# US 10,375,099 B2 · Network device spoofing detection for information security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,099 B2 - Document ID: US10375099B2 - Status: Granted - Kind: B2 - Application number: 15/660,593 - Filed: 2017-07-26 - Published: 2019-01-31 - Granted: 2019-08-06 - Earliest claimed: 2017-07-26 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Rahul Isola; Equettis Twantwalon Jenkins - Web page: https://patentgrep.com/patent/US10375099B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system that includes a threat management server configured to store a device log identifying location information for endpoint devices that have passed authentication. The threat management server identifies a first instance and a second instance of an endpoint device in the device log file. The threat management server identifies a first switch connected to the first instance of the endpoint device and a second switch connected to the second instance of the endpoint device. The threat management server sends location information request to the first switch and the second switch requesting location information for the first instance and the second instance of the endpoint device, respectively. The threat management server compared the received location information to the information in the device log file to identify a spoofed instance of the endpoint device and blocks the spoofed instance of the endpoint device from accessing the communications network. ## Claims ### Claim 1 A system comprising: a threat management server in a network, comprising: a memory configured to store: a device log file identifying location information for endpoint devices that have passed authentication; a threat management engine implemented by a processor configured to: identify a first instance of an endpoint device in the device log file; identify a second instance of the endpoint device in the device log file; determine a device identifier for the endpoint device based on the device log file; identify a first switch connected the first instance of the endpoint device based on the device log file; send a first location information request comprising the device identifier to the first switch, wherein the first location information request requests location information for the first instance of the endpoint device; receive location information for the first instance of the endpoint device in response to sending the first location information request; identify a second switch connected to the second instance of the endpoint device based on the device log file; send a second location information request comprising the device identifier to the second switch, wherein the second location information request requests location information for the second instance of the endpoint device; receive location information for the second instance of the endpoint device in response to sending the second location information request; compare the location information for the first instance of the endpoint device and the location information for the second instance of the endpoint device to the location information for the endpoint device in the device log file; identify a spoofed instance of the endpoint device based on the comparison, wherein: the spoofed instance of the endpoint device is one of the first instance of the endpoint device and the second instance of the endpoint device; and identifying the spoofed instance of the endpoint device is based on a location mismatch between received location information and the location information for the endpoint device in the device log file; and block the spoofed instance of the endpoint device from accessing the network in response to identifying the spoofed instance of the endpoint device; the first switch operably coupled to the threat management server, configured to: receive the first location information request for the first instance of the endpoint device; identify the first instance of the endpoint device connected to the first switch; and send location information for the first instance of the endpoint device to the threat management server; and the second switch operably coupled to the threat management server, configured to: receive the second location information request for the second instance of the endpoint device; identify the second instance of the endpoint device connected to the first switch; and send location information for the second instance of the endpoint device to the threat management server. ### Claim 2 (depends on 1) The system of claim 1, wherein the threat management engine is configured to remove the spoofed instance of the endpoint device from a white list in response to blocking the spoofed instance of the endpoint device from accessing the network. ### Claim 3 (depends on 1) The system of claim 1, wherein the location mismatch is a geographic region mismatch for the endpoint device. ### Claim 4 (depends on 1) The system of claim 1, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and the blackhole command triggers a transformation of the destination of traffic associated with the spoofed instance of the endpoint device to a null destination. ### Claim 5 (depends on 1) The system of claim 1, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and the blackhole command triggers traffic associated with the spoofed instance of the endpoint device to be discarded. ### Claim 6 (depends on 1) The system of claim 1, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and the disable command disables a port the spoofed instance of the endpoint device is connected to. ### Claim 7 (depends on 1) The system of claim 1, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and the disable command triggers disconnecting electrical power to a port the spoofed instance of the endpoint device is connected to. ### Claim 8 A threat management server in a network, comprising: a memory configured to store: a device log file identifying location information for endpoint devices that have passed authentication; a threat management engine implemented by a processor configured to: identify a first instance of an endpoint device in the device log file; identify a second instance of the endpoint device in the device log file; determine a device identifier for the endpoint device based on the device log file; identify a first switch connected the first instance of the endpoint device based on the device log file; send a first location information request comprising the device identifier to the first switch, wherein the first location information request requests location information for the first instance of the endpoint device; receive location information for the first instance of