THREAT EXPOSURE MANAGEMENT SYSTEM USING LARGE LANGUAGE MODELS

A system and method of using generative AI to identify exposures of computing devices on computing networks to actual and/or potential threats. The method includes collecting a plurality of responses from a plurality of devices to a target device on a private network. The method includes providing the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data. The method includes assigning, by the processing device using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions. The method includes generating, based on the plurality of device descriptions, a status report comprising a list of network addresses associated with a group of devices having access to the target device.

TECHNICAL FIELD

The present disclosure relates generally to cyber security, and more particularly, to systems and methods of using generative artificial intelligence (AI), such as large language models (LLMs), to identify exposures of assets, such as computing devices, on computing networks to actual and/or potential threats.

BACKGROUND

Cybersecurity is the practice of protecting critical systems and sensitive information from digital attacks. Cybersecurity techniques are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside of an organization.

DETAILED DESCRIPTION

An asset cloud is a centralized digital storage facility that operates over the internet. The vast majority of businesses today use either cloud software or cloud services for keeping track of company equipment, also referred to assets. An asset includes the hardware (e.g., computing devices, databases, and/or the like), software (e.g., applications, firewalls, and/or the like), and networking entities (e.g., routers, switches, and/or the like) that a company has as tools and resources for their objectives. External Attack Surface Management (EASM) tools constantly uncover internet exposed assets belonging to customers while querying exposed ports from the entire addressable Internet. These EASM tools iteratively query the entire addressable internet by trying to send requests over all possible ports by leveraging the most used protocols. Each time they get a valid response (as opposed to an error message), this equates to a port being open and accessible and thus an asset being exposed. Indeed, not all assets are exposed accidentally because some of them might serve a specific purpose.

To identify the specific assets that are accidentally exposed, one must analyze the response they get back to a particular request and study its contents (e.g., the contents of a Hyper Text Transfer Protocol Secure (HTTP/S) response). This is a slow process often resulting in severe inaccuracies because Internet Protocol (IP) addresses change dynamically over time, and there is a time delta between the moment an item is discovered and the time it can be processed. Consequently, an asset that is discovered at a particular IP address might not be at that IP address a few moments later, so the asset can no longer be directly assigned to an asset inside a customer's environment. Some conventional systems have tried to use regex rules to churn through these responses but have failed because of the difficulty of analyzing large sets of unstructured data.

For these reasons, assigning assets to a particular customer and being able to flag the issue to the appropriate customer is still a difficult problem for the conventional EASM systems. Moreover, explaining what exact asset needs to be fixed and what team it belongs to is also a hard problem to solve, especially if the company and/or team name is not explicitly written in the retrieved response.

Aspects of the present disclosure address the above-noted and other deficiencies by using generative artificial intelligence (e.g., LLMs, Recurrent Neural Network, text generating model based on diffusion techniques) to identify exposures of computing devices on computing networks to actual and/or potential threats. Although the present disclosure is applicable to various types of artificial intelligence models, for simplicity, the remainder of this disclosure will describe the present embodiments using LLMs. That is, any type of artificial intelligence model may be used in place of an LLM in any of the present embodiments.

The present disclosure provides a mechanism for using an LLM which takes as input a plurality of responses gathered from a pass over the addressable internet and is able to generate a set of assignments/explanations for each of these responses containing information meant to help attribute an exposed asset to a set of topics. These topics can directly represent potential customers, or they can describe business verticals/industry segments as well as the specific department of a particular organization whose confidential data are exposed on the internet and many others. The generated output can either help to directly attribute a particular response to a specific customer and department or it can help narrow down the pool of customers to go over and manually/semi-automatically check given any particular information the system can extract around them from the response (e.g., business sector, business size, organizational culture, country of origin, document topics, document types, languages used, asset type, asset functionality etc.). Additionally the same assignment can be periodically constructed from within the customer's environment such as when the time to match devices (e.g., mobile phones, s3 buckets, servers, etc.) from within an organization to devices identified from outside that organizations' environment, the matching process could be done almost instantaneously either by matching on the same topics/descriptions given to a particular asset or via embeddings generated for these assets based on available information. Moreover, given a list of assets for which the customer would like to investigate the external attack surface, an LLM agent could appropriately assign these assets to external discovered assets based on their characteristics. If additional protocols want to be tested out, an LLM can also help with generating code to create some request which follow the desired protocol's format and structure. Customers could also benefit from a breakdown of their exposed assets by department in order to be able to enforce proactive measures and additional training in the parts of the organization which stand to benefit most from them. Being able to correlate information from both inside and outside the organization based on the content exposed to the internet also represents another way in which internet exposed assets can be assigned to particular customers

