# US 12,009,986 B2 · Proactive inspection technique for improved classification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,009,986 B2 - Document ID: US12009986B2 - Status: Granted - Kind: B2 - Application number: 18/056,561 - Filed: 2022-11-17 - Published: 2023-10-05 - Granted: 2024-06-11 - Earliest claimed: 2022-04-01 - Assignees: Forescout Technologies, Inc. - Applicants: Forescout Technologies, Inc. - Inventors: Naor Kalbo - Web page: https://patentgrep.com/patent/US12009986B2 ## CPC - H04L 41/12: Discovery or management of network topologies - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and related technologies for a proactive inspection system for improved classification of devices are described. A device is discovered on a network that has a first open port number. A file is requested from the device with the first open port number and a filename. The filename has a highest likelihood of being used as a name for the file with the port number. In response to obtaining the file from the device, the device is classified with information held in the file. ## Claims ### Claim 1 A method comprising: discovering a device on a network that has a first open port number; obtaining a filename that has a highest likelihood of being used as a name for a file with the first open port number; requesting the file from the device with the first open port number and the filename; and in response to obtaining the file from the device, classifying the device with information held in the file. ### Claim 2 (depends on 1) The method of claim 1, further comprising: in response to failing to obtain the file from the device with the filename and the first open port number, requesting the file from the device with the first open port number and a second filename that has a second highest likelihood of being used as the name for the file with the first open port number. ### Claim 3 (depends on 1) The method of claim 1, further comprising: in response to a failure of obtaining the file with the first open port number, requesting the file from the device with a second open port number and a second filename that has a highest likelihood of being used as the name for the file with the second open port number. ### Claim 4 (depends on 1) The method of claim 1, wherein obtaining the filename includes referencing the first open port number in a data storage that comprises a plurality of port numbers, wherein each of the plurality of port numbers has associated to it, one or more filenames that are ranked in order of likelihood of being used as the name for the file at a respective one of the plurality of port numbers. ### Claim 5 (depends on 4) The method of claim 4, further comprising ignoring a candidate filename of the one or more filenames from the data storage if a probability or a success rate of the candidate filename does not satisfy a respective threshold. ### Claim 6 (depends on 5) The method of claim 5, further comprising updating the success rate of the filename with respect to the first open port number in the data storage, in view of whether or not the file was obtained from the device with the filename and the first open port number. ### Claim 7 (depends on 1) The method of claim 1, wherein the device is universal plug and play (UPnP) enabled. ### Claim 8 (depends on 1) The method of claim 1, wherein requesting the file from the device includes sending an (hypertext transfer protocol) HTTP GET request to the device, comprising an IP address of the device, the first open port number of the device, and the filename of the file. ### Claim 9 A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to: discover a device on a network that has a first open port number; obtain a filename that has a highest likelihood of being used as a name for a file with the first open port number; request the file from the device with the first open port number and the filename; and in response to obtaining the file from the device, classify the device with information held in the file. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the processing device is further to: in response to failing to obtain the file from the device with the filename and the first open port number, request the file from the device with the first open port number and a second filename that has a second highest likelihood of being used as the name for the file with the first open port number. ### Claim 11 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the processing device is further to: in response to a failure of obtaining the file with the first open port number, request the file from the device with a second open port number and a second filename that has a highest likelihood of being used as the name for the file with the second open port number. ### Claim 12 (depends on 9) The non-transitory computer readable medium of claim 9, wherein to obtain the filename comprises referencing the first open port number in a data storage that comprises a plurality of port numbers, wherein each of the plurality of port numbers has associated to it, one or more filenames that are ranked in order of likelihood of being used as the name for the file at a respective one of the plurality of port numbers. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the processing device is further to: ignore a candidate filename of the one or more filenames from the data storage if a probability or a success rate of the candidate filename does not satisfy a respective threshold. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein processing device is further to: update the success rate of the filename with respect to the first open port number in the data storage, in view of whether or not the file was obtained from the device with the filename and the first open port number. ### Claim 15 A system, comprising: a memory; and a processing device, operatively coupled to the memory, to: discover a device on a network that has a first open port number; obtain a filename that has a highest likelihood of being used as a name for a file with the first open port number; request the file from the device with the first open port number and the filename; and in response to obtaining the file from the device, classify the device with information held in the file. ### Claim 16 (depends on 15) The system of claim 15, wherein the processing device is further to: in response to failing to obtain the file from the device with the filename and the first open port number, request the file from the device with the first open port number and a second filename that has a second highest likelihood of being used as the name for the file with the first open port number. ### Claim 17 (depends on 15) The system of claim 15, wherein the processing device is further to: in response to a failure of obtaining the file with the first open port number, request the file from the device with a second open port number and a second filename that has a highest likelihood of being used as the name for the file with the second open port number. ### Claim 18 (depends on 15) The system of claim 15, wherein to obtain the filename comprises to reference the first open port number in a data storage that comprises a plurality of port numbers, wherein each of the plurality of port numbers has associated to it, one or more filenames that are ranked in order of likelihood of being used as the name for the file at a respective one of the plurality of port numbers. ### Claim 19 (depends on 18) The system of claim 18, wherein the processing device is further to: ignore a candidate filename of the one or more filenames from the data storage if a probability or a success rate of the candidate filename does not satisfy a respective threshold. ### Claim 20 (depends on 19) The system of claim 19, wherein the processing device is further to: update the success rate of the filename with respect to the first open port number in the data storage, in view of whether or not the file was obtained from the device with the filename and the first open port number.