# US 10,320,619 B2 · Method and system for discovery and mapping of a network topology > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,619 B2 - Document ID: US10320619B2 - Status: Granted - Kind: B2 - Application number: 15/811,655 - Filed: 2017-11-13 - Published: 2018-05-17 - Granted: 2019-06-11 - Earliest claimed: 2016-11-12 - Assignees: Solana Networks Inc. - Applicants: Solana Networks Inc. - Inventors: Nabil Seddigh; Biswajit Nandy; Rupinder Singh Makkar; Craig Dillabaugh; Kevin Wong - Web page: https://patentgrep.com/patent/US10320619B2 ## CPC - H04L 41/12: Discovery or management of network topologies - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for discovery and mapping of industrial control and SCADA networks are described herein. The disclosed systems and methods help operators ensure the cyber security of their SCADA network through accurate discovery, fingerprinting and mapping the industrial control network map, including PLCs (Programmable Logic Controller) and RTUs (Remote Terminal Unit), using passive techniques. ## Claims ### Claim 1 A method for discovering topology of a network comprising a Layer 3 and a Layer 2, the method comprising: employing at least one hardware processor for: discovering a first Layer 3 network topology by examining routing protocols using route analytics method; discovering a second Layer 3 network topology using information from at least one of Simple Network Management Protocol (SNMP) and Source Shell/Command Line Interface/Telnet login to a router; and merging and deduplicating the first discovered Layer 3 network topology and the second discovered Layer 3 network topology to obtain a resultant Layer 3 network topology that includes a plurality of routers and associated links between the routers. ### Claim 2 (depends on 1) The method of claim 1, further comprising using the resultant Layer 3 network topology to identify a plurality of subnets in Layer 2 corresponding to each of the plurality of routers by: retrieving a list of active interfaces for each discovered router; and discovering routable subnets on each active interface using a combination of information from the SNMP and the routing protocols. ### Claim 3 (depends on 2) The method of claim 2, further comprising detecting a plurality of active devices and a plurality of silent devices in each of the plurality of identified subnets in Layer 2 to discover topology of the Layer 2 of the network. ### Claim 4 (depends on 3) The method of claim 3, further comprising merging and deduplicating the discovered topology of the Layer 2 with the resultant topology of the Layer 3 to discover a full Layer 2/3 topology. ### Claim 5 (depends on 3) The method of claim 3, wherein the detecting of silent devices comprises monitoring and analyzing network traffic flow information and examining data obtained from the plurality of routers and a plurality of switches in the Layer 2. ### Claim 6 (depends on 5) The method of claim 5, wherein the analyzing traffic flow information further comprises determining IP addresses of devices that are sending and/or receiving traffic-flow, and ensuring the traffic-flow is bi-directional. ### Claim 7 (depends on 5) The method of claim 5, wherein the examining data comprises using at least one of SNMP and Command Line Interface (CLI) to examine Address Resolution Protocol (ARP) tables and Address Forwarding Tables (AFT) of the plurality of switches. ### Claim 8 (depends on 3) The method of claim 3, further comprising classifying the detected plurality of active and silent devices, comprising: fusing data from at least two classification methods; obtaining a certainty level for device classification by combining certainty levels for type of device outputted from the at least two classification methods; and using the certainty level to identify device type and class. ### Claim 9 (depends on 8) The method of claim 8, wherein the at least two classification methods include any two of the SNMP analysis, Media Access Control (MAC) analysis and network traffic-flow analysis. ### Claim 10 (depends on 1) The method of claim 1, wherein the merging and deduplicating of the first discovered Layer 3 network topology and the second discovered Layer 3 network topology further comprises: distilling the first and second discovered network topologies into a plurality of nodes and links; searching the plurality of nodes in the first and the second discovered Layer 3 network topology; identifying a plurality of candidate nodes in the second discovered topology that are not present in the first discovered topology, and add the candidate nodes to the first discovered topology; searching the plurality of links in the first and the second discovered Layer 3 network topology; discarding links found in the second discovered topology that also exists in the first discovered topology; identifying a plurality of candidate links in the second discovered topology that are not present in the first discovered topology; and using information from the SNMP and the routing protocols to validate a set of links from the plurality of candidate links and add the validated set of links to the first discovered topology. ### Claim 11 (depends on 1) The method of claim 1, comprising discovering the topology of a Supervisory Control and Data Acquisition (SCADA) network. ### Claim 12 A system for discovering topology of a network comprising a Layer 3 and a Layer 2, the system comprising: at least one