In an illustrative embodiment, a threat exposure management (TEM) system collects a plurality of responses from a plurality of devices to a target device on a private network. The TEM provides the plurality of responses to a classification model (e.g., LLM) trained to assign device descriptions for device responses based on semantic matching of the device responses to database data. Each device description may indicate one or more of a company name, a business vertical, a device type (e.g., smartphone, laptop, and/or the like), or a department name. The TEM assigns, using the classification model, a plurality of device descriptions for the plurality of responses to the target device. Each response is respectively associated with one or more device descriptions of the plurality of device descriptions. The TEM generates, based on the plurality of device descriptions, a status report that includes a list of network addresses that are associated with a group of devices that have access to the target device. A device has access to the target device if the device can communicate with the target device, access a storage of the target device, and/or use the access rights/privileges (e.g., rights to access secured data and/or resources) of the target device. In other words, the status report identifies the exposures that the target device has to actual and/or potential threats as a result of being connected to one or more computing networks.

FIG.1is a block diagram depicting an example environment for using generative artificial intelligence to identify exposures of computing devices on computing networks to actual and/or potential threats, according to some embodiments. The environment100includes and/or executes a threat exposure management (TEM) system (sometimes referred to as External Attack Surface Management Investigator)104, a private network system102(e.g., a corporate network, a local area network (LAN), a wide area network (WAN), a personal area network (PAN)) and a public network system106(e.g., the internet). The private network system102includes client devices101(e.g., client device101a,101b,101c,101d) and an administrative device105(shown inFIG.1as admin device) that are communicably coupled together via a private communication network of the private network system102. The public network system106includes client devices101(e.g., client devices101e,101f,101g) that are communicably coupled together via a public communication network of the public network system106. The client devices101of the private network system102, the administrative device105of the private network system102, and the client devices101of the public network system106are each communicably coupled to the TEM system104.

The TEM system104includes and/or executes a TEM agent108, a classification model109, a port scanning agent110, an indexed database111, and a threat candidates database112. The TEM agent108stores, in the indexed database111, a plurality of device responses that are each respectively associated (e.g., linked) with one or more device descriptions (e.g., tags, labels). For example,FIG.1shows that the indexed database111includes response 1 (abbreviated as resp 1) that is linked to a first set of tags (“tags A”); response 2 that is linked to a second set of tags (“tags B”); response 3 that is linked to a third set of tags (“tags C”); and up to response N that is linked to an nth set of tags (“tags N”).

The TEM agent108stores, in the threat candidates database112, a plurality of threat candidates that each indicate one or more network addresses of devices that have access to one or more client devices101(client device101a) of the private network system102. In some embodiments, the classification model190may be a large language model (LLM) that uses generative AI techniques. An LLM is, for example, deep learning algorithms that can recognize, summarize, translate, predict, and/or generate content using very large datasets.

In some embodiments, the TEM agent108deploys a sensor onto each of the client devices101of the private network system102by sending (e.g., broadcasting) messages to the client devices101. The messages cause the client devices101to install the sensor onto its own resources (e.g., memory, storage, processor). For example, client device101ainstalls sensor103a, client device101binstalls sensor103b, client device101cinstalls sensor103c, and client device101dinstalls sensor103d(each collectively referred to as, sensors103).

