on one or more of the asset-specific attributes.

[0011] In some aspects, the techniques described herein relate to a method, wherein the first fingerprint for the asset includes data defined by the TCP / IP service.

[0012] In some aspects, the techniques described herein relate to a method, wherein creating the first fingerprint for the asset includes combining each attribute of the asset-specific attributes to create a unique hash.

[0013] In some aspects, the techniques described herein relate to a method, wherein creating the first fingerprint for the asset includes creating a plurality of unique fingerprints based on a plurality of services associated with a corresponding plurality of ports of the asset.

[0014] In some aspects, the techniques described herein relate to a method, wherein detecting the first fingerprint for the asset includes performing the scan of publicly routable IP addresses.

[0015] In some aspects, the techniques described herein relate to a method, wherein detecting the first fingerprint for the asset further includes: storing fingerprints of assets at publicly routable IP addresses in a database; instantiating the database within the computer network; querying the database for the first fingerprint for the asset; and determining that the database includes the first fingerprint for the asset.

[0016] In some aspects, the techniques described herein relate to a method, wherein querying the database for the first fingerprint for the asset includes searching the database from within the network.

[0017] In some aspects, the techniques described herein relate to a method, wherein detecting the first fingerprint for the asset includes: querying a server with a first portion of the firstAttorney Docket No. RNZR-002W001 fingerprint for the asset; receiving, for assets at publicly routable IP addresses, a list of fingerprints that match the first portion of the first fingerprint; and determining that the list includes the first fingerprint for the asset.

[0018] In some aspects, the techniques described herein relate to a method, further including performing the scan of publicly routable IP addresses by: identifying publicly routable IP addresses; for each publicly routable IP address, attempting to elicit a response from a TCP / IP service; for each elicited response, querying one or more services at that IP address to obtain specific protocol fields used to create the first fingerprint for the asset; and deriving a fingerprint for each established connection based on the specific protocol fields.

[0019] In some aspects, the techniques described herein relate to a method, wherein remediating the vulnerability includes restricting data transfer for a service operated by the asset.

[0020] In some aspects, the techniques described herein relate to a method, wherein restricting data transfer for a service operated by the asset includes implementing a firewall rule or disabling a network interface of the asset.

[0021] In some aspects, the techniques described herein relate to a method, wherein remediating the vulnerability includes notifying a user of one or more actions to mitigate the vulnerability.

[0022] In some aspects, the techniques described herein relate to a method of managing an asset on a computer network, the method including: interrogating the asset using a query associated with a transmission control protocol / internet protocol (TCP / IP) service, the TCP / IP service including at least one of secure shell (SSH), simple network management protocol (SNMP), common internet filesystem (CIFS), hypertext transport protocol (HTTP), transport layer security (TLS), or remote desktop (RDP); receiving asset-specific attributes in response to the query, the asset-specific attributes including at least one confidential asset-specific attribute and based on at least one of a protocol type, a protocol field, a cryptographic hash, a media access control (MAC) address, software information associated with the asset, or hardware information associated with the asset; creating a first fingerprint for the asset based on the asset-specific attributes; detecting the first fingerprint for the asset at a plurality of internet protocol (IP) addresses based on a scan of publicly routable IP addresses; identifying a vulnerability of the computer network in response to detecting the first fingerprint for theAttorney Docket No. RNZR-002W001 asset at the plurality of IP addresses; and remediating the vulnerability of the computer network.

[0023] In some aspects, the techniques described herein relate to a method, wherein detecting the first fingerprint for the asset includes: querying a server with a first portion of the first fingerprint for the asset; receiving, for assets at publicly routable IP addresses, a list of fingerprints that match the first portion of the first fingerprint; and determining that the list includes the first fingerprint for the asset.

[0024] In some aspects, the techniques described herein relate to a method, wherein remediating the vulnerability includes restricting data transfer for a service operated by the asset.

[0025] In some aspects, the techniques described herein relate to a network agent, the network agent including: a processor, and a memory containing instructions configuring the processor to: interrogate an asset on a computer network using a query associated with a transmission control protocol / intemet protocol (TCP / IP) service; receive asset-specific attributes in response to the query; create a first fingerprint for the asset based on the asset-specific attributes; detect the first fingerprint for the asset at a plurality of internet protocol (IP) addresses based on a scan of publicly routable internet protocol (IP) addresses; identify a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the plurality of IP addresses; and remediate the vulnerability of the computer network.

[0026] In some aspects, the techniques described herein relate to a network agent, wherein detecting the first fingerprint for the asset includes: querying a server with a first portion of the first fingerprint for the asset; receiving, for assets at publicly routable IP addresses, a list of fingerprints that match the first portion of the first fingerprint; and determining that the list includes the first fingerprint for the asset.

[0027] All combinations of the foregoing concepts and additional concepts discussed in greater detail below (provided such concepts are not mutually inconsistent) are part of the inventive subject matter disclosed herein. In particular, all combinations of claimed subject matter appearing at the end of this disclosure are part of the inventive subject matter disclosed herein. The terminology used herein that also may appear in any disclosure incorporated by reference should be accorded a meaning most consistent with the particular concepts disclosed herein.Attorney Docket No. RNZR-002W001BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The skilled artisan will understand that the drawings primarily are for illustrative purposes and are not intended to limit the scope of the inventive subject matter described herein. The drawings are not necessarily to scale; in some instances, various aspects of the inventive subject matter disclosed herein may be shown exaggerated or enlarged in the drawings to facilitate an understanding of different features. In the drawings, like reference characters generally refer to like features (e.g., functionally similar and / or structurally similar elements).

[0029] FIG. 1 illustrates a computing environment in accordance with the present technology.

[0030] FIG. 2 illustrates a computing environment in accordance with the present technology having functionality provided by network agent included in a self-hosted service.

[0031] FIG. 3 illustrates a computing environment including a central network communicatively coupled to one or more remote networks through corresponding virtual private network (VPN) tunnels.

[0032] FIG. 4 illustrates a computing environment utilizing passive traffic sampling in accordance with the present technology.

[0033] FIG. 5 is a flowchart of a method of managing an asset on a computer network.

