Patent Description:
During the last years, digitization has become more and more relevant and is an integral party in our daily lives. It is beyond dispute that security is a core need for digitization, Industry <NUM> and Internet of Things (IoT), and with <NUM> - the digital life - the "attack surface" is to become larger due to the new dimensions of connected entities.

According to the source "https://github. com/BishopFox/eyeballer", there are <NUM> billion IoT connected devices in <NUM>, while <NUM> billion devices are forecasted by <NUM>. Meanwhile, the number of successful large-scale cyber-attacks is rising, e.g., Emotet and WannaCry, and the asymmetry in the cyberwarfare is increasing. Here, skilled hacker ability increases to harm enterprises, organizations and even states despite more investments in the defense line.

Thereby, a fundamental question the driver of digitization and <NUM> needs to answer is: How adopters of digitization and <NUM> can be well prepared against security threats?.

Especially the following three points pose an immense challenge, with which existing security measures and tools have not been able to cope:.

Due to these facts and the limitation of existing solutions, even malicious users with low level of expertise have become capable to hack large organizations, internet service provider and/or internet capable devices.

<CIT> describes a system and method for identifying Internet of Things (IoT) devices communicatively connected to a plurality of gateways. The gateways are in turn all connected to a controller module which is configured to train and maintain classifier models for fingerprinting the IoT devices. The gateways themselves are configured to utilize the updated classifier models generated by the controller module to classify IoT devices connected to them.

<CIT> discloses Systems and methods for detecting vulnerabilities and/or privileged access are disclosed. In some embodiments, a computerized method comprises receiving asset information for each of a plurality of assets, the assets connected to a network; clustering the assets into a plurality of cluster nodes based on the asset information, each of the assets being clustered in one of the cluster nodes, at least a first asset being clustered in a particular one of the cluster nodes; receiving one or more events associated with the first asset; remapping the first asset to a different one of the cluster nodes based on the asset information of the first asset and the one or more events associated with the first asset; calculating a distance between the particular cluster node and the different cluster node; and triggering one or more actions based on the distance between the particular cluster node and the different cluster node.

<CIT> discloses a computerized method for analyzing a subject URL to determine whether the subject URL is associated with a phishing attack is disclosed. The method includes steps of detecting keypoints within a screenshot of a webpage corresponding to the subject URL and determining a set of confidences based on an analysis of the detected keypoints with a model.

In the view of above, it is an object of the present invention to provide a method, a computer and a computer program product that enable organizations, internet service provider and/or internet capable devices to continuously re-discover and group their internet-capable services in order to able to efficiently perform security investigations.

The features of the various aspects of the invention described below or the various examples of implementation may be combined with each other, unless this is explicitly excluded or is technically impossible According to a first aspect of the invention, a method for automatic and dynamic clustering of IT-services according to claim <NUM> is provided.

This provides the advantage that the company can get a structured and transparent overview of its whole IT-services. But it is also possible to provide this method by a third party for companies in order to give the company an overview of its IT-services because the IT-service-information as well as the list of IT-services can be extracted externally. For example, the IT-services can be webpages. A small company with only one webpage can classify and cluster its webpage, subdomains and so on in principle manually. This gets very cumbersome for large companies that can have of different websites with different properties. The structured and transparent overview of the webpages in different classes and different clusters provides advantageous means for big company to handle its IT-services or webpages, respectively.

An association to a certain class and/or to a certain cluster indicates a similarity of the IT-services within that certain class and/or to that certain cluster.

This provides the advantage that the company easily knows that all IT-services within that certain class and/or that certain cluster have similar properties so that the companies can handle those IT-services in a uniform way. This greatly enhances the efficiency of the operators of the respective IT-services of the company. Automated scripts perform certain tasks on the IT service based on its class and or cluster membership. In addition, it is possible to tag the classes and/or the clusters with names that indicate associated properties. This can provide additional efficiency when applying the automated scripts.

The similarity is a security vulnerability similarity.

This provides the advantage that the company can get a structured overview of the security status of its IT-services, in particular its webpages. This enables the company to efficiently find those webpages with the highest security risk. According to the method, those webpages can be found within a small number of clusters, in particular within one single cluster. Or the method provides clusters ordered regarding their security status. Hence, the company fix the most threatened webpages first, in particular in an automated way. A possible way would be to let a respective script simply run overall IT services within a distinct cluster. This provides an efficient way for big companies to prevent cyber-attacks on their IT services.

In an embodiment, the IT-service-information are externally visible when requesting the IT-service. This means that the IT-service-information can be seen from a "hacker's view". This has the advantage that foreign companies can offer the service of providing clustering of the IT-services and as an additional advantage that the analysis is performed on properties of the IT services a hacker also has access to. This is more efficient than analyzing other properties of the IT-services that do not provide a possible entrance gate for cyber-attacks.

The first IT-service-information is a status-code of the IT-service, wherein the second IT-service-information is a screenshot of the IT-service, wherein the third IT-service-information is extracted from a HTML-Body of the IT-service.

This provides the advantage that it is easily possible to access these IT-service-information in a scripted way when requesting the IT-service and that each of the IT-service-information yields different kinds of information that help to tackle the problem of correct classifying and clustering from "different directions".

