Asset Ownership Identification: Using machine learning to predict enterprise asset ownership

TL;DR

This paper explores machine learning techniques to accurately predict enterprise asset ownership, aiding security efforts by identifying vulnerabilities and attack surfaces through data-driven classification models.

Contribution

The study compares multiple machine learning algorithms for asset owner prediction and introduces an interactive dashboard for model evaluation and data analysis.

Findings

Adaboost achieved the lowest testing error below 5%.

Naive Bayes performed the worst among tested models.

FQDN, CIDR, and location are key features for prediction.

Abstract

Asset owner identification is an important first step for any information security organization, allowing organizations the ability to identify and detect data breaches and losses, vulnerabilities, possible attack surfaces, and define effective countermeasures. Using existing asset ownership data, the research utilized an assortment of machine learning algorithms to determine the best classification model to predict an asset's owner. The research ran separate analyses for each enumerated team, then ran a 100 iteration Monte Carlo Cross Validation across Adaboost, Logistic Regression, Naive Bayes, Classification and Regression Trees, and Random Forests. Finally, a visualization dashboard was created to help users understand the asset inventory through interactive exploratory data analysis as well as the ability to understand model evaluation metrics including accuracy, sensitivity, and specificity for each model. Overall, Adaboost performed the best across all owners with low testing errors below 5% while Naive Bayes performed the worst. The remaining models performed similarly. The fully qualified domain name (FQDN), Classless Inter-Domain Routing (CIDR) CIDR/16, and location were among the most important features.