[0034] FIG. 6 is a flowchart of an additional method of managing an asset on a computer in accordance with the present technology.DETAILED DESCRIPTION

[0035] FIG. 1 illustrates a computing environment 100 in accordance with the present technology. Computing environment 100 includes a computer network 110, which may have a variety of assets 112a-h. Assets 112a-h may include a laptop 112a, desktop 112b, tablet 112, telephone 112d, server 112e, modem 112f, printer 112g, and projector 112h. Each asset of assets 112a-h may include one or more such assets; for example, computer network 110 may include one or more servers 112e, two or more servers 112e, five or more servers 112e, ten or more servers 112e, 50 or more servers 112e, 100 or more servers 112e, 200 or more servers 112e, 500 or more servers 112e, 1000 or more servers 112e, 50,000 or more servers, 1,000,000 or more servers, or any plurality of servers 112e.Attorney Docket No. RNZR-002W001

[0036] Computer network 110 may include any suitable networking infrastructure including cables, routers, switches, modems, Wi-Fi modems, repeaters, and the like, that provide networking functionality and / or communicative coupling among assets 112a-h. Each asset 112 of assets 112a-h may be connected to one or more other assets of assets 112a-h using suitable networking infrastructure. Each asset 112 may include a suitable processor (e.g., one or more central processing units (CPUs), one or more graphics processing units (GPUs), one or more neural processing units (NPUs), etc.), memory (e.g., volatile memory such as random access memory (RAM), long-term memory such as solid-state memory, etc.), network interface(s), user interface(s), connectors, ports, and the like.

[0037] Computer network 110 and each asset 112 may be communicatively coupled to network agent 120. Network agent 120 may be a computer such as a server, a desktop computer, a laptop computer, or other computer. In some embodiments, network agent 120 may be or include any suitable components for a network scanner. Network agent 120 may include a processor such as one or more CPUs, one or more GPUs, one or more NPUs, or any suitable logic integrated circuit (IC) configured to perform logical operations. Network agent 120 may further include one or more memories. The one or more memories may include volatile memory such as RAM, dynamic random access memory (DRAM), static random access memory (SRAM), synchronous dynamic random access memory (SDRAM), high-bandwidth memory (HBM), or the like. The one or more memories may include one or more non-transitory computer readable media storing instructions that configure one or more processors to perform one or more operations or actions, e.g., as described in one or more methods or blocks of methods herein.

[0038] In an embodiment, network agent 120 may be embodied on an asset 112, such as a server 112e. Network agent 120 may perform passive traffic scanning or active traffic scanning. Passive traffic scanning may include routing network traffic to and from assets 112 through network agent 120 and monitoring or recording the network traffic. For example, network agent 120 may passively scan hypertext transfer protocol (HTTP) traffic in the form of data packets to and from a laptop 112a.

[0039] Additionally or alternatively, network agent 120 may perform active scanning of assets 112 and / or network 110 according to a TCP / IP protocol. Active scanning may include querying one or more assets 112, querying a particular IP address or block of IP addresses such as 192.168.10.1 or 192.168.10.0 / 24, discovering assets on computer network 110, within a subset of computer network 110, within a subset of an organization or physical location (e.g., on a particular floor of an office building), or the like. Computer network 110 may be addressableAttorney Docket No. RNZR-002W001 via request for comment (RFC) 1918 IP space, e.g., 192.168.0.0 / 24, 10.0.0.0 / 8, etc., which is not routable via the public Internet.

[0040] Active scanning may include interrogating one or more services of one or more of assets 112 using a query associated with a TCP / IP service. Examples of TCP / IP services that may be interrogated include Secure Shell (SSH), Remote Desktop, Simple Network Management Protocol (SNMP), Common Internet Filesystem (CIFS), Hypertext Transport Protocol (HTTP), transport layer security (TLS), echo, finger, Internet Message Access Protocol (IMAP), Simple Mail Transfer Protocol (SMTP), OpenVPN, Lightweight Directory Access Protocol (LDAP), or any suitable service that utilizes TCP / IP functionality (including user datagram protocol (UDP) and / or internet control message protocol (ICMP)). A response from the asset may include an indication of asset-specific attributes. If a response is elicited, network agent 120 may utilize the asset-specific attributes to generate a unique fingerprint for the asset.

[0041] For example, network agent 120 may scan computer network 110 for assets 112 by querying the SSH protocol (e.g., by connecting to the service and negotiating the key exchange and recording the results) and analyzing if a response is received and / or if a response associated with an active SSH server or client protocol is received. Network agent 120 may generate, store, update, alter, and / or delete a record of responses received from each IP address. For example, network agent 120 may interrogate the SSH protocol for IP addresses 192.168.10.1- 192.168.10.10. Network agent 120 may receive responses from none, one, some, or all of the IP addresses. For each IP address from which network agent 120 receives a reply, network agent 120 may include the asset-specific attributes received from the corresponding IP address.

[0042] Network agent 120 and / or remote management system 130 may receive information from one or more external services through one or more application programming interfaces (APIs). For example, network agent 120 may be communicatively coupled with one or more endpoint detection and response (EDR) services, one or more virtualization services, one or more vulnerability management services, one or more security orchestration, automation, and response (SOAR) services, information technology service management (ITSM) services, one or more security information and event management (SIEM) services, or any suitable service. API integrations may include one or more inbound API integrations 114a (e.g., communicative couplings to sources from which network agent 120 receives data relevant to one or more operations of computing environment 100) and / or one or more outbound API integrations 114b (e.g., communicative couplings to services that receive data from network agent 120 or other device in computer network 110).Attorney Docket No. RNZR-002W001

[0043] This communicative coupling with one or more external services through APIs may enable remote management system 130 to mitigate or remediate a vulnerability by providing an indication of the vulnerability to an appropriate service, which may then take an appropriate action to remediate the vulnerability. Additionally or alternatively, network agent 120 may utilize information received through one or more APIs to perform active or passive scanning of a particular asset, IP address, or service based on the information.

[0044] FIG. 1 further shows remote management system 130. Remote management system 130 may be used to configure network agent 120, provide external monitoring of computer network 110, calculate fingerprints for one or more assets, perform correlations, data analysis, or the like. Remote management system 130 may integrate with one or more services 134 through corresponding API integrations. These services 134 may provide data storage, information management, IT security, and the like. Remote management system 130 may further be communicatively coupled with external scanner 132.

[0045] In an aspect, remote management system 130 may coordinate or control one or more functions of network agent 120. A user may interface with remote management system 130 (e.g., through a console or other suitable user interface) to conduct scanning and vulnerability analysis of computer network 110 through network agent 120. In an aspect, remote management system 130 may be communicatively coupled to one or more assets 112 of computing environment 100, whereby a user may interface with remote management system 130 through an asset such as laptop 112a. The user may utilize remote management system 130 to direct network agent 120 to perform one or more operations such as asset inventorying, fingerprint determination or generation, or logging.

[0046] Remote management system 130 may utilize a particular port of a TCP / IP ethemet connection to communicate with computer network 110 and / or assets 112. For example, information transmitted from computer network 110 to remote management system 130 may be transmitted using port 443.

