Back to results
US 11,108,799 B2Granted
Name translation monitoring
AssigneeForescout Technologies, Inc.
InventorsOded Comay, Oren Nechushtan
Life of this patent
Estimating the term…
Abstract
Systems, methods, and related technologies for analyzing traffic based on naming information are described. In certain aspects, name information and address information from a name translation response are stored. The name information is associated with a device based on the device sending a communication to an address associated with the name information.
Claims11
A method comprising:
- accessing network traffic;
- accessing name translation traffic from the network traffic;
- accessing name information and address information from the name translation traffic;
- storing the name and address information;
- accessing subsequent network traffic sent by a device, wherein the network traffic includes address information;
- determining a match between address information of the subsequent network traffic and the address information of the name translation traffic;
- associating network traffic from the device with the name information;
- determining a session classification based on the name information;
- classifying the device based on the name information;
- and
- assigning a security policy to the classified device, wherein the security policy is assigned based on the classification of the device.
8 more elements
A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
- access a first packet comprising name information and address information;
- store the name information and address information;
- monitor network traffic for an address matching the stored address information;
- determine a match between an address portion of a second packet and the stored address information, wherein a device is the sender of the second packet;
- and
- determining a characteristic associated with the device that sent the second packet based on the name information associated with the stored address information, wherein the characteristic associated with the device comprises a classification of the device;
- wherein the characteristic associated with the device comprises a session classification of the device;
- and
- assigning a security policy to the device, wherein the security policy is assigned based on the session classification of the device.
6 more elements
Dependencies are inferred from the claim text.