The status-code can be a Hypertext Transfer Protocol (HTTP) response status-codes. Status codes are issued by a server in response to a client's request made to the server. The first digit of the status code specifies one of five standard classes of responses. The message phrases shown are typical, but any human-readable alternative may be provided. All HTTP response status codes are separated into five classes or categories. The first digit of the status code defines the class of response, while the last two digits do not have any classifying or categorization role. There are five classes defined by the standard: 1xx informational response - the request was received, continuing process; 2xx successful - the request was successfully received, understood, and accepted; 3xx redirection - further action needs to be taken in order to complete the request; 4xx client error - the request contains bad syntax or cannot be fulfilled; 5xx server error - the server failed to fulfil an apparently valid request. Of course classifications can be done based on the status code and/or search strings like login, Tomcat etc..

The screenshot as the second IT-service-information delivers structural information about the IT-service or the webpage, respectively. For example, companies create their webpages with similar icons, colors etc. this information can be used to group these webpages together as clusters. Another example is that webpages that comprise login fields share several comments pictures, for example a first empty field for the username and the second empty field for the password. Another advantage is that this structural information of the screenshots can be independent from the language that is used in the HTML-body.

On the other hand, if the language of the HTML-body is known, it is possible to use this information advantageously as the third IT-service-information. For example, this could be helpful if two login pages what look structurally very different but if the HTML-body with in both cases contain the words "username" and "password". In this case, these two similar pages can efficiently be clustered based on information from the HTML-body.

The IT-service-information can be used by applying supervised or unsupervised algorithms.

In an embodiment, a first additional step is performed, in particular following the second step, wherein the first additional step improves the classifying by assigning at least on IT-service from one class to another class based on the second piece of the IT-service-information.

This provides the advantage, that webpages that have not been programmed carefully and return uncorrected status-codes can be classified into the correct classes by additionally using the second piece of the IT-service-information. Incorrect status-codes can also be caused by hackers in case of Firewalls and other security systems. As an example, the first additional step can help finding login pages that do not have the login search string in the response, thus, being not classified into a login class. To be very efficient and accurate, the first additional step can use supervised machine learning algorithms, for example the Mobilenet algorithm, that is trained on data sets comprising the second piece of the IT-service-information. Supervised machine learning algorithms are very efficient to classify structural information from images like screenshots.

In an embodiment, the third step uses a second algorithm if the clustering is based on the second piece of the IT-service-information and/or that the third step uses a third algorithm if the clustering is based on the third piece of the IT-service-information.

Using the second piece of the IT-service-information with another algorithm, namely the second algorithm, provides the advantage of having the chance to analyze the IT-services "differently" compared to the case when the first algorithm was used on the second piece of the IT-service-information. In particular, the second algorithm uses an unsupervised clustering machine learning algorithm, like DBSCAN, which efficiently clusters the IT-services within the classes even without training data set. Using the third piece of the IT-service-information with another algorithm, namely the third algorithm, provides the advantage of having the chance to analyze the IT-services "differently" compared to all other cases described above. In particular, the third algorithm uses an unsupervised deep learning "word2vec" natural language processing model. Especially preferred the third algorithm uses a self-supervised deep learning "word2vec" natural language processing model that is more accurate and more strict but needs more computational resources.

In an embodiment, the second algorithm and/or the third algorithm are unsupervised algorithms that are designed to apply at least one level of parametrization.

This provides the advantage that multiple levels of the parameterization can be applied to further improve the results. Typically, the algorithms start with a relaxed parameterization to prevent "overfitting" of the resulting clusters of IT-services. The output of the first level can be several clusters with similar properties and problematic clusters in which IT-services are grouped that cannot be assigned to a cluster having similar properties. The further levels with a more tuned set of parameterization are then applied to the IT-services within the problematic clusters in order to assign the problematic elements into existing clusters or to create new clusters for them.

In an embodiment, a second additional step is performed, in particular following the third step, to further cluster elements of the problematic clusters, wherein the second additional step improves the clustering within each class by using the second piece of the IT-service-information with the first algorithm and the third piece IT-service-information with a fourth algorithm on problematic clusters. In this case, the first algorithm and the fourth algorithm are based on supervised learning methods to train the algorithm.

This again provides the advantage, that the IT-services are evaluated "differently" as before. This second additional step is again applied only to the IT-services within the problematic clusters. To mitigate the "false" positive outcomes, i.e. to find similarities between IT-services do not exist, it is possible to only associate the IT-services of the second additional step into new or existing clusters if both the evaluation of the first algorithm and the evaluation of the fourth algorithm yield the same results. In other words, only the cross section of the output of the first algorithm and of the output of the fourth algorithm is associated to a new or an existing cluster.

In an embodiment, the steps of clustering are applied in the following order:.

Tests have shown that this order of steps is the most efficient and yields the best results concerning the clustering of IT-services, in particular webpages, into groups of similar properties.

According to a second aspect of the invention, a computer system for automatic and dynamic clustering of IT-services and/or IT-systems is provided that is configured to perform the method described above.

Basically, the computer system provides the same advantages as described in the context of the method.