[0047] External scanner 132 may be configured to perform scanning of publicly routable IP addresses to determine if a first fingerprint associated with an attribute is associated with one or more of the publicly routable IP addresses. External scanner 132 may be configured to perform some or all of the same functionality that network agent 120 is configured to perform. External scanner 132 may be instantiated on a server, a desktop computer, a laptop, in a cloudcomputing environment, or any suitable computer or computing environment. External scannerAttorney Docket No. RNZR-002W001132 may further perform scanning of computer network 110 from outside of computer network 110, for example to probe for vulnerabilities or access points that may be exploited by malicious actors. Additionally or alternatively, external scanner 132 may be configured to scan publicly routable IP addresses for one or more fingerprints associated with one or more of assets 112 to determine if a vulnerability exists with any of the assets 112. For example, external scanner 132 may perform a scan of one or more publicly routable IP addresses by sending an ICMP query (e.g., a ping) to each of the publicly routable IP addresses and determining if a response is received.

[0048] In an aspect, an overall workflow of the present technology may proceed according to the following order of operations. First, external scanner 132 may gather data from internet- exposed systems across a variety of services and protocols, calculating unique fingerprints for each endpoint based on asset-specific attributes, hashing these fingerprints, and storing them in a fingerprint database accessible to remote management system 130. This internet-wide scanning and fingerprint calculation may be performed on a periodic basis such as daily, weekly, or at another suitable interval to maintain current data. Second, network agent 120 performs active scans and / or passive traffic observation across one or more customer environments (e.g., computer network 110) and calculates the same types of fingerprints for services observed on assets 112 within those environments. Third, during data processing, network agent 120 or remote management system 130 looks up the customer-environment fingerprint hashes against the internet fingerprint database to identify matches. A match may indicate one of several scenarios: the internal asset is directly exposed to the Internet (discovered without requiring knowledge of the customer’s external IP address space), the asset shares encryption keys with other systems, or the asset has a hardcoded and widely-reused encryption key. Network agent 120 or remote management system 130 may apply heuristics to determine which scenario applies and report a security finding with appropriate severity based on the context, such as the type of service involved and whether the exposure represents an intentional configuration or an inadvertent vulnerability.

[0049] In an aspect, a user may interrogate (i.e., query) some or all network equipment within their organization (e.g., on an internal side of a network firewall) using TCP / IP protocols and application-specific enumeration using network agent 120. For example, a user may initiate a TCP connection to ports 22 and 3389 on some or all IP addresses of computer network 110. This interrogation action may occur automatically (e.g., once or repeatedly on a predeterminedAttorney Docket No. RNZR-002W001 schedule), or may be manually specified by the user. This scan identifies and interrogates some or all network-connected devices and a subset of their services and may generate a list of assets.

[0050] For each asset identified by network agent 120 on computer network 110, network agent 120 may connect with, interrogate, or otherwise elicit a response from a predetermined service or services to determine device-specific attributes. For example, network agent 120 may obtain a TLS certificate from a network-level authentication (NLA) enabled Remote Desktop (RDP) service at port 3389 of the IP address for the asset or per-al gorithm host keys from an SSH service communicating using port 22 of the IP address.

[0051] Information used to create a unique fingerprint for an asset may include data defined by a TCP / IP service; in other words, the data may have a structure, organization, and / or contents particular to the TCP / IP service. Once a suitable group of asset-specific attributes has been determined, a unique fingerprint may be calculated based on the service or services for that particular asset. Asset-specific attributes may be cryptographic in nature and / or have cryptographic aspects. For example, an asset-specific attribute may be an SSH host key. Additionally or alternatively, an asset-specific attribute may be non-cryptographic in nature and / or have non-cryptographic aspects. For example, an asset-specific attribute may include a 128-bit UUID during a server message block (SMB) handshake.

[0052] Asset-specific attributes may be both protocol-specific and asset-specific. Assetspecific attributes may include service-presented timestamps, activity counters, service logs, user lists, operating system (OS) information including OS type, OS version, manufacturer, trademark and / or copyright information, installation dates, valid or invalid usernames, device hostname, service software version, or other suitable information. For example, an assetspecific attribute may include an SNMP v3 pre-authentication EnginelD field. Asset-specific attributes may be restart dependent or restart agnostic. In other words, some asset-specific attributes may change when an asset is restarted or otherwise powered off and powered on again. In some aspects, asset-specific attributes may not change when an asset is restarted or otherwise powered off and powered on again.

[0053] In an aspect, remote management system 130 may store one or more asset-specific attributes and calculate a unique hash from the one or more asset-specific attributes. For example, remote management system 130 may store a TLS certificate and SSH host key (including a plurality of each) for a particular asset and calculate a secure hash algorithm (SHA) SHA-256 hash from the TLS certificates and SSH host keys. This SHA-256 hash may be usedAttorney Docket No. RNZR-002W001 as a unique fingerprint for the asset. Multiple unique fingerprints may be calculated for a single asset, e.g., based on different combinations of services associated with the asset. Multiple unique fingerprints may be combined into a single unique fingerprint, for example by calculating unique hashes for a plurality of asset-specific attribute combinations, and then calculating a unique hash for the combination of the plurality of asset-specific attribute unique hashes. A combination of asset-specific attributes may serve to prevent a standard cryptographic key that may be reused across multiple assets from being interpreted as belonging to or identifying a specific asset.

[0054] Computing environment 100 may include functionality to perform scanning analogous to that described above with respect to network agent 120, where the scanning is performed across publicly -routable IP addresses hosted on networks other than computer network 110. For example, external scanner 132 may scan publicly-routable IP addresses for unique fingerprints calculated by network agent 120.

[0055] The present technology provides significant technical efficiency advantages over conventional approaches to detecting externally exposed assets. Traditional methods require organizations to maintain comprehensive inventories of their public IP address space and perform ongoing external vulnerability scans of those known addresses. This ‘attribution stage’ — where public IP addresses must be identified and associated with an organization’s assets — is computationally expensive, time-consuming, and prone to errors and false positives. Organizations may not have complete knowledge of all public IP addresses used by their assets, particularly in dynamic cloud environments or when remote workers connect through various internet service providers. Additionally, repeatedly scanning large ranges of public IP addresses for comparison against internal assets consumes significant network bandwidth and computational resources. By contrast, the hash-based fingerprint matching approach described herein eliminates the attribution stage entirely. Instead of attempting to determine which public IP addresses belong to an organization and then scanning those addresses, the system performs a fast hash lookup against a pre-computed database of internet-exposed system fingerprints. This approach avoids the need to perform additional internet scanning for each comparison operation, significantly reducing computational overhead and scan time while improving accuracy. The fingerprint database may be updated on a periodic basis (e.g., daily, weekly, or at another suitable interval) by scanning publicly routable IP addresses and calculating fingerprints for systems found at those addresses. During customer environment analysis, network agent 120 or remote management system 130 simply performs hash lookups againstAttorney Docket No. RNZR-002W001 this pre-computed database rather than initiating new external scans, thereby providing near- instantaneous detection of exposed assets without requiring knowledge of the organization's external IP address space.

