SYSTEMS AND METHODS FOR DETECTING VULNERABILITIES AND PRIVILEGED ACCESS USING CLUSTER MOVEMENT

摘要

Systems and methods for detecting vulnerabilities and/or privileged access are disclosed. In some embodiments, a computerized method comprises receiving asset information for each of a plurality of assets, the assets connected to a network; clustering the assets into a plurality of cluster nodes based on the asset information, each of the assets being clustered in one of the cluster nodes, at least a first asset being clustered in a particular one of the cluster nodes; receiving one or more events associated with the first asset; remapping the first asset to a different one of the cluster nodes based on the asset information of the first asset and the one or more events associated with the first asset; calculating a distance between the particular cluster node and the different cluster node; and triggering one or more actions based on the distance between the particular cluster node and the different cluster node.

主权项

1. A computerized method comprising:
receiving, at a security system, asset information for each of a plurality of assets, the security system and the plurality of assets connected to a communication network; clustering, at the security system, the plurality of assets into a plurality of cluster nodes based on the asset information, each of the plurality of assets being clustered in one of the plurality of cluster nodes, at least a first asset of the plurality of assets being clustered in a particular one of the plurality of cluster nodes; receiving, at the security system, one or more events associated with the first asset; remapping, at the security system, the first asset to a different one of the plurality of cluster nodes based on the asset information of the first asset and the one or more events associated with the first asset; calculating, at the security system, a distance between the particular one of the plurality of cluster nodes and the different one of the plurality of cluster nodes; and triggering, at the security system, one or more actions based on the distance between the particular one of the plurality of cluster nodes and the different one of the plurality of cluster nodes.