In some embodiments, the TEM agent108does not need to deploy a sensor onto each of the client device101, but instead can leverage an already existing and deployed sensor103which is also configured to send the necessary telemetry data for the TEM agent108to function.

A client device101on the private network system102may send a request (shown inFIG.1as internal request) to one or more client devices101(client devices101b-101d) of the private network system102to cause each of the client devices101b-101dto send a response (shown inFIG.1as internal response) back to client device101a. A client device101on the private network system102may also send a request (shown inFIG.1as external request) to one or more client devices101(client devices101e-101f) of the public network system106to cause each of the client devices101e-101fto send a response (shown inFIG.1as external response) back to client device101a.

Each sensor103is configured to monitor (e.g., track) and detect each communication (e.g., transmission/transmit, reception/receive) between the client device101in which the sensor103is installed and the other client devices101on the private network system102and/or the public network system106. Each communication includes a header (e.g., source network address, destination network address, and/or the like) and a message body (e.g., text, code, etc.). The sensor103also assigns a time stamp to each communication and records (e.g., stores) the communication in a local storage (e.g., memory, database, cache) of the respective client device101. Therefore, each client device101may use its sensor103to keep track of network addresses (e.g., internet protocol (IP) address, Media Access Control (MAC) address, telephone number, and/or the like) of the client devices101on the private network system102and/or the public network system106that are currently communication with the client device101and/or have previously communicated (sometimes referred to as historical communication) with the client device101.

Each of the client devices101(client devices101a-101d) of the private network system102periodically sends its locally stored records of communication to the TEM agent108, which in turn, stores the records of communication in the indexed database111. Again, the stored records of communication that the TEM agent108receives from a particular client device (e.g., client device101a) include (a) the requests and responses that the particular client device has sent to and received from other client devices (e.g., client devices101b-101d) in the private network system102, and/or (b) the requests and responses that the particular client device has sent to and received from other client devices (e.g., client devices101e-101g) in the public network system106.

The port scanning agent110may perform a port scanning of the public network system106across one or more communication protocols (e.g., Hyper Text Transfer Protocol Secure (HTTP/HTTPS), File Transfer Protocol (FTP), Remote Procedure Call (RPC), and/or the like) to discover the network addresses of one or more client devices101that are currently connected to the public network of the public network system106. These “online” devices may also be simultaneously connected to the private network system102. For example, client device101amay have a first connection to the private network of the private network system102and a second connection to the public network of the public network system106.

The TEM agent108, in some embodiments, uses training data to train the classification model109to generate and/or assign device descriptions (e.g., tags, descriptions, labels) for device responses based on semantic matching of the device responses to database data. The training data may include a portion or all portions of the database data of the indexed database111and/or the threat candidates database112. The TEM agent108may then use the classification model109, now trained, to generate and/or assign device descriptions for the records of communication (e.g., requests, responses) that the TEM agent108receives from the client device101.

A communication network (e.g., private communication network of private network system102and/or public communication network of public network system106) may include a wired or a wireless infrastructure, which may be provided by one or more wireless communications systems, such as wireless fidelity (Wi-Fi) connectivity to the communication network and/or a wireless carrier system that can be implemented using various data processing equipment, communication towers (e.g., cell towers), etc. The communication network may carry communications (e.g., data, message, packets, frames, etc.) between any other the computing device.

Still referring toFIG.1, the TEM agent108collects a plurality of responses from a plurality of client devices101to the client device101a(e.g., sometimes referred to as, target device) on the private network system102. The TEM agent108provides the plurality of responses to a classification model109trained to assign device descriptions for device responses based on semantic matching of the device responses to data stored in a database (e.g., indexed database111, and/or threat candidates database112). Each device description may indicate one or more of a company name, a business vertical, a device type, or a department name. The TEM agent108assigns, using the classification model, a plurality of device descriptions for the plurality of responses to the client device101a. Each response is respectively associated with one or more device descriptions of the plurality of device descriptions.