[0056] If instances of unique fingerprints associated with one or more assets of computer network 110 are detected, an alert or notification may be generated and sent to a user or system indicating a vulnerability may exist. In an aspect, remote management system 130 may communicate with one or more outbound API integrations 114b in order to respond to, mitigate, and / or remediate a discovered vulnerability.

[0057] When a match is detected between a fingerprint of an asset on computer network 110 and a fingerprint in a database of publicly routable IP addresses, network agent 120 or remote management system 130 may determine which of several scenarios has occurred. In a first scenario, the asset may be directly exposed to the Internet, meaning the asset is accessible from publicly routable IP addresses without the organization’s knowledge or authorization. This scenario represents a potential security vulnerability that should be remediated. In a second scenario, the asset may share encryption keys with other systems. Whether this represents a vulnerability may depend on the type of service; for example, sharing TLS certificates across web servers may be acceptable in some cases, while sharing cryptographic keys between an internal virtual machine and a publicly exposed system may represent a critical security risk. In a third scenario, the asset may have a hardcoded encryption key that is widely reused across multiple devices, which is common for certain loT device vendors. Network agent 120 or remote management system 130 may apply heuristics to determine which scenario is most likely and adjust the severity level of any generated vulnerability record accordingly. For example, if an asset with a matching TLS fingerprint is identified as a web server, the vulnerability severity may be classified as low or informational, whereas if the matching service is Remote Desktop (RDP) or SSH, the vulnerability severity may be classified as high or critical, indicating that immediate remediation is necessary.

[0058] External scanner 132 may utilize IPv4 IP addresses, IPv6 IP addresses, or both. External scanner 132 may utilize a brute force method for scanning IPv4 IP addresses (e.g., scanning a portion of or all available IPv4 IP addresses that are publicly routable). Additionally or alternatively, external scanner 132 may utilize lookup-based scanning for IPv4 or IPv6 IP addresses. Lookup-based scanning may include utilizing domain name service (DNS) records or public records for IP addresses associated with a particular entity, location, asset type, etc. In an aspect, network agent 120, remote management system 130, and / or external scanner 132Attorney Docket No. RNZR-002W001 may query external services for external asset scan data from third-party data sources, e.g., through one or more API integrations such as inbound API integrations 114a or outbound API integrations 114b. For example, external scanner 132 may receive external asset and / or fingerprint information from one or more third-party data sources. External scanner 132 may further scan or query these external assets to fill in missing information that may be used to calculate a unique fingerprint based on asset-specific attributes for assets 112.

[0059] Unique fingerprint data from external sources may be analyzed to identify cases where a specific fingerprint method returns duplicates for disparate assets. For example, some network appliance vendors hardcode identical TLS and SSH keys across multiple manufactured assets, which results in all of these assets having the same fingerprint. This practice may allow a malicious actor to undermine encryption, intercept and / or modify communication, and / or decrypt messages sent from an asset if the hardcoded key is discovered or leaked. External scanner 132 may identify keys that are not unique to a single customer by detecting instances where a particular fingerprint appears at a threshold number of unrelated IP addresses (e.g., more than 10, more than 100, more than 1000, or another suitable threshold indicating the key is shared across multiple organizations or customers). Remote management system 130 may flag these shared or duplicative keys as non -unique and record them as potential vulnerabilities. When such hardcoded keys are detected, network agent 120 may generate a vulnerability record indicating the asset uses a widely-reused hardcoded encryption key and recommend remediation actions such as regenerating unique cryptographic keys for the asset. Remote management system 130 may transmit reports or notifications regarding hardcoded keys to security companies, vendors, affected organizations, or other suitable entities. Despite the presence of hardcoded keys, assets may still be uniquely identified by combining the hardcoded key fingerprint with other asset-specific attributes that vary between devices, such as service-presented timestamps, activity counters, operating system information, or device-specific configuration parameters.

[0060] Network agent 120, remote management system 130, and / or external scanner 132 may create, update, modify, add information to, or delete one or more fingerprint databases storing fingerprints for assets 112 and / or assets external to computer network 110. Such a fingerprint database may be queried by a user or automatically by software to determine if unique fingerprints determined as being in computer network 110 were also detected outside of computer network 110, e.g., if a unique fingerprint associated with an asset of assets 112 matches a fingerprint associated with one or more assets at publicly routable IP addresses notAttorney Docket No. RNZR-002W001 controlled by an entity or organization that controls / owns / manages computer network 110 and / or assets 112.

[0061] In an aspect, such a fingerprint database may be generated outside of computer network 110 and then copied or otherwise instantiated on one or more assets 112 within computer network 110. Once the fingerprint database is instantiated within computer network 110, a user may query the fingerprint database (e.g., using a user interface such as a console presented via remote management system 130 or other suitable device) to determine if unique fingerprints for one or more assets 112 match fingerprints for assets at publicly-routable IP addresses. Instantiating the one or more fingerprint databases and querying the fingerprint databases from within computer network 110 may confer the benefit of reducing or eliminating a transfer of sensitive information containing unique fingerprints for one or more assets of assets 112 and / or potentially revealing what information an entity or organization uses to assess vulnerabilities in their assets or networks.

[0062] In an aspect, remote management system 130 may include a central console server communicatively coupled to network agent 120 and / or external scanner 132. Remote management system 130 may receive information from network agent 120 and / or external scanner 132 associated with active scans, passive discovery, asset-specific identifiers, services operated on assets such as assets 112, collection of integration data, and the like. Remote management system 130 may perform fingerprint calculation for assets, asset correlation, and other analysis. Network agent 120 and / or external scanner 132 may both feed information into a central server via a console (which may be operated, e.g., by a separate organization as a software-as-a-service (SaaS) platform, or in a self-hosted configuration on one of the assets 112) and this is where the lookups occur; remote management system 130 may also include a separate lookup server which keeps a map of the externally visible fingerprints and allows prefix queries from processing tasks (which may be performed on the separate organization console(s), as SaaS services, or as customer hosted tasks).

[0063] Additionally or alternatively, network agent 120 and / or remote management system 130 may query a fingerprint database hosted on one or more devices outside of computer network 110, e.g., remote management system 130, external scanner 132, or another device(s) / cloud service(s). Network agent 120 may transmit one or more unique fingerprints for corresponding assets of assets 112 to the one or more devices outside of computer network 110 and receive an indication of whether or not any matches to the unique fingerprints were found. In an aspect, network agent 120 may query the fingerprint database hosted on one orAttorney Docket No. RNZR-002W001 more devices outside of computer network 110 by sending a first portion of a unique fingerprint (which may be less than the entirety of the unique fingerprint, and which may exclude a second portion of the unique fingerprint). Remote management system 130 may then receive an indication of whether or not any fingerprints in the fingerprint database contain portions that match the first portion of the unique fingerprint. This may increase the total number of results or potential matches received by network agent 120; however, this may also confer the benefit of masking or obfuscating uniquely identifying information for one or more assets of assets 112.

