Abstract: Systems, methods, and related technologies for a proactive inspection system for improved classification of devices are described. A device is discovered on a network that has a first open port number. A file is requested from the device with the first open port number and a filename. The filename has a highest likelihood of being used as a name for the file with the port number. In response to obtaining the file from the device, the device is classified with information held in the file.

Abstract: Systems and methods for determining a risk associated with an entity based on exposed services are described. The risk determination may include determining one or more services exposed by ports of an entity and determining a level of exposure associated with the service corresponding to each of the one or more open ports of the entity. A risk level associated with the entity based at least in part on the level of exposure associated with the service corresponding to each of the one or more open ports of the entity.

Abstract: Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.

Abstract: Systems, methods, and related technologies for determining a risk score or value are described. The risk score determination may include accessing network traffic from a network, where the network traffic is associated with a plurality of entities. One or more values associated with one or more properties associated with an entity are determined. The one or more values may be based on the network traffic. At least one of a functional risk value, a configurational risk value, or a behavioral risk value associated with the entity are determined. A risk value for the entity is determined based on the functional risk value and at least one of the configurational risk value or the behavioral risk value associated with the entity.

Abstract: Systems and methods are provided for detecting anomalous messages on a multipoint serial communications bus by extracting features from a first and a second message, including a time delay between the first and the second messages and, for each message, a sender address, a recipient address, a bus number, and a word count. A message transition pattern including the extracted features is generated. A probability of occurrence of the message transition pattern is determined by comparing the message transition pattern to a pattern dictionary, and the second message is determined to be anomalous when the probability is less than a predetermined threshold.