The TEM agent108generates, based on the plurality of device descriptions, a status report that includes a list of network addresses that are associated with a group of devices that have access to the client device101a. The TEM agent108may generate a status report that excludes the client devices101that once had access to the client device101a, but no longer does at the time of generating the status report. For example, the TEM agent108generates the status report by identifying, based on the port scanning results, one or more offline devices that are associated with one or more responses of the plurality of responses. The TEM agent108excludes one or more network addresses of the one or more offline devices from the list of network addresses. A device has access to the client device101aif the device can communicate with the client device101a, access a storage of the client device101a, and/or use the access rights/privileges (e.g., rights to access secured data and/or resources) of the client device101a.

The TEM agent108may generate one or more natural language strings including the one or more device descriptions of the plurality of device descriptions. The TEM agent108may include the one or more natural language strings in the status report. In some embodiments, the TEM agent108may include the one or more device descriptions of the plurality of device descriptions in the status report in a list format, instead of a natural language format.

AlthoughFIG.1shows only a select number of computing devices (e.g., TEM system104, client devices101, admin devices105) and private network systems; the environment100may include any number of computing devices and private network systems that are interconnected in any arrangement to facilitate the exchange of data between the computing devices and the private network systems.

FIG.2Ais a block diagram depicting an example environment for training a classification model to generate and assign device descriptions to device responses based on semantic matching of the device responses to database data, according to some embodiments. Each of the components inFIG.1Bmay be included in the TEM system104inFIG.1. For example, the LLM209amay correspond to the classification model109inFIG.1. The internal response contents may correspond to the internal responses discussed with respect toFIG.1, and the external response contents may correspond to external response discussed with respect toFIG.1. The TEM agent108trains the LLM209ato generate and/or assign device descriptions for device responses based on semantic matching of the device responses to database data. The training data may include a portion or all portions of the database data of the indexed database111and/or the threat candidates database112.

FIG.2Bis a block diagram depicting an example environment for using the LLM inFIG.2Ato identify exposures of computing devices on computing networks to actual and/or potential threats, according to some embodiments. Each of the components inFIG.2Bmay be included in the TEM system104inFIG.1. For example, the LLM209may correspond to the classification model109inFIG.1. In some embodiments, the TEM system104may use a single LLM to process the private responses and the public responses. In some embodiments, LLM209and/or LLM210bmay correspond to LLM109inFIG.1. A public response may be a response that originates from a client device (e.g., any of client devices101e-101g) that is connected to the public network system106. A private response may be a response that originates from a client device (e.g., any of the client devices101b-101d) that is connected to the private network system102. In some embodiments, the TEM system104may use a first LLM209bto process the private responses and a second LLM210bto process the public responses.

The one or more LLMs store their outputs in the indexed database211b(e.g., indexed database111inFIG.1), the TEM agent108inFIG.1is used to generate one or more threat candidates. As shown inFIG.1, the threat candidates may include an indication of one or more customers most likely (e.g., top x-number of customers) to be associated with the client device101a, an indication of one or more customer departments most likely to be associated with the client device101a; and/or an indication of one or more customer devices most likely belonging to the one or more customers. The TEM agent108includes the threat candidates in a status report.

FIG.3Ais a block diagram depicting an example of the threat exposure management (TEM) system inFIG.1, according to some embodiments. While various devices, interfaces, and logic with particular functionality are shown, it should be understood that the TEM system104includes any number of devices and/or components, interfaces, and logic for facilitating the functions described herein. For example, the activities of multiple devices may be combined as a single device and implemented on the same processing device (e.g., processing device302a), as additional devices and/or components with additional functionality are included.

The TEM system104includes a processing device302a(e.g., general purpose processor, a PLD, etc.), which may be composed of one or more processors, and a memory304a(e.g., synchronous dynamic random-access memory (DRAM), read-only memory (ROM)), which may communicate with each other via a bus (not shown).