the endpoint device in response to sending the first location information request; identify a second switch connected to the second instance of the endpoint device based on the device log file; send a second location information request comprising the device identifier to the second switch, wherein the second location information request requests location information for the second instance of the endpoint device; receive location information for the second instance of the endpoint device in response to sending the second location information request; compare the location information for the first instance of the endpoint device and the location information for the second instance of the endpoint device to the location information for the endpoint device in the device log file; identify a spoofed instance of the endpoint device based on the comparison, wherein: the spoofed instance of the endpoint device is one of the first instance of the endpoint device and the second instance of the endpoint device; and identifying the spoofed instance of the endpoint device is based on a location mismatch between received location information and the location information for the endpoint device in the device log file; and block the spoofed instance of the endpoint device from accessing the network in response to identifying the spoofed instance of the endpoint device. ### Claim 9 (depends on 8) The device of claim 8, wherein the threat management engine is configured to remove the spoofed instance of the endpoint device from a white list in response to blocking the spoofed instance of the endpoint device from accessing the network. ### Claim 10 (depends on 8) The device of claim 8, wherein the location mismatch is a geographic region mismatch for the endpoint device. ### Claim 11 (depends on 8) The device of claim 8, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and the blackhole command triggers a transformation of the destination of traffic associated with the spoofed instance of the endpoint device to a null destination. ### Claim 12 (depends on 8) The device of claim 8, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and the blackhole command triggers traffic associated with the spoofed instance of the endpoint device to be discarded. ### Claim 13 (depends on 8) The device of claim 8, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and the disable command disables a port the spoofed instance of the endpoint device is connected to. ### Claim 14 (depends on 8) The device of claim 8, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and the disable command triggers disconnecting electrical power to a port the spoofed instance of the endpoint device is connected to. ### Claim 15 A method comprising: identifying, by a threat management server, a first instance of an endpoint device in a device log file identifying location information for endpoint devices that have passed authentication; identifying, by the threat management server, a second instance of the endpoint device in the device log file; determining, by the threat management server, a device identifier for the endpoint device based on the device log file; identifying, by the threat management server, a first switch connected the first instance of the endpoint device based on the device log file; sending, by the threat management server, a first location information request comprising the device identifier to the first switch, wherein the first location information request requests location information for the first instance of the endpoint device; identifying, by the first switch, the first instance of the endpoint device connected to the first switch in response to receiving the first location information request; sending, by the first switch, location information for the first instance of the endpoint device to the threat management server; identifying, by the threat management server, a second switch connected to the second instance of the endpoint device based on the device log file; sending, by the threat management server, a second location information request comprising the device identifier to the second switch, wherein the second location information request requests location information for the second instance of the endpoint device; identifying, by the first switch, the second instance of the endpoint device connected to the first switch in response to receiving the second location information request; sending, by the first switch, location information for the second instance of the endpoint device to the threat management server; comparing, by the threat management server, the location information for the first instance of the endpoint device and the location information for the second instance of the endpoint device to the location information for the endpoint device in the device log file; identifying, by the threat management server, a spoofed instance of the endpoint device based on the comparison, wherein: the spoofed instance of the endpoint device is one of the first instance of the endpoint device and the second instance of the endpoint device; and identifying the spoofed instance of the endpoint device is based on a location mismatch between received location information and the location information for the endpoint device in the device log file; and blocking, by the threat management server, the spoofed instance of the endpoint device from accessing the network in response to identifying the spoofed instance of the endpoint device. ### Claim 16 (depends on 15) The method of claim 15, further comprising removing, by the threat management server, the spoofed instance of the endpoint device from a white list in response to blocking the spoofed instance of the endpoint device from accessing the network. ### Claim 17 (depends on 15) The method of claim 15, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and the blackhole command triggers a transformation of the destination of traffic associated with the spoofed instance of the endpoint device to a null destination. ### Claim 18 (depends on 15) The method of claim 15, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and the blackhole command triggers traffic associated with the spoofed instance of the endpoint device to be discarded. ### Claim 19 (depends on 15) The method of claim 15, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and the disable command disables a port the spoofed instance of the endpoint device is connected to. ### Claim 20 (depends on 15) The method of claim 15, wherein: blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and the disable command triggers disconnecting electrical power to a port the spoofed instance of the endpoint device is connected to.