# US 12,184,498 B2 · Networked device discovery and management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,184,498 B2 - Document ID: US12184498B2 - Status: Granted - Kind: B2 - Application number: 17/742,979 - Filed: 2022-05-12 - Published: 2023-11-16 - Granted: 2024-12-31 - Earliest claimed: 2022-05-12 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Arun Mannengal; Chandra Sekhar Surapaneni; Rajesh Kumaraswamy - Web page: https://patentgrep.com/patent/US12184498B2 ## CPC - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 41/12: Discovery or management of network topologies - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/0811: by checking connectivity - H04L 63/1433: {Vulnerability analysis} - G06F 2221/034: Test or assess a computer or a system - H04L 43/045: for graphical visualisation of monitoring data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Networked device management is based on an ontology graph which includes device nodes, physical facility nodes, and edges. The ontology graph may go beyond network topology by also documenting: relationships between devices and facilities, facility attributes such as facility-specific security scores, and device characteristics such as whether a device is recognized, whether it is authorized, and its mission criticality. Medical devices, physical condition sensors, and other internet of things devices, including those embedded in vehicles, those located on a vehicle, those used for industrial control, or those which are intermittently air-gapped, are managed. Devices may be discovered by extraction of identifications and characteristics from telemetry data in a staged architecture. Security postures may be assessed, and security recommendations based on device context may be provided. ## Claims ### Claim 1 A computing system which is configured to perform networked device discovery, the computing system comprising: a digital memory; a processor in operable communication with the digital memory, the processor configured to execute the networked device discovery including: (a) ingesting telemetry data of devices, (b) obtaining relationship data which specifies one or more relationships between at least some of the devices and one or more physical facilities, (c) extracting device identifications and device characteristics from the ingested telemetry data, (d) constructing or updating an ontology graph, the ontology graph having device nodes, facility nodes, and edges, each edge between a device node and a facility node representing a relationship between a corresponding device and a physical facility, each edge between two device nodes representing a network communication between the two corresponding devices, the facility node representing the physical facility itself as opposed to any of the following: a device, a device component, a network endpoint, a computing system hardware component, or a network component, and (e) managing at least in part by use of artificial intelligence at least one of the devices based on the ontology graph, the managing comprising at least one of: creating in the digital memory an inventory manifest of the devices based on the telemetry data, visualizing on a computing system display a network topology, sending via the computing system a notification of an unknown device, sending via the computing system a notification of a previously inactive device that is active again, sending via the computing system a notification of a previously active device that is no longer active, or managing a security posture of a networked device by changing a configuration of the networked device or a configuration of another device, the managing also comprising calculating a risk rating or a security score by using a machine learning model with one or more of the following as inputs to the machine learning model: a value representing a misconfiguration, a value representing an omitted update, a value representing a vulnerability, a value representing an attack surface, a value representing a recent attack, or a value representing a physical security measure; and wherein items above are labeled (a) through (e) for convenient reference without imposing any chronological sequence. ### Claim 2 (depends on 1) The system of claim 1, further comprising the ontology graph, wherein the ontology graph resides in the digital memory, and wherein the ontology graph includes at least one device node, at least one facility node, and at least one edge between the at least one device node and the at least one facility node. ### Claim 3 (depends on 1) The system of claim 1, further comprising the ontology graph, wherein the ontology graph resides in the digital memory, and wherein the ontology graph includes at least two device nodes which represent respective internet of things devices. ### Claim 4 (depends on 1) The system of claim 1, further comprising the ingested telemetry data of the devices, wherein the ingested telemetry data of the devices resides in stages of the digital memory, and wherein the ingested telemetry data of the devices includes at least one of the following: telemetry data in a form of captured packet content, or telemetry data in a form of log content. ### Claim 5 A method for networked device discovery, the method executed by a computing system, the method comprising: ingesting telemetry data of devices; obtaining relationship data which specifies one or more relationships between at least some of the devices and one or more physical facilities; extracting device identifications and device characteristics from the ingested telemetry data; constructing or updating an ontology graph, the ontology graph having device nodes, facility nodes, and edges, each edge between a device node and a facility node representing a relationship between a corresponding device and a physical facility, each edge between two device nodes representing a network communication between two corresponding devices, the facility node representing the physical facility itself as opposed to any of the following: a device, a device component, a network endpoint, a computing system hardware component, or a network component; and managing at least in part by use of artificial intelligence at least one of the devices based on the ontology graph, the managing comprising at least one of: creating in the digital memory an inventory manifest of the devices based on the telemetry data, visualizing on a computing system display a network topology, sending via the computing system a notification of an unknown device, sending via the computing system a notification of a previously inactive device that is active again, sending via the computing system a notification of a previously active device that is no longer active, or managing a security posture of a networked device by changing a configuration of the networked device or a configuration of another device, the managing also comprising