According to a third aspect of the invention, a computer program product for automatic and dynamic clustering of IT-services is provided, when executed by a computer system, causes the computer system to perform the method described above.

Basically, the computer program product provides the same advantages as described in the context of the method.

Given the large number of assets (IT systems) per enterprise and the different indicators of security issues in general, it is imperative to have (semi-) automated methods to discover relevant security issues on a large scale. One major step towards increasing the detection coverage and rate of security issues is to gain a more transparent and accurate overview of the network.

That is, to get an overview of how many and which systems do have default installations, outdated products, blocked requests, administrative components online, login interfaces etc. The more transparent and the more accurate the overview the better is the detection rate of security issues, e.g., how many and which systems do have default installations of what product and in which version?.

This invention deals with the automated classification and clustering of assets that do share similar characteristics with respect to the services running on them. The goal is to answer the questions above as granular as possible, thereby, to achieve a more transparent and accurate asset overview than existing methods. For example, the method can be used to automatically classify and cluster http-services (e.g., websites), thus: Finding out suspicious and/or misconfigured websites. Grouping all IPs together, which provide similar characteristics in their website in a way, which yields better results than using search strings to group assets together and/or using hash-based comparisons of screenshots. Another example would be for instance to apply this method on the remote desktop-services, thus: Grouping all IPs together, which run Windows and have the same Windows Version.

<FIG> shows an overview of a modular solution approach <NUM> to mitigate cyberattacks, wherein the invention represents one module of the solution approach.

The modular solution approach <NUM> is a novel combination of systems/modules for identifying and evaluating the attack surface of a company in real time. It automatically retrieves a comprehensive inventory of the IT infrastructure of a company/internet service provider. Based on an innovative framework, the modular solution approach <NUM> interconnects different systems in a recursive manner to efficiently collect all in-scope information. Moreover, its enhanced in time vulnerability analysis of a company's IT infrastructure makes the modular solution approach <NUM> an attractive solution for risk management of oneself and of contractual partners. The information gathered by the modular solution approach <NUM> is relevant for any company to accelerate management discussions and to take appropriate IT security decisions.

A first module <NUM> focuses on creating a list of all comprehensive inventory/list of the IT infrastructure of a company/internet service provider as a starting point in an automatic fashion. This process is described in the European patent application with the application number<CIT>.

In principle, all cyber risks could be determined manually from this comprehensive list. However, especially in the case of large companies this list is likely to be so large and the individual risk of each IT-unit and/ or IT-services could change so dynamically that an efficient risk assessment is only possible if the large number of IT-unit and/or IT-services, e.g. websites and/or internet capable devices, is clustered in groups having similar properties. This invention deals in particular with an automated classification and clustering module <NUM> of the modular solution approach <NUM>, which leads to a significant improve of the overall performance of the modular solution approach <NUM>, in particular it provides better attack surface evaluation and an overview of higher transparency and accuracy.

The third module <NUM> serves the purpose to evaluate the vulnerabilities of each cluster, which is very efficient because that each IT-unit and/or each IT-service within the same cluster shows a similar vulnerability.

The box <NUM> shows possible insights that the company get from the modular solution approach <NUM>, namely: How effective are my implemented security measures? How is my security posture in comparison to other companies in the same sector? What (alternative or new) security measures shall be implemented and what results are to expect? Which IT-unit and/or each IT-service you need immediate care?.

In the following it might happen due to ease the reading of the text that only the term IT-service will be used. However, the described techniques can be applied to the IT-units, too.

The general approach of the automated method to classify and cluster IT systems/IT-services is depicted in <FIG>. The method can run on a computer system <NUM>. A short description of each step as well as diagrams of the main components are provided below. The symbols of the flowcharts will be labeled as set out by the American National Standards Institute (ANSI) in the <NUM>. The International Organization for Standardization (ISO) adopted the ANSI symbols in <NUM>. The current standard, ISO <NUM>, was revised in <NUM>.

An input <NUM> inputs a list of (service-) screenshots and corresponding (service-) responses for each IT system/IT-services. For example, a list of all websites belonging to a company can be gained as described in the European patent application with the application number<CIT>. Therefore, if one has the list of all IT-services/websites of company, it is possible to design an algorithm that is configured to automatically save screenshots (i.e. an actual picture of the web page) of these websites along with the respective "status code field". To ease the description, the classification and clustering of http-services (here websites) is used as an example.

A process <NUM> triggers the step of "status code and search string-based classification" and yields as an output classes of screenshots and responses. However, the combination of the "status code field" with the "screenshots of the webpages" alone does not allow an accurate determination of the classification of the respective webpages, e.g. due to custom error pages or other reasons. Instead of "status code field" the terms "response-code" or simply "response" are used. The invention regards these terms as being equal to one another.

A process <NUM> triggers the step of "screenshot-based supervised learning" and yields as an output "more accurate classes of screenshots and responses".

A process <NUM> triggers a "multi- level clustering of the screenshots" and yields as an output "clusters of screenshots and responses of each class".

A process <NUM> triggers a "joint screenshot-and responsive-based supervised learning" and yields as an output "more accurate clusters of screenshots and responses of each class".

