BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to computer technology, and more particularly but not exclusively to methods and systems for identifying critical network assets of private computer networks.

DESCRIPTION OF THE BACKGROUND ART

Organizations, such as corporations and other entities with a plurality of users, may maintain a private computer network that comprises a plurality of network devices, such as servers, end user computers, routers, etc. The private computer network may restrict access to services by providing and maintaining computer accounts (“accounts”). A user may log into his account to use a service provided by a server (e.g., email server, file server). Accounts and network devices are examples of network assets (“assets”) of the private computer network. However, not all assets have equal importance to an organization. More particularly, some assets, which are referred to herein as “critical assets,” are more important than others. As an example, a file server provides storage space for a plurality of users. Accordingly, file servers, and servers in general, are more critical to the functionality of the private computer network compared to computers that are used by a single user or sparingly used by a few users. As another example, an administrator account, which has administrator privileges, is more critical to the functionality of the private computer network compared to a normal user account.

Embodiments of the present invention are directed to automatic identification of critical assets of a private computer network so that these assets may be provided more or enhanced security, thereby improving the overall functionality and operation of the private computer network.

SUMMARY

In one embodiment, critical network assets of a private computer are automatically identified by training a machine learning model with histograms of features obtained by aggregating data of log entries. The model is deployed in a private computer network and retrained using a training data set of the private computer network. Data from log entries of a target network asset are aggregated, numerically transformed, and converted into features histograms. The features histograms are concatenated into a single file, which is provided to the machine learning model for prediction. The machine learning model outputs a prediction score that gives an indication of whether or not the target network asset is critical.

These and other features of the present invention will be readily apparent to persons of ordinary skill in the art upon reading the entirety of this disclosure, which includes the accompanying drawings and claims.