calculating a risk rating or a security score by using a machine learning model with one or more of the following as inputs to the machine learning model: a value representing a misconfiguration, a value representing an omitted update, a value representing a vulnerability, a value representing an attack surface, a value representing a recent attack, or a value representing a physical security measure. ### Claim 6 (depends on 5) The method of claim 5, wherein the managing the at least one of the devices based on the ontology graph comprises the sending via the computing system the notification of the previously inactive device that is active again, or the sending via the computing system the notification of the previously active device that is no longer active, or both. ### Claim 7 (depends on 5) The method of claim 5, wherein the managing the at least one of the devices based on the ontology graph comprises calculating a per-facility security score which is based on at least the security score which was calculated by using the machine learning model. ### Claim 8 (depends on 5) The method of claim 5, further comprising refreshing the ontology graph in response to at least one of the following refresh conditions: an expiration of a scheduled service period; a detection of connectivity after a period of non-connectivity; a detection of non-connectivity after a period of connectivity; a detection of an asset security vulnerability; a remediation of an asset security vulnerability; a notification of a change of administrative control or legal control of a physical facility; or a mission criticality attribute of a device. ### Claim 9 (depends on 5) The method of claim 5, wherein the extracting device identifications and device characteristics from the ingested telemetry data comprises querying a device. ### Claim 10 (depends on 5) The method of claim 5, further comprising getting device identifications or device characteristics or both from a vendor-specific inventory list, and wherein the device nodes collectively represent devices from multiple vendors. ### Claim 11 (depends on 5) The method of claim 5, further comprising displaying a device recognition query via a user interface, and conforming the ontology graph according to a response to the device recognition query. ### Claim 12 (depends on 5) The method of claim 5, wherein the extracting device identifications and device characteristics from the ingested telemetry data comprises matching a format of a captured packet to a format template which corresponds to at least one of: a device category; or a device manufacturer. ### Claim 13 (depends on 5) The method of claim 5, wherein the extracting device identifications and device characteristics from the ingested telemetry data comprises identifying a device based on a login pattern. ### Claim 14 (depends on 5) The method of claim 5, wherein the extracting device identifications and device characteristics from the ingested telemetry data comprises inferring a presence of an unauthorized gateway which is in the network communication with at least one recognized device. ### Claim 15 (depends on 5) The method of claim 5, wherein a facility node of the ontology graph represents at least one of the following physical facilities: a vehicle equipped for travel by land, a vehicle equipped for travel by water, a vehicle equipped for travel by air, a vehicle equipped for travel in space, or a facility having devices which include industrial control system devices. ### Claim 16 A computer-readable storage device configured with data and instructions which upon execution by a processor cause a computing system to perform a method for networked device discovery, the method comprising: ingesting telemetry data of devices; obtaining relationship data which specifies one or more relationships between at least some of the devices and one or more physical facilities; extracting device identifications and device characteristics from the ingested telemetry data; constructing or updating an ontology graph, the ontology graph having device nodes, facility nodes, and edges, each edge between a device node and a facility node representing a relationship between a corresponding device and a physical facility, each edge between two device nodes representing a network communication between the two corresponding devices, the facility node representing the physical facility itself as opposed to any of the following: a device, a device component, a network endpoint, a computing system hardware component, or a network component, the ontology graph including at least twenty device nodes which represent respective internet of things devices; and managing at least in part by use of artificial intelligence at least one of the devices based on the ontology graph, the managing comprising at least one of: creating in the digital memory an inventory manifest of the devices based on the telemetry data, visualizing on a computing system display a network topology, sending via the computing system a notification of an unknown device, sending via the computing system a notification of a previously inactive device that is active again, sending via the computing system a notification of a previously active device that is no longer active, or managing a security posture of a networked device by changing a configuration of the networked device or a configuration of another device, the managing also comprising calculating a risk rating or a security score by using a machine learning model with one or more of the following as inputs to the machine learning model: a value representing a misconfiguration, a value representing an omitted update, a value representing a vulnerability, a value representing an attack surface, a value representing a recent attack, or a value representing a physical security measure. ### Claim 17 (depends on 16) The computer-readable storage device of claim 16, wherein the method further comprises refreshing the ontology graph in response to an expiration of a scheduled service period. ### Claim 18 (depends on 16) The computer-readable storage device of claim 16, wherein the method further comprises refreshing the ontology graph in response to at least one of the following refresh conditions: a detection of connectivity after a period of non-connectivity; or a notification of a change of administrative control or legal control of a physical facility. ### Claim 19 (depends on 16) The computer-readable storage device of claim 16, wherein the method further comprises refreshing the ontology graph in response to at least one of the following refresh conditions: a detection of an asset security vulnerability; or a remediation of an asset security vulnerability. ### Claim 20 (depends on 16) The computer-readable storage device of claim 16, wherein the method further comprises refreshing the ontology graph in response to a mission criticality attribute of a device.