A process <NUM> triggers a "response-based single/multi-level clustering" and yields a further clustering of cluster "<NUM>" and "-<NUM>" of each class.

A process <NUM> triggers "clusters of IT-services/websites having similar screenshots and responses" can be the subject of security tests or an efficient mitigation of security risks. Due to the similarity, they can be treated basically equally, which makes it especially efficient to treat common security vulnerabilities.

In the following, the individual processes Fig. 2a will be described in greater detail.

The process <NUM> triggers the step of "status code and search string-based classification". An algorithm implemented on a processing unit of the computer system is designed to classify the screenshots in different classes based on the corresponding responses status-code and/or search-strings (e.g., <NUM>, <NUM>, <NUM>, login etc.). In other words, search all responses of the webpages for pre-defined status-codes and search-strings and group the results (responses and corresponding screenshots - and IPs) into classes.

The search-strings can be used to find response-codes (e.g., <NUM>, <NUM>, <NUM>, login etc.) of particular interest. For example, response-code "<NUM>" means that the request has succeeded, wherein a response code of <NUM> means a "bad request". Hence, in the process <NUM> the classification only based on the stages-codes and not on an analysis of the screenshots. The list of screenshots and responses can be automatically saved within the computer system. There are saved in a way that it is clear that they "belong" together. To serve that purpose, a data type can be created that connects them, for example in a first data field of the data type the screenshot is saved and in a second data field of the data type the response-code is saved. However, the combination of the "status code field" with the "screenshots of the webpages" alone does not allow an accurate determination of the classification of the respective webpages, e.g. due to custom error pages or other reasons. The response-codes do not match the actual situation all cases so that a further analysis/refinement/correction is needed. In case of a non-accurate classification, an efficient mitigation of security vulnerability is not possible because the websites do not necessarily have "similar properties" regarding the security vulnerability.

The process <NUM> outputs: Classes of Screenshots and Responses, e.g., <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, login.

<FIG> shows an illustrative example output of the process <NUM> of Fig. 2a. <FIG> shows that the screenshots are classified in three different classes, namely class "<NUM>" <NUM>, class "<NUM>" <NUM>, and class "<NUM>" <NUM>. Within those classes there are smaller boxes <NUM> that each contain and "S" <NUM> and an "R" <NUM>. The "S" <NUM> represented the term "screenshot" and the "R" <NUM> represents the term "response-code". Hence, the smaller boxes <NUM> indicate that each unique screenshot <NUM> has a response-code <NUM> associated to it. Different screenshots <NUM> can have the same response-code <NUM>. In <FIG> the screenshots <NUM> having a response code <NUM> that starts with the same number are grouped into the same class.

The process <NUM> triggers the step of "screenshot-based supervised learning". The "screenshot-based supervised learning" algorithm aims to purify the results of process <NUM> by identifying wrongly classified screenshots (e.g., custom error page with status code <NUM> classified as non-error page <NUM>). The algorithm is based on the idea that the information needed to purify the results can be extracted from the screenshots because graphics, texts etc. displayed on the webpage contains information, too. An effective way to enable the process <NUM> to gain the right information from those screenshots <NUM> is to implement a machine learning algorithm <NUM> and to apply supervised learning to train the machine learning algorithm <NUM> with screenshots <NUM> of a "correct" classification. For example, the machine learning algorithm <NUM> can find "login pages", which do not have the login search string in the response, thus, being not classified as login.

An example of supervised learning to use in this process <NUM> is the "Mobilenet algorithm" using transfer learning. This step can be mainly split into <NUM> sub-steps:.

<FIG> shows the process screenshot-based supervised learning if Fig. 2a in detail.

Terminal <NUM> start the process <NUM>. This leads to a decision <NUM> that checks if there is a new data set. If there is no new data set, a flowline <NUM> goes to a terminal <NUM> that end the process <NUM> without further calculations. If there is a new data set, a flowline <NUM> leads to a decision <NUM> that checks if the model, i.e. the machine learning algorithm <NUM>, is already existing.

If the decision <NUM> yields that the model is already existing, then a flowline <NUM> leads to a process <NUM> in which the machine learning algorithm <NUM> generates more accurate classes of screenshots and responses. The new data set, that serves as an input for the process <NUM> is being preprocessed in a preprocessing step <NUM> before it is given to process <NUM>, wherein the preprocessed data is named and labeled in step <NUM> accordingly so that it can be assigned to the individual screenshots <NUM> and to the respective response-codes <NUM>. The preprocessing step <NUM> comprises the following steps. A document 310a is used in combination with a screenshot package 310b to serve as an input for a predefined process 310c. A document 310a comprises a CSV with screenshots, screenshot names, labels from status code and HTML Bodies. Hence, the document 310a provides the information to analyze the webpages. The predefined process 310c is an image preprocessing and classification "train_validate_img_pro()" process, which yields compressed images 310d. Those compressed images 310d are then converted to a matrix in a predefined process 310e.