hardware processor, and computer readable storage medium having computer readable instructions stored thereon for execution by the processor, causing the processor to: discover a first Layer 3 network topology by examining routing protocols using route analytics method; discover a second Layer 3 network topology using information from at least one of Simple Network Management Protocol (SNMP) and Source Shell/Command Line Interface/Telnet login to a router; and merge and deduplicate the first discovered Layer 3 network topology and the second discovered Layer 3 network topology to obtain a resultant Layer 3 network topology that includes a plurality of routers and associated links between the routers. ### Claim 13 (depends on 12) The system of claim 12, wherein the computer readable instructions further cause the processor to use the resultant Layer 3 network topology to identify a plurality of subnets in Layer 2 corresponding to each of the plurality of routers by: retrieving a list of active interfaces for each discovered router; and discovering routable subnets on each active interface using a combination of information from the SNMP and the routing protocols. ### Claim 14 (depends on 13) The system of claim 13, wherein the computer readable instructions further cause the processor to detect a plurality of active devices and a plurality of silent devices in each of the plurality of identified subnets in Layer 2 to discover topology of the Layer 2 of the network. ### Claim 15 (depends on 14) The system of claim 14, wherein the computer readable instructions further cause the processor to merge and deduplicate the discovered topology of the Layer 2 with the resultant topology of the Layer 3 to discover a full Layer 2/3 topology. ### Claim 16 (depends on 14) The system of claim 14, wherein the computer readable instructions further cause the processor to detect silent devices by monitoring and analyzing network traffic flow information and examining data obtained from the plurality of routers and a plurality of switches in the Layer 2. ### Claim 17 (depends on 16) The system of claim 16, wherein the computer readable instructions further cause the processor to determine IP addresses of devices that are sending and/or receiving traffic-flow, and ensuring the traffic-flow is bi-directional. ### Claim 18 (depends on 16) The system of claim 16, wherein the computer readable instructions further cause the processor to use at least one of SNMP and Command Line Interface (CLI) to examine Address Resolution Protocol (ARP) tables and Address Forwarding Tables (AFT) of the plurality of switches for the examining data. ### Claim 19 (depends on 14) The system of claim 14, wherein the computer readable instructions further cause the processor to classify the detected plurality of active and silent devices by: fusing data from at least two classification methods; obtaining a certainty level for device classification by combining certainty levels for type of device outputted from the at least two classification methods; and using the certainty level to identify device type and class. ### Claim 20 (depends on 19) The system of claim 19, wherein the computer readable instructions further cause the processor to classify according to any two classification methods, consisting of the SNMP analysis, Media Access Control (MAC) analysis and network traffic-flow analysis. ### Claim 21 (depends on 12) The system of claim 12, wherein the computer readable instructions further cause the processor to merge and deduplicate of the first discovered Layer 3 network topology and the second discovered Layer 3 network topology, comprising: distilling the first and second discovered network topologies into a plurality of nodes and links; searching the plurality of nodes in the first and the second discovered Layer 3 network topology; identifying a plurality of candidate nodes in the second discovered topology that are not present in the first discovered topology, and add the candidate nodes to the first discovered topology; searching the plurality of links in the first and the second discovered Layer 3 network topology; discarding links found in the second discovered topology that also exists in the first discovered topology; identifying a plurality of candidate links in the second discovered topology that are not present in the first discovered topology; and using information from the SNMP and the routing protocols to validate a set of links from the plurality of candidate links and add the validated set of links to the first discovered topology. ### Claim 22 A network comprising a plurality of routers, comprising: a system for discovering topology of a network comprising a Layer 3 and a Layer 2, the system comprising: at least one hardware processor, and computer readable storage medium having computer readable instructions stored thereon for execution by the processor, causing the processor to: discover a first Layer 3 network topology by examining routing protocols using route analytics method; discover a second Layer 3 network topology using information from at least one of Simple Network Management Protocol (SNMP) and Source Shell/Command Line Interface/Telnet login to a router; and merge and deduplicate the first discovered Layer 3 network topology and the second discovered Layer 3 network topology to obtain a resultant Layer 3 network topology that includes a plurality of routers and associated links between the routers.