The memory304a(e.g., Random Access Memory (RAM), Read-Only Memory (ROM), Non-volatile RAM (NVRAM), Flash Memory, hard disk storage, optical media, etc.) of processing device302astores data and/or computer instructions/code for facilitating at least some of the various processes described herein. The memory304aincludes tangible, non-transient volatile memory, or non-volatile memory. The memory304astores programming logic (e.g., instructions/code) that, when executed by the processing device302a, controls the operations of the TEM system104. In some embodiments, the processing device302aand the memory304aform various processing devices and/or circuits described with respect to the TEM system104. The instructions include code from any suitable computer programming language such as, but not limited to, C, C++, C #, Java, JavaScript, VBScript, Perl, HTML, XML, Python, TCL, and Basic.

The processing device302aexecutes a TEM agent108, a classification model109, and a port scanning agent110. The TEM system104includes an indexed database111and a threat candidates database112. In some embodiments, any of the TEM agent108, the classification model109, and the port scanning agent110may be combined into a single entity that includes the functions and features of its individual parts.

The TEM agent108may be configured to collect a plurality of responses from a plurality of client devices101that are sent to the client device101a(e.g., target device) on the private network system102. For example, the TEM agent108may send a request to the client device101a(e.g., a target device) to cause the client device101ato perform a port scanning procedure on its own ports to discover one or more assets (and their corresponding device identifier, such as a MAC address and/or IP address) that have access to the client device101a. An asset (e.g., a client device) has access to the client device101aif the asset can communicate (e.g., send and/or receive messages) with the client device101a. The client device101asends the results of the port scanning procedure to the TEM agent108.

The TEM agent108may be configured to provide the plurality of responses to the classification model109. The TEM agent108may be configured to train the classification model109to assign device descriptions for client device101responses based on semantic matching of the device responses to database data. The TEM agent108may be configured to assign, using the classification model109, a plurality of device descriptions for the plurality of responses to the client device101a. In some embodiments, each response is respectively associated with one or more device descriptions of the plurality of device descriptions. The TEM agent108may be configured to generate, based on the plurality of device descriptions, a status report that includes a list of network addresses associated with a group of devices (e.g., client device101) having access to the client device101a.

In some embodiments, client device101b(e.g., a first client device) of the plurality of client devices101communicates with the client device101avia the private network system102and a second device of the plurality of client devices101communicates with the client device101avia the public network system106.

In some embodiments, the TEM agent108may be configured to collect a plurality of responses from a plurality of client devices101to a client device101on the private network system102by deploying one or more sensors103to the private network system102to be used by the plurality of client devices101to monitor communication between the client device101aand the plurality of client devices101and send the plurality of responses to the TEM agent108.

In some embodiments, the TEM agent108may be configured to collect a plurality of responses from a plurality of client devices101to a client device101on the private network system102by performing a port scanning across a plurality of communication protocols (e.g., Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), and the like) to discover a plurality of online devices (e.g., client device101) that are connected to at least one of the public network system106or the private network system102.

The TEM agent108may be configured to generate, based on the plurality of device descriptions, a status report by identifying, based on the port scanning, one or more offline devices (e.g., client device101) that are associated with one or more responses of the plurality of responses; and excluding one or more network addresses of the one or more offline devices from the from the list of network addresses.

The TEM agent108may be configured to maintain, in a database, a plurality of historical device descriptions that are associated with a plurality of historical responses from a plurality of sending devices (e.g., client device101) to a plurality of receiving devices (e.g., client device101) on the private network system102and a public network system106. In some embodiments, each historical response of the plurality of historical responses is respectively associated with one or more historical device descriptions of the plurality of device descriptions and/or one or more device descriptions of the plurality of device descriptions.

In some embodiments, the classification model190may be an LLM that uses generative AI techniques. An LLM is, for example, deep learning algorithms that can recognize, summarize, translate, predict, and/or generate content using very large datasets.