If the decision <NUM> yields that the model does not yet exist, a flowline <NUM> leads to a predefined process <NUM> that is the training process of the model, i.e. of the machine learning algorithm <NUM>. The training process of the model <NUM> requires as input: i) a selection of the appropriate model <NUM>. A decision <NUM> asks if transfer learning shall be used. If no, then a normal convolutional neural network <NUM> serves as input for the model for the process <NUM>. If yes, then use "Mobilenet for transfer learning" <NUM> as the model for the process <NUM>; ii) the preprocessing step <NUM> followed by the labeling step <NUM>; iii) training parameters <NUM> like Epoch, Batch-Size etc..

This "creates" the trained model <NUM>. In the following, the model <NUM> can be validated and/or evaluated.

A decision <NUM> asks if the model <NUM> shall be validated. If no, then the evaluation process <NUM> is performed on the new data set <NUM> that generates more accurate classes of screenshots and responses. If yes, then the model <NUM> undergoes a validation process <NUM>. The validation process <NUM> has the following inputs: i) the model <NUM>; ii) a validation dataset <NUM> that has undergone the preprocessing step <NUM>. The validation process <NUM> generates validation results and reports <NUM>. Optional: The user can check if he is satisfied with the validation results and reports <NUM>. After generating the validation results and reports <NUM>, then the evaluation process <NUM> is performed on the new data set <NUM> that generates more accurate classes of screenshots and responses.

A decision <NUM> asks if the model <NUM> shall be evaluated. If no, then the evaluation process <NUM> is performed on the new data set <NUM> that generates more accurate classes of screenshots and responses. If yes, then the model <NUM> undergoes an evaluation process <NUM>. The evaluation process <NUM> has the following inputs: i) the model <NUM>; ii) an evaluation <NUM> dataset that has undergone the preprocessing step <NUM>. The evaluation process <NUM> generates evaluation results and reports <NUM>. Optional: The user can check if he is satisfied with the evaluation results and reports <NUM>. After generating the evaluation results and reports <NUM>, then the evaluation process <NUM> is performed on the new data set <NUM> that generates more accurate classes of screenshots and responses.

The output of process <NUM> yields more accurate classes of screenshots and responses, e.g., <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, login.

This is illustrated in <FIG>. The screenshots <NUM> that a new framed with a dashed-line style were put in a different class by the process <NUM>. For example, the screenshots S: <NUM> and S: <NUM> were removed from class "<NUM>" <NUM> and the screenshots S: <NUM> and S: <NUM> were added to class "<NUM>" <NUM>. Hence, S: <NUM> and S: <NUM> are more similar with respect to security vulnerabilities to the other screenshots of class <NUM> than S: <NUM> and S: <NUM>.

The next processes than serve to "refine" within the classes. Test have shown that the method becomes even more efficient if one takes the differences regarding the security vulnerability within the classes into account. Hence, the aim of the next step is to find clusters of screenshots <NUM> within each of the classes that are more similar to each other with respect to the security vulnerability than the other screenshots of the respective class.

The output of process <NUM> is important for the process <NUM> that triggers a "multi- level clustering of the screenshots".

The process <NUM> can comprise three levels of processing steps.

Level <NUM>: The standard and supervised clustering machine learning algorithm DBSCAN is used with a relaxed parameterization (e.g. Eps = <NUM>; samples <NUM>) and auto-encoder compression algorithm used to find clusters within each of the classes. The auto-encoder compression algorithm can detect non-linear characteristics, to cluster the screenshots in large clusters. Hence, Level <NUM> outputs several clusters that can be named as: - <NUM>, <NUM>, <NUM>, <NUM>, <NUM>,. For example, they could be <NUM> screenshots within cluster "-<NUM>", <NUM> screenshots within cluster "<NUM>", <NUM> screenshots within cluster "<NUM>", <NUM> screenshots within cluster "<NUM>", <NUM> screenshots within cluster "<NUM>", and so on. The clusters with the numbers "-<NUM>" and "<NUM>" have a special meaning. Basically they represent "problematic" clusters with screenshots, which cannot be classified correctly. In particular, the cluster "-<NUM>" comprises the screenshots that could be clustered into any other class and the cluster "<NUM>" is the largest and the worst is that of screenshots. The more screenshots the clusters "-<NUM>" and "<NUM>" the less efficient the method of assessing security problems is. Therefore, the next level aims to tackle this problem.

Level <NUM>: Use the same algorithm as in Level <NUM> but with a tuned parameterization (e.g. Eps = <NUM>; samples <NUM>) and a PCA compression algorithm, which is focused on linear characteristics, to further cluster the previous clusters number "<NUM>" and "-<NUM>" of level <NUM>. Of course the values of the parameterization can be adapted to each use case. Typically, after the process of level <NUM>, they will still remain screenshots within the clusters "-<NUM>" and "<NUM>". Using the method of Level <NUM> after Level <NUM> is done to avoid overfitting, that could result from only using the tuned parameterization of Level <NUM> without using Level <NUM>.

Level <NUM>: Use the same algorithm as before in Level <NUM>, but with a more fine-tuned parameterization (e.g. Eps = <NUM>; samples <NUM>) and PCA compression algorithm to even further cluster the remain clusters number "<NUM>" and "-<NUM>" of the previous level. Tests have shown that is more efficient to first apply level <NUM> to the clusters "<NUM>" and "-<NUM>" and then to apply level <NUM>, instead of only applying the procedure of level <NUM>.

