REAL-TIME IDENTIFICATION OF AN ASSET MODEL AND CATEGORIZATION OF AN ASSET TO ASSIST IN COMPUTER NETWORK SECURITY

摘要

.LAMBDA. unique identifier is assigned to a network node and is used to o btain an "asset model" corresponding to the node and to determine whether th e node is a member of a particular category. An asset model is a set of info rmation about a node (e.g., the node's role within the enterprise, software installed on the node, and known vulnerabilities/weaknesses of the node). An identifier lookup module determines a node's identifier based on characteri stics of the node (such as [P address., host name, network zone, and/or MAC address), which are used as keys into lookup data structures. A category loo kup module determines whether a particular node is a member of (i.e., within ) a particular category using a transitive closure to model the categories ( properties) that can be attached to an asset model. A transitive closure for a particular asset category is stored as a bitmap, similar to bitmap indexi ng.