In some embodiments, the plurality of device descriptions indicate at least one of a company name, a business vertical, a device type, or a department name. In some embodiments, the status report includes an indication of one or more customers most likely to be associated with the target device. In some embodiments, the status report includes an indication of one or more customer departments most likely to be associated with the target device. In some embodiments, the status report includes an indication of one or more customer devices most likely belonging to the one or more customers.

The TEM agent108may be configured to receive a request (shown inFIG.1as, request) from the admin device105for information indicating exposures of the client device101aon the private network system102. The TEM agent108may be configured to generate the status report using the techniques described herein and then provide the status report to admin device105. In some embodiments, the TEM agent108sends the status report to the client device101ato notify the client device101a(including a user of the client device101a) about the group of devices that have access to the client device101. That is, the status report notifies the admin device105and/or the client device101aabout the security vulnerabilities associated with the client device101.

The TEM agent108may be configured to generate one or more natural language strings that include the one or more device descriptions of the plurality of device descriptions. The TEM agent108may be configured to include the one or more natural language strings in the status report.

The TEM system104includes a network interface306aconfigured to establish a communication session with a computing device for sending and receiving data over the communication network120to the computing device. Accordingly, the network interface306aincludes a cellular transceiver (supporting cellular standards), a local wireless network transceiver (supporting 802.11X, ZigBee, Bluetooth, Wi-Fi, or the like), a wired network interface, a combination thereof (e.g., both a cellular transceiver and a Bluetooth transceiver), and/or the like. In some embodiments, the TEM system104includes a plurality of network interfaces306aof different types, allowing for connections to a variety of networks, such as local area networks (public or private) or wide area networks including the Internet, via different sub-networks.

The TEM system104includes an input/output device305aconfigured to receive user input from and provide information to a user. In this regard, the input/output device305ais structured to exchange data, communications, instructions, etc. with an input/output component of the TEM system104. Accordingly, input/output device305amay be any electronic device that conveys data to a user by generating sensory information (e.g., a visualization on a display, one or more sounds, tactile feedback, etc.) and/or converts received sensory information from a user into electronic signals (e.g., a keyboard, a mouse, a pointing device, a touch screen display, a microphone, etc.). The one or more user interfaces may be internal to the housing of the TEM system104, such as a built-in display, touch screen, microphone, etc., or external to the housing of the TEM system104, such as a monitor connected to the TEM system104, a speaker connected to the TEM system104, etc., according to various embodiments. In some embodiments, the TEM system104includes communication circuitry for facilitating the exchange of data, values, messages, and the like between the input/output device305aand the components of the TEM system104. In some embodiments, the input/output device305aincludes machine-readable media for facilitating the exchange of information between the input/output device305aand the components of the TEM system104. In still another embodiment, the input/output device305aincludes any combination of hardware components (e.g., a touchscreen), communication circuitry, and machine-readable media.

The TEM system104includes a device identification component307a(shown inFIG.3Aas device ID component307a) configured to generate and/or manage a device identifier associated with the TEM system104. The device identifier may include any type and form of identification used to distinguish the TEM system104from other computing devices. In some embodiments, to preserve privacy, the device identifier may be cryptographically generated, encrypted, or otherwise obfuscated by any device and/or component of the TEM system104. In some embodiments, the TEM system104may include the device identifier in any communication (e.g., classifier performance data, input message, parameter message, etc.) that the TEM system104sends to a computing device.

The TEM system104includes a bus (not shown), such as an address/data bus or other communication mechanism for communicating information, which interconnects the devices and/or components of the TEM system104, such as processing device302a, network interface306a, input/output device305a, and device ID component307a.

In some embodiments, some or all of the devices and/or components of TEM system104may be implemented with the processing device302a. For example, the TEM system104may be implemented as a software application stored within the memory304aand executed by the processing device302a. Accordingly, such embodiment can be implemented with minimal or no additional hardware costs. In some embodiments, any of these above-recited devices and/or components rely on dedicated hardware specifically configured for performing operations of the devices and/or components.