<FIG> shows the process "multi- level clustering of the screenshots" <NUM> in detail.

Terminal <NUM> starts the process <NUM>. A flowline leads to a decision <NUM> to that asks if clusters shall be created.

If no, then a flowline <NUM> leads to a terminal <NUM> that ends the process <NUM>.

If yes, then a flowline <NUM> leads to a predefined process <NUM> of level <NUM> clustering that basically performs the steps described above. The predefined level <NUM> clustering process <NUM> has to further inputs: i) process <NUM> determines a clustering algorithm selection. Decision <NUM> asks if the algorithm shall be density based. If no, a flowline <NUM> leads to a process <NUM> in which a "KMEANS or Tree" algorithm is selected. The "KMEANS or Tree" algorithm need as an input parameter <NUM> the number of clusters. If yes, a flowline <NUM> leads to a process <NUM> in which the DBSCAN algorithm is chosen. The DBSCAN algorithm needs as input parameters <NUM> Eps and a sample number. ii) of course, the predefined level <NUM> clustering process <NUM> needs as an additional input the screenshots of each class. The screenshots are processed to compressed images and serve as an import <NUM> for an image to matrix predefined process <NUM>. The created matrices of the screenshots are then labeled accordingly in step <NUM>. In addition, a compressing algorithm selection <NUM> is performed to compress the matrices. A decision <NUM> asks if a nonlinear relation is needed. If yes, then an auto-encoder model is used to compress the matrices. If no, then the PCA algorithm <NUM> is used to compress the matrices. The process of data compression/matrix compression <NUM> has as an additional input the chosen class <NUM>. This results in a compressed data from the chosen class <NUM> as input for the level <NUM> clustering process <NUM>.

After the level <NUM> clustering process <NUM> is finished, a flowline leads to a level <NUM> clustering process <NUM> as described above. After the level <NUM> clustering process <NUM> is finished, a flowline leads to a level <NUM> clustering process <NUM> as described above. The level <NUM> clustering process <NUM> then creates the output <NUM> of clusters of Screenshots and responses for each class, e.g., -<NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> etc. with <NUM> and -<NUM> being problematic cluster before the terminal <NUM> ends the process <NUM>.

This output is illustrated in <FIG> shows only the creation of clusters of class <NUM>. It can be seen that six different clusters are created, wherein the screenshots <NUM> of the clusters "<NUM>" to "<NUM>" lie closer together than the screenshots <NUM> of the clusters "-<NUM>" to "<NUM>". In technical terms this has the meaning that the screenshots <NUM> within each of the clusters "<NUM>" to "<NUM>" are similar to each other concerning security issues. Since <FIG> serves only illustrative purposes, it can actually happen that the numbers of screenshots <NUM> within the clusters "-<NUM>" to "<NUM>" is quite large, which still prevents an efficient assessing of security problems of the websites.

Therefore, a process "joint screenshot- and response-based supervised learning" <NUM> is started to yield as an output even more accurate clusters of screenshots and responses of each class.

The process <NUM> is based on different data sets than the foregoing processes and combines two different approaches to generate get the results.

The first approach, or the first part, trains the same algorithm as in process <NUM>, e.g. the transfer deep learning algorithm "Mobilenet". In this case however, the training data set differs - due to the different training data set, different results compared to process <NUM> are possible. The first approach now uses as training data the clustered classes and takes the screenshot as inputs and the associated cluster numbers as the respective tags. So it uses the output of process <NUM>, but without the problematic clusters "-<NUM>" and "<NUM>". In the next step, this trained algorithm is applied to find further screenshots belonging to a given cluster from the clusters "<NUM>" and "-<NUM>". It is possible to set a first threshold value that determines the likelihood that screenshot of the clusters "<NUM>" and "-<NUM>" belongs to any of the other clusters. Only if the probability of screenshot exceeds this first threshold value, this screenshot is considered for reclassification. All of those screenshots exceeding this first threshold form a first set of screenshots.

The second approach, or the second part, trains a TD-IDF-based algorithm (a statistical model based on natural language processing) for each cluster of screenshots based on their corresponding "http-responses". It is an important insight, that it is beneficial not only to use the screenshot information when creating the clusters because those screenshots need to be compressed so that the content of the webpage is no longer recognizable. Due to the compression, the algorithms that are trained with respect to the screenshot basically learn about the structure. However, the training of the second approach learns about the content of that page that can be assessed by the information of the HTML-Body. After having trained the TD-IDF-based algorithm, an algorithm is used to find further screenshots in the remaining clusters number "<NUM>" and "-<NUM>", which shall belong to other clusters. It is possible to set a second threshold value that determines the likelihood that screenshot of the clusters "<NUM>" and "-<NUM>" belongs to any of the other clusters. Only if the probability of screenshot exceeds this second threshold value, this screenshot is considered for reclassification. All of those screenshots exceeding this second threshold form a second set of screenshots.

The next step of process <NUM> then creates a cross section of the first set of screenshots and the second set of screenshots. All the screenshots that belong to this cross section are re-grouped into the appropriate clusters. Hence, process <NUM> outputs more accurate clusters of screenshots and responses for each class, e.g., -<NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> etc. with "<NUM>" and "-<NUM>" being problematic cluster.

