Systems and methods for network device discovery and vulnerability assessment
AssigneeFortinet, Inc.
InventorHaitao Li
Life of this patent
Estimating the term…
Abstract
Various embodiments are discussed that provide systems and methods for identifying possible unsecured devices on a network. In some cases, embodiments discussed relate to systems and methods for identifying possible unsecured devices; clustering the identified devices with other similar devices, and/or determining default or simplified access processes for a given cluster of the identified devices.
Claims20
A method for identifying network vulnerabilities through reducing a number of characterizations used to identify a problematic network element, the method comprising:
- forming, by a processor, a first device cluster, wherein the first device cluster includes:
- at least a first Internet Protocol (IP) address corresponding to a first type of network device, and a first device cluster fingerprint;
- forming, by the processor, a second device cluster, wherein the second device cluster includes:
- at least a second IP address corresponding to a second type of network device, and a second device cluster fingerprint;
- forming, by the processor, a third IP address fingerprint of a third IP address;
- comparing, by the processor, the third IP address fingerprint to at least the first device cluster fingerprint of the first device cluster, wherein the third IP address identifies an accessed network device that is similar to the first type of network device, and wherein comparing the third IP address fingerprint to the first device cluster fingerprint includes:
- calculating a Jaccard index between the third IP address fingerprint and the first device cluster fingerprint;
- and
- comparing the Jaccard index with a threshold;
- and
- adding, by the processor, the third IP address and the third IP address fingerprint to the first device cluster based at least in part on the comparing the third IP address to the first device cluster.
A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources of a computer system, causes the one or more processing resources to perform a method for identifying network vulnerabilities through reducing a number of characterizations used to identify a problematic network element comprising:
- forming a first device cluster, wherein the first device cluster includes:
- at least a first Internet Protocol (IP) address corresponding to a first type of network device, and a first device cluster fingerprint;
- forming a second device cluster, wherein the second device cluster includes:
- at least a second IP address corresponding to a second type of network device, and a second device cluster fingerprint;
- forming a third IP address fingerprint of a third IP address;
- comparing the third IP address fingerprint to at least the first device cluster fingerprint of the first device cluster, wherein the third IP address identifies an accessed network device that is similar to the first type of network device, and wherein comparing the third IP address fingerprint to the first device cluster fingerprint includes:
- calculating a Jaccard index between the third IP address fingerprint and the first device cluster fingerprint;
- and
- comparing the Jaccard index with a threshold;
- and
- adding the third IP address and the third IP address fingerprint to the first device cluster based at least in part on the comparing the third IP address to the first device cluster.
A network device discovery system for identifying network vulnerabilities through reducing a number of characterizations used to identify a problematic network element, the system comprising:
- at least one processor;
- a memory, wherein the memory includes instructions executable by the at least one processor to:
- form a first device cluster, wherein the first device cluster includes:
- at least a first Internet Protocol (IP) address corresponding to a first type of network device, and a first device cluster fingerprint;
- form a second device cluster, wherein the second device cluster includes:
- at least a second IP address corresponding to a second type of network device, and a second device cluster fingerprint;
- form a third IP address fingerprint of a third IP address;
- compare the third IP address fingerprint to at least the first device cluster fingerprint of the first device cluster, wherein the third IP address identifies an accessed network device that is similar to the first type of network device, and wherein comparing the third IP address fingerprint to the first device cluster fingerprint includes:
- calculating a Jaccard index between the third IP address fingerprint and the first device cluster fingerprint;
- and
- comparing the Jaccard index with a threshold;
- and
- add the third IP address and the third IP address fingerprint to the first device cluster based at least in part on the comparing the third IP address to the first device cluster.
Dependencies are inferred from the claim text.