FIG.3Bis a block diagram depicting an example of the client device inFIG.1, according to some embodiments. While various devices, interfaces, and logic with particular functionality are shown, it should be understood that the client device101includes any number of devices and/or components, interfaces, and logic for facilitating the functions described herein. For example, the activities of multiple devices may be combined as a single device and implemented on a same processing device (e.g., processing device302b), as additional devices and/or components with additional functionality are included.

The client device101includes a processing device302b(e.g., general purpose processor, a PLD, etc.), which may be composed of one or more processors, and a memory304b(e.g., synchronous dynamic random-access memory (DRAM), read-only memory (ROM)), which may communicate with each other via a bus (not shown). The processing device302bincludes identical or nearly identical functionality as processing device302ainFIG.3A, but with respect to devices and/or components of the client device101instead of devices and/or components of the TEM system104.

The memory304bof processing device302bstores data and/or computer instructions/code for facilitating at least some of the various processes described herein. The memory304bincludes identical or nearly identical functionality as memory304ainFIG.3A, but with respect to devices and/or components of the client device101instead of devices and/or components of the TEM system104.

The processing device202aexecutes a client management agent315. In some embodiments, the client management agent315may be configured to receive a message from the TEM system104, where the message includes information about installing a sensor103. In response to receiving the message, the client management agent315uses the message to install the sensor onto its own resources (e.g., memory, storage, processor). In some embodiments, the TEM system104does not need to deploy a sensor onto each of the client devices101, but instead can leverage an already existing and deployed sensor which is also configured to send the necessary telemetry data for the TEM system104to function. The client management agent315may be configured to use the installed sensor103to record (in a local storage, e.g., memory, hard drive, and/or the like) communication that takes place between the particular client device101(in which the sensor103is installed) and other client devices101that communicate with the particular client device101. The client management agent315may be configured to periodically send its locally stored records of communication to the TEM system104, which in turn, stores the records of communication in the indexed database111.

The client management agent315of a particular client device (e.g., client device101a) may be configured to send a request (shown inFIG.1as internal request) to one or more client devices of the client devices101b-101dof the private network system102to cause each of the client devices101b-101dto send a response (shown inFIG.1as internal response) back to client device101a. The client device101aon the private network system102may also be configured to send a request (shown inFIG.1as external request) to one or more of the client devices101e-101fof the public network system106to cause each of the client devices101e-101fto send a response (shown inFIG.1as external response) back to client device101a.

The client device101includes a network interface306bconfigured to establish a communication session with a computing device for sending and receiving data over a network to the computing device. Accordingly, the network interface306bincludes identical or nearly identical functionality as network interface306ainFIG.3A, but with respect to devices and/or components of the client device101instead of devices and/or components of the TEM system104.

The client device101includes an input/output device305bconfigured to receive user input from and provide information to a user. In this regard, the input/output device305bis structured to exchange data, communications, instructions, etc. with an input/output component of the client device101. The input/output device305bincludes identical or nearly identical functionality as input/output device305ainFIG.3A, but with respect to devices and/or components of the client device101instead of devices and/or components of the TEM system104.

The client device101includes a device identification component307b(shown inFIG.3Bas device ID component307b) configured to generate and/or manage a device identifier associated with the client device101. The device ID component307bincludes identical or nearly identical functionality as device ID component307ainFIG.3A, but with respect to devices and/or components of the client device101instead of devices and/or components of the TEM system104.

The client device101includes a bus (not shown), such as an address/data bus or other communication mechanism for communicating information, which interconnects the devices and/or components of the client device101, such as processing device302b, network interface306b, input/output device305b, and device ID component307b.

In some embodiments, some or all of the devices and/or components of the client device101may be implemented with the processing device302b. For example, the client device101may be implemented as a software application stored within the memory304band executed by the processing device302b. Accordingly, such an embodiment can be implemented with minimal or no additional hardware costs. In some embodiments, any of these above-recited devices and/or components rely on dedicated hardware specifically configured for performing operations of the devices and/or components.