<FIG> shows the process <NUM> in detail.

Terminal <NUM> start the process <NUM>. Decision <NUM> asks if a user wants to regroup the screenshots in the problematic clusters "-<NUM>" and "<NUM>". If no, then a flowline goes to the terminal <NUM> that ends the process <NUM>. If yes, then the flowline leads to two different approaches, namely an image processing approach <NUM> and a natural language processing approach <NUM>.

In the image processing approach a training process <NUM> starts with the screenshot as and the associated cluster numbers as inputs. Hence, the image process approach has three inputs: i) the model <NUM> "Mobilenet" for transfer learning; ii) parameters <NUM> of the model, in particular Epoch, Batch-Size, etc, and iii) the screenshot as image data <NUM> and the associated cluster numbers. In two pre-processes the image data <NUM> is being prepared. The first pre-process <NUM> uses compressed images of the screenshots as input for an "image to matrix" process <NUM>. The second preprocess <NUM> uses as input the screenshot names and the associated labels for a "reorder class number" process <NUM>.

The training process <NUM> outputs a trained model <NUM>. This trained model <NUM> is applied in an evaluation process <NUM> to an input <NUM>, wherein the input <NUM> is the screenshots of the problematic clusters "-<NUM>" and "<NUM>". If the evaluation process <NUM> yields that a certain screenshot exceeds a first threshold value <NUM>, then the screenshot is re-grouped into the cluster that was determined in the evaluation process <NUM>. The first threshold value <NUM> determines the likelihood that the screenshot belongs in to the determined "new" class. All screenshots that exceed this first threshold value <NUM> form a first set <NUM> of screenshots.

In the natural language processing approach <NUM> a training process <NUM> starts that uses extracted information HTML-Body of the websites that belong to the screenshots to train a model. The training process <NUM> has three inputs: i) a model <NUM> that shall be trained, wherein the model can be a Bidirectional LSTM if the Word2Vec model was used or Feed-Forward Neural Network if TF-IDF model was used; ii) parameters <NUM> of the model, in particular Epoch, Batch-Size, etc, and iii) the extracted HTML-Body information <NUM> is by eliminating 'tags like <html><\html>, <body>. ' and stop words like 'is', 'the', 'a' which are meaningless. Then we got the most important information as extracted information. The HTML-Body information <NUM> can need an appropriate reordering and labeling that matches the reordering and labeling of the screenshots in step <NUM>.

The HTML-Body information <NUM> is preprocessed in several steps. In step <NUM> a language model is selected. Decision <NUM> asks if the model shall use machine learning. If no, a flowline goes to the process <NUM> that trains a "TF-IDF-Model". As a further input process <NUM> gets a "dictionary from HTML <NUM>" that is based on the data set <NUM> of CSV with screenshot names, status codes and HTML bodies of the websites. The process <NUM> outputs a trained TF-IDF model <NUM>. If yes, flowline goes to the process <NUM> to train a "word2vec" model. As a further input process <NUM> gets a "dictionary from HTML <NUM>" that is based on the data set <NUM> of CSV with screenshot names, status codes and HTML bodies of the websites. The process <NUM> outputs a trained "word2vec" <NUM> model.

Depending on the answer of the decision <NUM>, the trained "word2vec" model <NUM> or the trained TF-IDF model <NUM> enter a "word to vector: HTML analysis process <NUM> that creates as output the HTML-Body information <NUM> used for the training process <NUM>.

The training process <NUM> creates a model <NUM> that is based on "HTML"-responses of the webpages. This trained model <NUM> is applied in an evaluation process <NUM> to an input <NUM>, wherein the input <NUM> the HTML data extracted of the webpages whose screenshots are inside the problematic clusters "-<NUM>" and "<NUM>". If the evaluation process <NUM> yields that a certain screenshot exceeds a second threshold value <NUM>, then the website or respectively the screenshot is re-grouped into the cluster that was determined in the evaluation process <NUM>. Since every website is uniquely assigned to a screenshot, the re-grouping can be done with the screenshots as well. The second threshold value <NUM> determines the likelihood that the screenshot belongs in to the determined "new" class. All screenshots that exceed this second threshold value <NUM> form a second set of <NUM> screenshots.

The next step of process <NUM> then creates a cross section <NUM> or Joint section <NUM> of the first set of screenshots <NUM> and the second set of screenshots <NUM>. All the screenshots that belong to this cross section are re-grouped into the appropriate clusters in an update process <NUM>. Hence, process <NUM> outputs more accurate clusters of screenshots and responses for each class, e.g., - <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> etc. with "<NUM>" and "-<NUM>" being problematic cluster.

<FIG> shows an illustrative output of process <NUM> of Fig. 2a. The screenshot S: <NUM>; R: <NUM> was re-grouped in Cluster <NUM> and the screenshot S: <NUM>; R: <NUM><NUM> was re-grouped in Cluster <NUM>. However, even after process <NUM> is finished they can still remain elements within cluster "-<NUM>" and "<NUM>".