[0064] For example, if the unique fingerprint includes a 128-bit UUID, a user may send a query for the first 64 bits, and a server may return all matches that start with this 64-bit prefix.

[0065] If any unique fingerprints for one or more assets of assets 112 are identified in response to a fingerprint database query, the user is told that the one or more assets may be exposed to the Internet and is provided remediation advice. Network agent 120 may generate a vulnerability record associated with the asset describing the vulnerability and the steps to mitigate or remediate the vulnerability (e.g., enable a firewall rule, disable an external interface such as a cellular modem, etc.). The user may also receive an alert of this exposure. If a unique fingerprint is identified on a fingerprint database, but the fingerprint was identified by network agent 120, remote management system 130, and / or external scanner 132 as duplicative or shared (e.g., a fixed fingerprint assigned to multiple assets by a manufacturer), the user may be notified and network agent 120, remote management system 130, and / or external scanner 132 may generate a vulnerability record indicating that the unique fingerprint is associated with a duplicative fingerprint.

[0066] Remote management system 130 may calculate unique fingerprints in a variety of manners. For example, network agent 120 may query TCP / IP port 22 (e.g., an SSH service) for each asset of assets 112. A hash may be calculated for each SSH host key using an appropriate hashing algorithm such as SHA-256, SHA-512, message digest method 5 (MD5), MurmurHash, or any suitable hashing algorithm. Other service-specific attributes such as an SSH ciphers list, TCP window size, software version, key exchange fields, SSH authentication banner, SSH authentication methods enabled, and time-relevant fields such as counters, etc., may be combined with the hash to form a unique fingerprint for the asset.

[0067] Remote management system 130 may calculate a unique fingerprint for an asset by querying a remote desktop (RDP) protocol for the asset and receiving a TLS public key. TheAttorney Docket No. RNZR-002W001TLS public key may be combined with other service-specific attributes such as TLS certificate serial number, computer name and / or domain name from the new technology local area network manager security service provide (NTLMSSP) handshake, etc.

[0068] Remote management system 130 may calculate a unique fingerprint for an asset by querying an HTTP protocol and calculating a hash from the HTTP headers and HTTP body of the first page received from the asset. The hash may be calculated from multiple portions of the HTTP response even in cases where multiple assets operate the same HTTP server software and HTTP interfaces.

[0069] Remote management system 130 may calculate a unique fingerprint for an asset by querying an SMB server and receiving an SMB v2 GUID. The hash may be calculated from the SMB v2 GUID alone, or may calculate the hash by combining the SMB v2 GUID with SMB protocol settings including if signing is required, compression methods used, etc.

[0070] Some or all of the above fingerprint calculations may be combined to create additional unique fingerprints.

[0071] If the network agent 120, remote management system 130, or external scanner 132 determines a vulnerability exists with respect to an asset, it may assign a confidence level to the vulnerability, consider the context of the detected fingerprint match including the type of service involved and whether the service is typically internet-facing, assign a risk score and severity / criticality to the vulnerability, and notify a user or software entity. For example, network agent 120 may create a vulnerability record for the finding, which may also include remediation advice or actions (e.g., enabling a firewall rule to block access to the exposed service from the public internet, disconnecting the affected asset from computer network 110, or other suitable remediation actions).

[0072] The severity and criticality assigned to a detected vulnerability may vary based on the service type and context. For example, if a matching TLS fingerprint is detected and the asset is identified as operating a web server (HTTP / HTTPS service), the vulnerability may be assigned a low severity or classified as informational, as web servers are often intentionally exposed to the Internet. However, if a matching fingerprint is detected for a Remote Desktop service (RDP), SSH service, or other service typically reserved for internal access, the vulnerability may be assigned a high or critical severity level, indicating that immediate remediation is necessary to prevent unauthorized access by malicious actors. Similarly, the detection of shared encryption keys may be assigned different severity levels depending onAttorney Docket No. RNZR-002W001 whether the sharing is between related systems under the same administrative control or between unrelated systems across different organizations. Network agent 120 or remote management system 130 may apply these context-based heuristics automatically when generating vulnerability records, enabling appropriate prioritization of remediation efforts.

[0073] Some or all of the functionality described herein may be performed by network agent 120, remote management system 130, external scanner 132, assets 112, or any suitable computing environment.

[0074] FIG. 2 illustrates a computing environment 200 in accordance with the present technology where functionality provided by network agent 120 is included in self-hosted service 220. Self-hosted service 220 may further include a database 222 configured to store information related to network 110 and assets 112 including a list of assets 112, fingerprints associated with respective assets 112, network status, API integrations, information provided by external services, scan results, detected vulnerabilities and potential vulnerabilities, and the like.

[0075] A user may manage network scanning and other functionality provided by self-hosted service 220 from one or more assets within computer network 110. In an aspect, all data except for software updates pertaining to functionality of self-hosted service 220 may be self- contained within a premises or physical location such as an office. This may provide the advantage of preventing sensitive security data from being transferred outside of an organization’s network, which may then become a target for malicious actors. The combined functionality of remote management system 130 and self-hosted service 220 may be substantially analogous to or the same as the combined functionality of remote management system 130 and network agent 120 as depicted in FIG. 1.

[0076] FIG. 3 illustrates a computing environment 300 including a central network 340 communicatively coupled to one or more remote networks 310-330 through respective VPN tunnels 314-334. For example, central network 340 may be communicatively coupled to remote network 310 through VPN tunnel 314; central network 340 may be communicatively coupled to remote network 320 through VPN tunnel 324; and central network 340 may be communicatively coupled to remote network 330 through VPN tunnel 334. Computing environment 300 may represent an instance of a central network 340 used to manage one or more remote networks located in satellite offices, retail locations, mobile worksites, or other suitable remote networks.Attorney Docket No. RNZR-002W001

[0077] Each network may include one or more respective assets. Remote network 310 may include a variety of assets 312a-h. Assets 312a-h may include a laptop 312a, desktop 312b, tablet 312, telephone 312d, server 312e, modem 312f, printer 312g, and projector 312h. Remote network 320 may include a variety of assets 322a-h. Assets 322a-h may include a laptop 322a, desktop 322b, tablet 322, telephone 322d, server 322e, modem 322f, printer 322g, and projector 322h. Remote network 330 may include a variety of assets 332a-h. Assets 332a-h may include a laptop 332a, desktop 332b, tablet 332, telephone 332d, server 332e, modem 332f, printer 332g, and projector 332h. Central network 340 may include a variety of assets 342a-h. Assets 342a-h may include a laptop 342a, desktop 342b, tablet 342, telephone 342d, server 342e, modem 342f, printer 342g, and projector 342h. Each asset of assets 312a-h, 322a-h, 332a-h, and 342a-h may include one or more such assets; for example, computer network 110 may include one or more servers 312e, two or more servers 312e, five or more servers 312e, ten or more servers 312e, 50 or more servers 312e, 100 or more servers 312e, 200 or more servers 312e, 500 or more servers 312e, 1000 or more servers 312e, 50,000 or more servers, 1,000,000 or more servers, or any plurality of servers 312e. Likewise, remote networks 320 and 330 may include corresponding numbers and / or distributions of assets 322 and 332. Central network 340 may include numbers and / or distributions of assets analogous to assets 112, 312, 322, and / or 332.

