Device and network classification based on probabilistic model

A system for automatic assignment of categories to network entities based on observed evidence, comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, cause:
• two or more agents gathering, from multiple sources across the network, observation data that identifies or informs observations made by the two or more agents about the network and a plurality of nodes of the network, wherein the observation data includes, for each of the plurality of nodes, traffic information, application-level information, and configuration information,
• wherein at least one source from which the two or more agents gather said observation data includes a catalog dataset comprising product information for at least one hardware manufacturer;
• the two or more agents, executing upon one or more computer systems across the network, providing the observation data to a classification module;
• and
• the classification module assigning a particular device category to each of the plurality of nodes based on the observation data and a probabilistic node model,
• wherein the probabilistic node model considers two or more of a set of probabilities to ascertain a recommended device category for a particular node, wherein the set of probabilities include:
• a first probability based on a manufacturer associated with the particular node, a second probability based on operating system associated with the particular node, a third probability based on other nodes in a local vicinity of the particular node on the network, and a fourth probability based on an administrator web page associated with the particular node.

A method for automatic assignment of categories to network entities based on observed evidence, comprising:

• two or more agents gathering, from multiple sources across the network, observation data that identifies or informs observations made by the two or more agents about the network and a plurality of nodes of the network, wherein the observation data includes, for each of the plurality of nodes, traffic information, application-level information, and configuration information,
• wherein at least one source from which the two or more agents gather said observation data includes a catalog dataset comprising product information for at least one hardware manufacturer;
• the two or more agents, executing across the network, providing the observation data to a classification module;
• and
• the classification module assigning a particular device category to each of the plurality of nodes based on the observation data and a probabilistic node model,
• wherein the probabilistic node model considers two or more of a set of probabilities to ascertain a recommended device category for a particular node, wherein the set of probabilities include:
• a first probability based on a manufacturer associated with the particular node, a second probability based on operating system associated with the particular node, a third probability based on other nodes in a local vicinity of the particular node on the network, and a fourth probability based on an administrator web page associated with the particular node.