FIG.3Cis a block diagram depicting an example environment for using the TEM inFIG.1, according to some embodiments. The TEM system104includes a memory304cand a processing device302cthat is operatively coupled to the memory304c. The processing device302cis collect a plurality of responses319cfrom a plurality of devices301cto a target device303con a private network306c. The processing device302cis configured to provide the plurality of responses319cto a classification model309cthat is trained to assign device descriptions313cfor device responses319cbased on semantic matching315cof the device responses319cto database data329c. The processing device302cis configured to assign, using the classification model309c, a plurality of device descriptions313cfor the plurality of responses319cto the target device303c. In some embodiments, each response is respectively associated with one or more device descriptions313cof the plurality of device descriptions313c. The processing device302cis configured to generate, based on the plurality of device descriptions313c, a status report325cthat includes a list of network addresses328cthat are associated with a group of devices301cthat have access to the target device303c.

FIG.4is a flow diagram depicting a method of using generative artificial intelligence to identify exposures of computing devices on computing networks to actual and/or potential threats, according to some embodiments. Method400may be performed by processing logic that may include hardware (e.g., circuitry, dedicated logic, programmable logic, a processor, a processing device, a central processing unit (CPU), graphic processing unit (GPU), a system-on-chip (SoC), etc.), software (e.g., instructions running/executing on a processing device), firmware (e.g., microcode), or a combination thereof. In some embodiments, method300may be performed by a threat exposure management system, such as the TEM system104inFIG.1. In some embodiments, method400may be performed by one or more computing devices of a private network system, such as private network system102inFIG.1. In some embodiments, method400may be performed by one or more computing devices of a public network system, such as public network system106inFIG.1.

With reference toFIG.4, method400illustrates example functions used by various embodiments. Although specific function blocks (“blocks”) are disclosed in method400, such blocks are examples. That is, embodiments are well suited to performing various other blocks or variations of the blocks recited in method400. It is appreciated that the blocks in method400may be performed in an order different than presented, and that not all of the blocks in method400may be performed.

The method400includes the block402of collecting a plurality of responses from a plurality of devices to a target device on a private network. The method400includes the block404of providing the plurality of responses to a classification model trained to assign device descriptions for device responses based on semantic matching of the device responses to database data. The method400includes the block406of assigning, by the processing device using the classification model, a plurality of device descriptions for the plurality of responses to the target device, each response is respectively associated with one or more device descriptions of the plurality of device descriptions. The method400includes the block408of generating, based on the plurality of device descriptions, a status report including a list of network addresses associated with a group of devices having access to the target device.

The example computing device500may include a processing device (e.g., a general-purpose processor, a PLD, etc.)502, a main memory504(e.g., synchronous dynamic random-access memory (DRAM), read-only memory (ROM)), a static memory506(e.g., flash memory and a data storage device518), which may communicate with each other via a bus530.

Computing device500may further include a network interface device508which may communicate with a communication network520. The computing device500also may include a video display unit510(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device512(e.g., a keyboard), a cursor control device514(e.g., a mouse) and an acoustic signal generation device516(e.g., a speaker). In one embodiment, video display unit510, alphanumeric input device512, and cursor control device514may be combined into a single component or device (e.g., an LCD touch screen).

Data storage device518may include a computer-readable storage medium528on which may be stored one or more sets of instructions525that may include instructions for one or more components/programs/applications542(e.g., TEM agent108, classification model109, port scanning agent110inFIG.1, etc.) for carrying out the operations described herein, in accordance with one or more aspects of the present disclosure. Instructions525may also reside, completely or at least partially, within main memory504and/or within processing device502during execution thereof by computing device500, main memory504and processing device502also constituting computer-readable media. The instructions525may further be transmitted or received over a communication network520via network interface device508.

The methods and illustrative examples described herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used in accordance with the teachings described herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear as set forth in the description above.