[0078] Network agent 120 and central network 340 may be located on premises 302 or disposed in separate locations. Network agent 120 and central network 340 may be communicatively coupled to each other, and a user may operate network agent 120 from central network 340, e.g., from an asset of assets 342. For example, a user may control the functionality of network agent 120 from a laptop 342a.

[0079] VPN tunnels 314, 324, and 334 may enable secure transfer of data to and from each of remote network 310, remote network 320, and / or remote network 330. Having a secure source of information transfer may allow a user or software program to remotely monitor assets included in each network, keep track of which assets are connected to each network, identify and track fingerprints for assets on each network, and the like.

[0080] A user may utilize this remote connection functionality to monitor dynamic or ad hoc networks, which may change or move and therefore preclude a consistent connection. Further, this remote connectivity may enable management, monitoring, and vulnerability remediation of a plurality of networks that may not share similar physical locations (e.g., if remote networkAttorney Docket No. RNZR-002W001310 is located in Seattle, WA, remote network 320 is located in Austin, TX, and remote network 330 is located in Atlanta, GA).

[0081] FIG. 4 illustrates a computing environment 400 utilizing passive traffic sampling in accordance with the present technology. Passive network analysis in computing environment 400 may operate by analyzing a copy of network traffic rather than inline interception, thereby avoiding any impact on network latency or throughput. Network agent 120 may receive mirrored or copied traffic through a SPAN port, network tap, or other traffic duplication mechanism that does not insert network agent 120 into the active data path. Because network agent 120 processes copied traffic rather than original traffic, no additional delay is introduced into communications between assets or between assets and external networks. This passive approach enables fingerprint extraction from passing traffic from remote network 310 and remote network 320. TCP / IP traffic from assets on remote network 310 and / or remote network 320 may be fed to network agent 120 through a router, modem, switched-port analyzer (SPAN), or other suitable routing device.

[0082] FIG. 4 illustrates traffic from assets on remote network 310 routed through SPAN 450 to network agent 120. Network agent 120 may analyze the traffic from remote network 310 to maintain or update a list of assets included in remote network 310, to ensure traffic is being sent to legitimate and / or authorized destinations, and the like. Network agent 120 may use the routed traffic to identify one or more fingerprints associated with assets 312 on remote network 310.

[0083] Traffic from assets on remote network 320 may be routed through router 460 to network agent 120, which may then route the network traffic to a destination. Alternatively, network agent 120 may simply scan the traffic from remote network 320 as it passes through and perform monitoring, asset identification, fingerprinting, or other functionality as highlighted above.

[0084] FIG. 5 is a flowchart of an example method 500 of managing an asset on a computer network. Method 500 may be performed by any suitable system or device disclosed herein. Method 500 includes blocks 510-560. Any of blocks 510-560 may be performed by network agent 120, remote management system 130, external scanner 132, or a suitable configured asset of assets 112.Attorney Docket No. RNZR-002W001

[0085] Block 510 includes interrogating an asset using a query associated with a transmission control protocol / intemet protocol (TCP / IP) service. The TCP / IP service may be selected from at least one of SSH, SNMP, CIFS, HTTP, TLS, or RDP.

[0086] Block 520 includes receiving asset-specific attributes from the asset in response to the query. The asset-specific attributes may include at least one of a protocol type, a protocol field, the TCP / IP service, a calculated unique hash, software information associated with the asset, or hardware information associated with the asset.

[0087] Block 530 includes creating a first fingerprint for the asset based on the asset-specific attributes. The first fingerprint may include generating a unique hash based on the assetspecific attributes. The first fingerprint for the asset may include data defined by the TCP / IP service. Creating the first fingerprint for the asset may include combining each attribute of the asset-specific attributes to create a unique hash. Creating the first fingerprint for the asset may include creating a plurality of unique fingerprints based on a plurality of services associated with a corresponding plurality of ports.

[0088] Block 540 includes detecting the first fingerprint for the asset at a plurality of IP addresses based on a scan of publicly routable IP addresses. Detecting the first fingerprint for the asset comprises performing the scan of publicly routable IP addresses, detecting the first fingerprint for the asset may further include storing fingerprints of assets at publicly routable IP addresses in a database. The database may be instantiated within the computer network and may then be queried for the first fingerprint for the asset in order to determine that the database includes the first fingerprint for the asset. Querying the database for the first fingerprint for the asset may include searching the database from within the network. Detecting the first fingerprint for the asset may further include querying a server with a first portion of the first fingerprint for the asset. Detecting the first fingerprint for the asset may further include receiving, for assets at publicly routable IP addresses, a list of fingerprints matching the first portion of the first fingerprint and determining that the list comprises the first fingerprint for the asset.

[0089] The scan of publicly routable IP addresses may include identifying publicly routable IP addresses. For each publicly routable IP address, an attempt is made to elicit a response from a TCP / IP service. For each elicited response, one or more services at that IP address may be queried to obtain specific protocol fields used to create the first fingerprint for the asset. AAttorney Docket No. RNZR-002W001 fingerprint may be derived for each established connection based on the specific protocol fields.

[0090] Block 550 includes identifying a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the plurality of IP addresses. The plurality of IP addresses may be located within networks having different security boundaries. For example, the first fingerprint may be detected at a first IP address of a first computer network such as an organization’s internal secure network and at a second IP address of a network external to the organization. Additionally or alternatively, the first fingerprint may be detected at a first IP address of a first computer network such as an organization’s internal secure network and at a second IP address within the organization’s internal guest network. A second IP address of the plurality of IP addresses may be publicly routable, e.g., accessible on the Internet.

[0091] Block 560 includes remediating the vulnerability of the computer network. Remediating the vulnerability may include restricting data transfer for a service operated by the asset. Restricting data transfer for a service operated by the asset may include implementing a firewall rule or disabling a network interface of the asset (e.g., a cellular modem, ethemet interface, etc.). Remediating the vulnerability may include notifying a user of one or more actions to mitigate the vulnerability. Remediating the vulnerability may include exchanging information with, receiving information from, or sending information to one or more EDR services, one or more virtualization services, one or more vulnerability management services, one or more SOAR services, ITSM services, one or more SIEM services, or any suitable service. Remediating the vulnerability may include generating, updating, or adding to a vulnerability record. For example, a record of existing vulnerabilities may be updated if a new vulnerability is found.

