Patent Document ID: 9667642
Application ID: 14243791
Patent Flag: 1

Claim One:
1. A method for associating current hosts with hosts identified in the past, the method comprising: receiving in computer memory a data structure representing first hosts, and one or more attributes, obtained with a network scanner, corresponding to each first host, wherein the one or more attributes corresponding to each first host include at least an Internet Protocol (IP) address; receiving in the computer memory a data structure representing second hosts, and one or more attributes, obtained with the network scanner, corresponding to each second host, wherein the one or more attributes corresponding to each second host include at least an IP address, and the second hosts having been discovered during a point-in-time assessment completed by a first prior time; receiving in the computer memory a set of matching rules; executing a matching program to generate a data structure comprising comparison scores, where each comparison score is associated with a different pairing of one of the first hosts and one of the second hosts and is determined based on one or more of the matching rules and an analysis of two or more attributes, wherein at least one of the two or more attributes is an IP address, wherein at least one comparison score from the data structure comprising comparison scores is associated with a pairing of one of the first hosts and one of the second hosts that both correspond to a same physical device, and wherein the one of the first hosts and the one of the second hosts that both correspond to the same physical device each have a different value for a same corresponding attribute; identifying an identical host in the first hosts and the second hosts, wherein identifying comprises comparing the comparison scores to each other to identify a comparison score, from the data structure comprising comparison scores, that is indicative of a possible match between the two hosts associated with the identified comparison score, and comparing the identified comparison score to a threshold, wherein the identified comparison score exceeding the threshold indicates that the two hosts associated with the identified comparison score are the same host; determining that the two hosts associated with the identified comparison score correspond to the same physical device when the identified comparison score exceeds the threshold; and generating a data structure associating at least some of the first hosts with at least some of the second hosts based on at least some of the comparison scores, wherein the data structure associating at least some of the first hosts with at least some of the second hosts is used for a network vulnerability assessment.