System, method, and computer program product for securing a computer system from threats introduced by malicious transparent network devices

A network security method for detecting MAC'less/transparent devices, the method comprising:

• in a data repository, accumulating “fingerprint” data indicative of expected physical level characteristics for each of plural types of switch-device links interconnecting a switch and a hardware device, wherein at least one pair of links of different types differ from one another at least with respect to a chipset residing in the respective device connected to the respective switch by each respective link;
• reading physical level characteristics of links in at least one network to be protected;
• and
• generating alerts of possible presence of a transparent device along at least one link if the physical level characteristics of said at least one link, as read, is anomalous relative to said “fingerprint” data stored in said data repository, wherein
• the method also comprises using machine learning functionality to update the “fingerprint” data based on data, provided by at least one enterprise, indicating which alerts were false alarms, and
• central or client DB s are modified with information collected using said machine learning functionality.

A computer program product, comprising a non-transitory tangible computer readable medium having computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a network security method for detecting MAC'less/transparent devices, the method comprising:

• in a data repository, accumulating “fingerprint” data indicative of expected physical level characteristics for each of plural types of switch-device links interconnecting a switch and a hardware device, wherein at least one pair of links of different types differ from one another at least with respect to a chipset residing in the respective device connected to the respective switch by each respective link;
• reading physical level characteristics of links in at least one network to be protected;
• and
• generating alerts of possible presence of a transparent device along at least one link if the physical level characteristics of said at least one link, as read, is anomalous relative to said “fingerprint” data stored in said data repository, wherein
• the method also comprises using machine learning functionality to update the “fingerprint” data based on data, provided by at least one enterprise, indicating which alerts were false alarms, and
• central or client DB s are modified with information collected using said machine learning functionality.