[0092] FIG. 6 is a flowchart of a method 600 in accordance with the present technology. Method 600 may be performed by any suitable system or device disclosed herein. Method 600 includes blocks 610-660. For example, any of blocks 610-660 may be performed by network agent 120, remote management system 130, external scanner 132, or a suitable configured asset of assets 112.

[0093] Block 610 includes interrogating an asset using a query associated with a TCP / IP service, the TCP / IP service comprising at least one of SSH, SNMP, CIFS, HTTP, TLS, or RDP.

[0094] Block 620 includes receiving asset-specific attributes in response to the query, the assetspecific attributes comprising at least one confidential asset-specific attribute and based on atAttorney Docket No. RNZR-002W001 least one of a protocol type, a protocol field, a cryptographic hash, a media access control (MAC) address, software information associated with the asset, or hardware information associated with the asset.

[0095] Block 630 includes creating a first fingerprint for the asset based on the asset-specific attributes. The first fingerprint may include generating a unique hash based on the assetspecific attributes. The first fingerprint for the asset may include data defined by the TCP / IP service. Creating the first fingerprint for the asset may include combining each attribute of the asset-specific attributes to create a unique hash. Creating the first fingerprint for the asset may include creating a plurality of unique fingerprints based on a plurality of services associated with a corresponding plurality of ports.

[0096] Block 640 includes detecting the first fingerprint for the asset at a plurality of IP addresses based on a scan of publicly routable IP addresses. Detecting the first fingerprint for the asset comprises performing the scan of publicly routable IP addresses, detecting the first fingerprint for the asset may further include storing fingerprints of assets at publicly routable IP addresses in a database. The database may be instantiated within the computer network and may then be queried for the first fingerprint for the asset in order to determine that the database includes the first fingerprint for the asset. Querying the database for the first fingerprint for the asset may include searching the database from within the network. Detecting the first fingerprint for the asset may further include querying a server with a first portion of the first fingerprint for the asset. Detecting the first fingerprint for the asset may further include receiving, for assets at publicly routable IP addresses, a list of fingerprints matching the first portion of the first fingerprint and determining that the list comprises the first fingerprint for the asset.

[0097] Block 650 includes identifying a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the plurality of IP addresses. The plurality of IP addresses may be located within networks having different security boundaries. For example, the first fingerprint may be detected at a first IP address of a first computer network such as an organization’s internal secure network and at a second IP address of a network external to the organization. Additionally or alternatively, the first fingerprint may be detected at a first IP address of a first computer network such as an organization’s internal secure network and at a second IP address within the organization’s internal guest network. A second IP address of the plurality of IP addresses may be publicly routable, e.g., accessible on the Internet.Attorney Docket No. RNZR-002W001

[0098] Block 660 includes remediating the vulnerability of the computer network. Remediating the vulnerability may include restricting data transfer for a service operated by the asset. Restricting data transfer for a service operated by the asset may include implementing a firewall rule or disabling a network interface of the asset. Remediating the vulnerability may include notifying a user of one or more actions to mitigate the vulnerability. Remediating the vulnerability may include exchanging information with, receiving information from, or sending information to one or more EDR services, one or more virtualization services, one or more vulnerability management services, one or more SOAR services, ITSM services, one or more SIEM services, or any suitable service. Remediating the vulnerability may include generating, updating, or adding to a vulnerability record. For example, a record of existing vulnerabilities may be updated if a new vulnerability is found.Conclusion

[0099] While various inventive embodiments have been described and illustrated herein, those of ordinary skill in the art will readily envision a variety of other means and / or structures for performing the function and / or obtaining the results and / or one or more of the advantages described herein, and each of such variations and / or modifications is deemed to be within the scope of the inventive embodiments described herein. More generally, those skilled in the art will readily appreciate that all parameters, dimensions, materials, and configurations described herein are meant to be exemplary and that the actual parameters, dimensions, materials, and / or configurations will depend upon the specific application or applications for which the inventive teachings is / are used. Those skilled in the art will recognize or be able to ascertain, using no more than routine experimentation, many equivalents to the specific inventive embodiments described herein. It is, therefore, to be understood that the foregoing embodiments are presented by way of example only and that, within the scope of the appended claims and equivalents thereto, inventive embodiments may be practiced otherwise than as specifically described and claimed. Inventive embodiments of the present disclosure are directed to each individual feature, system, article, material, kit, and / or method described herein. In addition, any combination of two or more such features, systems, articles, materials, kits, and / or methods, if such features, systems, articles, materials, kits, and / or methods are not mutually inconsistent, is included within the inventive scope of the present disclosure.

[0100] Also, various inventive concepts may be embodied as one or more methods, of which an example has been provided. The acts performed as part of the method may be ordered in any suitable way. Accordingly, embodiments may be constructed in which acts are performedAttorney Docket No. RNZR-002W001 in an order different than illustrated, which may include performing some acts simultaneously, even though shown as sequential acts in illustrative embodiments.

[0101] All definitions, as defined and used herein, should be understood to control over dictionary definitions, definitions in documents incorporated by reference, and / or ordinary meanings of the defined terms.

[0102] The indefinite articles “a” and “an,” as used herein in the specification and in the claims, unless clearly indicated to the contrary, should be understood to mean “at least one.”

[0103] The phrase “and / or,” as used herein in the specification and in the claims, should be understood to mean “either or both” of the elements so conjoined, i.e., elements that are conjunctively present in some cases and disjunctively present in other cases. Multiple elements listed with “and / or” should be construed in the same fashion, i.e., “one or more” of the elements so conjoined. Other elements may optionally be present other than the elements specifically identified by the “and / or” clause, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, a reference to “A and / or B”, when used in conjunction with open-ended language such as “comprising” can refer, in one embodiment, to A only (optionally including elements other than B); in another embodiment, to B only (optionally including elements other than A); in yet another embodiment, to both A and B (optionally including other elements); etc.

[0104] As used herein in the specification and in the claims, “or” should be understood to have the same meaning as “and / or” as defined above. For example, when separating items in a list, “or” or “and / or” shall be interpreted as being inclusive, i.e., the inclusion of at least one, but also including more than one, of a number or list of elements, and, optionally, additional unlisted items. Only terms clearly indicated to the contrary, such as “only one of’ or “exactly one of,” or, when used in the claims, “consisting of,” will refer to the inclusion of exactly one element of a number or list of elements. In general, the term “or” as used herein shall only be interpreted as indicating exclusive alternatives (i.e. “one or the other but not both”) when preceded by terms of exclusivity, such as “either,” “one of,” “only one of,” or “exactly one of.” “Consisting essentially of,” when used in the claims, shall have its ordinary meaning as used in the field of patent law.