The process <NUM> triggers a "response-based single/multi-level clustering" and yields a further clustering of cluster "<NUM>" and "-<NUM>" of each class to make the method even more efficient.

In process <NUM> a supervised response-based learning was applied. In contrast, process <NUM> now applies and unsupervised response-based learning by performing the following steps: Apply a response-based unsupervised learning using a deep learning "word2vec" natural language processing model (e.g., from genism or scikit-learn). Run this algorithm on the remaining clusters "<NUM>" and "-<NUM>" to further cluster these two clusters based on the corresponding http-responses. Depending on the number of remaining screenshots in the problematic clusters "<NUM>" and "-<NUM>", the clustering can be single or multi-level. If the multi-level approach shall be performed, then the prime leaders of the model can be further retuned/refined from level to level.

Unsupervised learning is especially suited to find similarities of the elements to which it is applied. In contrast to the supervised learning, it is not possible to regroup the clusters that have determined by the unsupervised algorithm into the already existing clusters because there is no "correct" reference data. Hence, the new clusters of process <NUM> are adults to the already existing list of clusters. Process <NUM> yields as an output a further clustering of cluster "<NUM>" and "-<NUM>" for each class.

Terminal <NUM> start the process <NUM>. Decision <NUM> asks if further clustering the problematic clusters "<NUM>" and "-<NUM>" shall be performed using response information. If no, a flowline goes to terminal <NUM> that terminates process <NUM>. If yes, a level <NUM> clustering process <NUM> starts that users response information from the HTML body. Lower clustering process <NUM> has different inputs: i) a clustering algorithm and ii) the elements of the problematic clusters "<NUM>" and "-<NUM>".

Input i) starts with a process <NUM> of cluster algorithm selection. Decision <NUM> asks if the algorithm shall be density based. If no, then process <NUM> selects a "KMEANS" or "TREE" algorithm with respective parameters <NUM>. If yes, then process <NUM> selects "DBSCAN" with respective parameters <NUM>.

Input ii) starts with step <NUM> in which a language model is selected. Decision <NUM> asks if the model shall use machine learning. If no, a flowline goes to the process <NUM> that trains a "TF-IDF-Model". As a further input process <NUM> gets a "dictionary from HTML <NUM>" that is based on a data set <NUM> of the elements of the problematic clusters "-<NUM>" and "<NUM>" that can comprise screenshot names, status codes and HTML bodies of the websites. The process <NUM> outputs a TF-IDF model <NUM>. If yes, flowline goes to the process <NUM> to train a "word2vec" model. As a further input process <NUM> gets a "dictionary from HTML <NUM>" that is based on the data set <NUM> of the elements of the problematic clusters "-<NUM>" and "<NUM>" that can comprise screenshot names, status codes and HTML bodies of the websites. The process <NUM> outputs a "word2vec" <NUM> model. Depending on the answer of the decision <NUM>, the "word2vec" model <NUM> or the trained TF-IDF model <NUM> enter a "word2vec: HTML analysis process <NUM>. However, the data of the output of process <NUM> can be further compressed. Therefore, process <NUM> selects of compression algorithm. Decision <NUM> asks if a nonlinear relation needed. If no, then a flowline goes to a PCA algorithm to compress the data of the process <NUM> and to yield the compressed data <NUM> as input for the level <NUM> clustering process <NUM>. If yes, then a flowline goes to an Auto-Encoder model to compress the data of the process <NUM> and to yield the compressed data <NUM> as input for the level <NUM> clustering process <NUM>.

The level <NUM> clustering process <NUM> then runs with respective parameters <NUM>. If the user wishes, further clustering processes level <NUM><NUM>,. , and level n <NUM> can be performed with tuned parameters.

Process <NUM> then creates at least one cluster for the new determined clusters and outputs the result before terminal <NUM> end the process <NUM>.

<FIG> shows an illustrative output of process <NUM> of Fig. 2a. The further clustering cluster "<NUM>" and "-<NUM>" for each class can lead to the effect that all or some the elements of former cluster "-<NUM>" are now classified in cluster <NUM>.

Claim 1:
A method for automatic and dynamic clustering of IT-services and/or IT-systems, comprising the following steps performed by a computer system:
- as a first step (<NUM>), inputting a list of IT-services to the computer system, wherein the list of the IT-services comprises multiple IT-service-information that characterizes each of the IT-services;
- as a second step (<NUM>), classifying the IT-services into different classes based on a first piece of the IT-service-information;
- as a third step (<NUM>, <NUM>), clustering the IT-services within at least one of the different classes based on a second piece of the IT-service-information or a third piece of the IT-service-information;
- as a fourth step (<NUM>), outputting at least one class with at least one cluster of IT-services,
characterised in that
- an association to a certain class and/or to a certain cluster indicates a similarity of the IT-services within that certain class and/or to that certain cluster,
- the similarity is a security vulnerability similarity
- the first IT-service-information is a status-code of the IT-service, wherein the second IT-service-information is a screenshot of the IT-service, wherein the third IT-service-information is extracted from a HTML-Body of the IT-service,
- all IT-services within the certain class and/or the certain cluster have similar properties and are handled in a uniform way by companies, wherein automated scripts perform certain tasks on the IT-service based on its class and/or cluster membership.