# US 11,122,040 B1 · Systems and methods for fingerprinting devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,040 B1 - Document ID: US11122040B1 - Status: Granted - Kind: B1 - Application number: 16/233,366 - Filed: 2018-12-27 - Granted: 2021-09-14 - Earliest claimed: 2018-12-27 - Assignees: NortonLifeLock Inc. - Applicants: Symantec Corporation - Inventors: Yuqiong Sun; Xueqiang Wang; Susanta Nanda; Yun Shen; Pierre-Antoine Vervier; Petros Efstathopoulos - Web page: https://patentgrep.com/patent/US11122040B1 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed computer-implemented method for fingerprinting devices may include (i) detecting that a new device has attempted to connect to a network gateway, (ii) attempting to fingerprint the new device as an instance of a known candidate device type by (a) transmitting to the new device, from a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type and (b) confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type, and (iii) performing a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for fingerprinting devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting that a new device has attempted to connect to a network gateway; attempting to fingerprint the new device as an instance of a known candidate device type by: transmitting to the new device, by a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type; and confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type; and performing a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type; wherein the set of network messages is identified by: crawling an online application distribution platform; performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform; and detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the network gateway executes the security application. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the set of network messages is unique according to a backend server analysis of multiple device-specific applications. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the backend server analysis of multiple device-specific applications indicates that the second application is configured to transmit the set of network messages while a remainder of the multiple device-specific applications is not so configured. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the network message analysis comprises at least one of: dynamic analysis based on an execution of a respective device-specific application; static analysis based on disassembling code for the respective device-specific application; or symbolic execution of the respective device-specific application. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the new device comprises an Internet-of-things device. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein the second application is specific to the Internet-of-things device and comprises an Internet-of-things management application that executes on a user mobile device to pair the user mobile device with the Internet-of-things device and manage the Internet-of-things device. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein fingerprinting the new device comprises identifying at least two of: a make of the new device; a type of the new device; a model of the new device; and a firmware version of firmware installed on the new device. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the set of network messages is extracted based on an analysis of the second application. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the set of network messages is extracted based on the analysis of the second application without access to any instance of the known candidate device type. ### Claim 11 A system for fingerprinting devices, the system comprising: a detection module, stored in memory, that detects that a new device has attempted to connect to a network gateway; a fingerprinting module, stored in memory, that attempts to fingerprint the new device as an instance of a known candidate device type by: transmitting to the new device, as part of a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type; and confirming, as part of the security application and based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type; a performance module, stored in memory, that performs a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type; and at least one physical processor configured to execute the detection module, the fingerprinting module, and the performance module; wherein the fingerprinting module is configured to identify the set of network messages by: crawling an online application distribution platform; performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform; and detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications. ### Claim 12 (depends on 11) The system of claim 11, wherein the network gateway executes the security application. ### Claim 13 (depends on 11) The system of claim 11, wherein the set of network messages is unique according to a backend server analysis of multiple device-specific applications. ### Claim 14 (depends on 13) The system of claim 13, wherein the backend server analysis of multiple device-specific applications indicates that the second application is configured to transmit the set of network messages while a remainder of the multiple device-specific applications is not so configured. ### Claim 15 (depends on 11) The system of claim 11, wherein the network message analysis comprises at least one of: dynamic analysis based on an execution of a respective device-specific application; static analysis based on disassembling code for the respective device-specific application; or symbolic execution of the respective device-specific application. ### Claim 16 (depends on 11) The system of claim 11, wherein the new device comprises an Internet-of-things device. ### Claim 17 (depends on 16) The system of claim 16, wherein the second application is specific to the Internet-of-things device and comprises an Internet-of-things management application that executes on a user mobile device to pair the user mobile device with the Internet-of-things device and manage the Internet-of-things device. ### Claim 18 (depends on 11) The system of claim 11, wherein the fingerprinting module fingerprints the new device by identifying at least two of: a make of the new device; a type of the new device; a model of the new device; and a firmware version of firmware installed on the new device. ### Claim 19 (depends on 11) The system of claim 11, wherein the set of network messages is extracted based on an analysis of the second application. ### Claim 20 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: detect that a new device has attempted to connect to a network gateway; attempt to fingerprint the new device as an instance of a known candidate device type by: transmitting to the new device, by a security application, a set of network messages that mimic network messages that a second application is configured to transmit to instances of the known candidate device type; and confirming, by the security application based on a response from the new device to the set of network messages, that the new device is the instance of the known candidate device type; and perform a security action to protect a network corresponding to the network gateway based on confirming that the new device is the instance of the known candidate device type; wherein the set of network messages is identified by: crawling an online application distribution platform; performing a network message analysis for each one of multiple device-specific applications extracted from the online application distribution platform; and detecting, based on each respective network message analysis, a respective set of network messages that uniquely identifies each one of the multiple device-specific applications.