[0105] As used herein in the specification and in the claims, the phrase “at least one,” in reference to a list of one or more elements, should be understood to mean at least one element selected from any one or more of the elements in the list of elements, but not necessarilyAttorney Docket No. RNZR-002W001 including at least one of each and every element specifically listed within the list of elements and not excluding any combinations of elements in the list of elements. This definition also allows that elements may optionally be present other than the elements specifically identified within the list of elements to which the phrase “at least one” refers, whether related or unrelated to those elements specifically identified. Thus, as a non-limiting example, “at least one of A and B” (or, equivalently, “at least one of A or B,” or, equivalently “at least one of A and / or B”) can refer, in one embodiment, to at least one, optionally including more than one, A, with no B present (and optionally including elements other than B); in another embodiment, to at least one, optionally including more than one, B, with no A present (and optionally including elements other than A); in yet another embodiment, to at least one, optionally including more than one, A, and at least one, optionally including more than one, B (and optionally including other elements); etc.

[0106] In the claims, as well as in the specification above, all transitional phrases such as “comprising,” “including,” “carrying,” “having,” “containing,” “involving,” “holding,” “composed of,” and the like are to be understood to be open-ended, i.e., to mean including but not limited to. Only the transitional phrases “consisting of’ and “consisting essentially of’ shall be closed or semi-closed transitional phrases, respectively, as set forth in the United States Patent Office Manual of Patent Examining Procedures, Section 2111.03.

Claims

Attorney Docket No. RNZR-002W001CLAIMS1. A method of managing an asset on a computer network, the method comprising: interrogating the asset from inside the computer network using a query associated with a transmission control protocol / intemet protocol (TCP / IP) service; receiving asset-specific attributes from the asset in response to the query; creating a first fingerprint for the asset based on the asset-specific attributes; detecting the first fingerprint for the asset at one or more IP addresses based on a scan of publicly routable IP addresses; identifying a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the one or more IP addresses; and remediating the vulnerability of the computer network.

2. The method of claim 1, wherein the asset-specific attributes comprise at least one of a protocol type, a protocol field, the TCP / IP service, a media access control (MAC) address, a calculated hash, software information associated with the asset, or hardware information associated with the asset.

3. The method of claim 2, wherein the TCP / IP service is selected from at least one of secure shell (SSH), simple network management protocol (SNMP), common internet filesystem (CIFS), hypertext transport protocol (HTTP), transport layer security (TLS), or remote desktop (RDP).

4. The method of claim 1, wherein creating the first fingerprint for the asset comprises generating a unique hash based on one or more of the asset-specific attributes.

5. The method of claim 1, wherein the first fingerprint for the asset comprises data defined by the TCP / IP service.

6. The method of claim 1, wherein creating the first fingerprint for the asset comprises combining each attribute of the asset-specific attributes to create a unique hash.Attorney Docket No. RNZR-002W0017. The method of claim 1, wherein creating the first fingerprint for the asset comprises creating a plurality of unique fingerprints based on a plurality of services associated with a corresponding plurality of ports of the asset.

8. The method of claim 1, wherein detecting the first fingerprint for the asset comprises performing the scan of publicly routable IP addresses.

9. The method of claim 1, wherein detecting the first fingerprint for the asset further comprises: storing fingerprints of assets at publicly routable IP addresses in a database; instantiating the database within the computer network; querying the database for the first fingerprint for the asset; and determining that the database comprises the first fingerprint for the asset.

10. The method of claim 9, wherein querying the database for the first fingerprint for the asset comprises searching the database from within the network.

11. The method of claim 1, wherein detecting the first fingerprint for the asset comprises: querying a server with a first portion of the first fingerprint for the asset; receiving, for assets at publicly routable IP addresses, a list of fingerprints that match the first portion of the first fingerprint; and determining that the list comprises the first fingerprint for the asset.

12. The method of claim 1, further comprising performing the scan of publicly routable IP addresses by: identifying publicly routable IP addresses; for each publicly routable IP address, attempting to elicit a response from a TCP / IP service; for each elicited response, querying one or more services at that IP address to obtain specific protocol fields used to create the first fingerprint for the asset; and deriving a fingerprint for each established connection based on the specific protocol fields.Attorney Docket No. RNZR-002W00113. The method of claim 1, wherein remediating the vulnerability comprises restricting data transfer for a service operated by the asset.

14. The method of claim 13, wherein restricting data transfer for a service operated by the asset comprises implementing a firewall rule or disabling a network interface of the asset.

15. The method of claim 1, wherein remediating the vulnerability comprises notifying a user of one or more actions to mitigate the vulnerability.

16. A method of managing an asset on a computer network, the method comprising: interrogating the asset using a query associated with a transmission control protocol / internet protocol (TCP / IP) service, the TCP / IP service comprising at least one of secure shell (SSH), simple network management protocol (SNMP), common internet filesystem (CIFS), hypertext transport protocol (HTTP), transport layer security (TLS), or remote desktop (RDP); receiving asset-specific attributes in response to the query, the asset-specific attributes comprising at least one confidential asset-specific attribute and based on at least one of a protocol type, a protocol field, a cryptographic hash, a media access control (MAC) address, software information associated with the asset, or hardware information associated with the asset; creating a first fingerprint for the asset based on the asset-specific attributes; detecting the first fingerprint for the asset at a plurality of internet protocol (IP) addresses based on a scan of publicly routable IP addresses; identifying a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the plurality of IP addresses; and remediating the vulnerability of the computer network.

17. The method of claim 16, wherein detecting the first fingerprint for the asset comprises: querying a server with a first portion of the first fingerprint for the asset; receiving, for assets at publicly routable IP addresses, a list of fingerprints that match the first portion of the first fingerprint; and determining that the list comprises the first fingerprint for the asset.Attorney Docket No. RNZR-002W00118. The method of claim 16, wherein remediating the vulnerability comprises restricting data transfer for a service operated by the asset.

19. A network agent, the network agent comprising: a processor, and a memory containing instructions configuring the processor to: interrogate an asset on a computer network using a query associated with a transmission control protocol / intemet protocol (TCP / IP) service; receive asset-specific attributes in response to the query; create a first fingerprint for the asset based on the asset-specific attributes; detect the first fingerprint for the asset at a plurality of internet protocol (IP) addresses based on a scan of publicly routable internet protocol (IP) addresses; identify a vulnerability of the computer network in response to detecting the first fingerprint for the asset at the plurality of IP addresses; and remediate the vulnerability of the computer network.

20. The network agent of claim 19, wherein detecting the first fingerprint for the asset comprises: querying a server with a first portion of the first fingerprint for the asset; receiving, for assets at publicly routable IP addresses, a list of fingerprints that match the first portion of the first fingerprint; and determining that the list comprises the first fingerprint for the asset.

Images