# US 12,003,383 B2 · Fingerprinting assisted by similarity-based semantic clustering

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,383 B2
- Document ID: US12003383B2
- Status: Granted
- Kind: B2
- Application number: 17/362,770
- Filed: 2021-06-29
- Published: 2022-11-03
- Granted: 2024-06-04
- Earliest claimed: 2021-04-29
- Assignees: Forescout Technologies, Inc.
- Applicants: Forescout Technologies, Inc.
- Inventors: Elisa Costante; Daniel Ricardo dos Santos; Guillaume François Christophe Dupont
- Web page: https://patentgrep.com/patent/US12003383B2

## CPC

- H04L 41/0893: Assignment of logical groups to network elements
- H04L 41/14: Network analysis or design
- G06N 5/04: Inference or reasoning models
- G06N 20/00: Machine learning
- H04L 41/12: Discovery or management of network topologies
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/1433: {Vulnerability analysis}
- G06N 5/025: Extracting rules from data
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Systems, methods, and related technologies for classification are described. Entity attribute data associated with network entities is obtained. One or more entity attributes for classifying a set of entities is determined based on the entity attribute data. A set of entities coupled to a network are monitored. Values of the one or more entity attributes for the plurality of entities is identified. The set of entities are clustered into one or more entity clusters based on a similarity of the one or more entity attributes for the entities. An entity fingerprinting action is then performed based on the entity clusters.

## Claims

### Claim 1

A method comprising:
accessing entity attribute data associated with network entities;
determining one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
monitoring a plurality of entities coupled to a network;
identifying values for the one or more entity attributes for the plurality of entities;
determining a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
determining a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function determined for each of the one or more entity attributes;
clustering, by a processing device, the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities; and
after clustering the plurality of entities, performing an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.

### Claim 2 (depends on 1)

The method of claim 1, wherein performing the entity fingerprinting action comprises:
providing the plurality of entity clusters for manual rule generation.

### Claim 3 (depends on 1)

The method of claim 1, wherein performing the entity fingerprinting action comprises:
determining one or more fingerprinting rule recommendations based on the plurality of entity clusters.

### Claim 4 (depends on 1)

The method of claim 1, wherein performing the entity fingerprinting action comprises:
automatically fingerprinting at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.

### Claim 5 (depends on 1)

The method of claim 1, wherein clustering the plurality of entities into the plurality of entity clusters based on the similarity of the one or more entity attributes comprises:
determining a similarity of each of the one or more entity attributes across the plurality of entities coupled to the network; and
identifying the plurality of entity clusters based on the similarity of each of the one or more entity attributes.

### Claim 6 (depends on 5)

The method of claim 5, wherein clustering the plurality of entities into the plurality of entity clusters comprises performing density-based clustering of the plurality of entities based on the one or more entity attributes associated with each entity of the plurality of entities.

### Claim 7

A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
obtain entity attribute data associated with network entities;
determine one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
monitor a plurality of entities coupled to a network;
identify values for the one or more entity attributes for the plurality of entities;
determine a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
determine a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function for each of the one or more entity attributes;
cluster the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities; and
after clustering the plurality of entities, perform an entity fingerprinting action on one or more entities included in a first cluster of the plurality of entity clusters based on at least one entity attribute of the first cluster, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.

### Claim 8 (depends on 7)

The system of claim 7, wherein to perform the entity fingerprinting action, the processing device is to:
provide the plurality of entity clusters for manual rule generation.

### Claim 9 (depends on 7)

The system of claim 7, wherein to perform the entity fingerprinting action, the processing device is to:
determine one or more fingerprinting rule recommendations based on the plurality of entity clusters.

### Claim 10 (depends on 7)

The system of claim 7, wherein to perform the entity fingerprinting action, the processing device is to:
automatically fingerprint at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.

### Claim 11 (depends on 7)

The system of claim 7, wherein to cluster the plurality of entities into the plurality of entity clusters based on the similarity of the one or more entity attributes, the processing device is to:
determine a similarity of each of the one or more entity attributes across the plurality of entities coupled to the network; and
identify the plurality of entity clusters based on the similarity of each of the one or more entity attributes.

### Claim 12 (depends on 11)

The system of claim 11, wherein to cluster the plurality of entities into the plurality of entity clusters, the processing device is to:
perform density-based clustering of the plurality of entities based on the one or more entity attributes associated with each entity of the plurality of entities.

### Claim 13

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access entity attribute data associated with network entities;
determine one or more entity attributes for classifying a plurality of entities based on the entity attribute data;
monitor a plurality of entities coupled to a network;
identify values for the one or more entity attributes for the plurality of entities;
determine a similarity function for each of the one or more entity attributes based on a type of attribute value associated with each of the one or more entity attributes, wherein the similarity function for each entity attribute is determined from a plurality of prestored similarity functions, with each similarity function of the plurality of similarity functions corresponding to a different type of data associated with the type of attribute value, and wherein each of the one or more entity attributes comprise semantically meaningful attribute values;
determine a similarity of the values of the one or more entity attributes for the plurality of entities based on the similarity function for each of the one or more entity attributes;
cluster, by the processing device, the plurality of entities into a plurality of entity clusters based on the similarity of the values of the one or more entity attributes for the plurality of entities;
identify at least one entity attribute of the one or more entity attributes of a first cluster of the plurality of entity clusters with a similarity of values that exceeds a threshold;
and
after clustering the plurality of entities, perform an entity fingerprinting action on one or more entities based on at least one entity attribute of a first cluster of the plurality of entity clusters, wherein the fingerprinting action is associated with classifying the network entities of the first cluster.

### Claim 14 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein to perform the entity fingerprinting action, the processing device is to:
provide the plurality of entity clusters for manual rule generation.

### Claim 15 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein to perform the entity fingerprinting action, the processing device is to:
determine one or more fingerprinting rule recommendations based on the plurality of entity clusters.

### Claim 16 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein to perform the entity fingerprinting action, the processing device is to:
automatically fingerprint at least one entity of the plurality of entities coupled to the network based on the plurality of entity clusters.

### Claim 17 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein to cluster the plurality of entities into the plurality of entity clusters based on the similarity of the one or more entity attributes, the processing device is further to:
determine a similarity of each of the one or more entity attributes across the plurality of entities coupled to the network; and
identify the plurality of entity clusters based on the similarity of each of the one or more entity attributes.