# US 12,192,066 B2 · Decision optimization mechanism for device classification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,066 B2 - Document ID: US12192066B2 - Status: Granted - Kind: B2 - Application number: 18/062,860 - Filed: 2022-12-07 - Published: 2023-10-05 - Granted: 2025-01-07 - Earliest claimed: 2022-04-04 - Assignees: Forescout Technologies, Inc. - Applicants: Forescout Technologies, Inc. - Inventors: Itai Koren; Nadav Gothait; Michael Oks; Shay Shemer - Web page: https://patentgrep.com/patent/US12192066B2 ## CPC - G06F 18/285: {Selection of pattern recognition techniques, e.g. of classifiers in a multi-classifier system} - H04L 41/16: using machine learning or artificial intelligence - G06F 18/241: relating to the classification model, e.g. parametric or non-parametric approaches - H04L 43/062: related to network traffic - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 43/0811: by checking connectivity - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and related technologies relate to obtaining a first classification of a device on a network from a first source, obtaining a second classification of the device on the network from a second source wherein the first classification and the second classification are different, and determining a classification result of the device based on selecting at least one of the first classification or the second classification. ## Claims ### Claim 1 A method, comprising: obtaining a first classification of a device on a network from a first source; obtaining a second classification of the device on the network from a second source wherein the first classification and the second classification are different, wherein the first source determines the first classification based on a fingerprint in network traffic and the second source determines the second classification based on applying a machine learning algorithm to the network traffic; selecting a source selection algorithm including selecting a depth based algorithm, based at least on a property of the first classification or the second classification; determining a classification result of the device based on applying the source selection algorithm to select at least one of the first classification or the second classification, including applying the depth based algorithm to select one of the first classification or the second classification based on a depth of the first classification and a depth of the second classification, wherein the classification result indicates at least a role or a vendor of the device; and storing the classification result to computer-readable memory, wherein a new classification is obtainable from a new source in response to the new source being added to a source configuration file, wherein the source configuration file identifies a plurality of sources that a respective classification is obtainable from, and identifies a respective property name that is associated with each of the plurality of sources. ### Claim 2 (depends on 1) The method of claim 1, wherein selecting the source selection algorithm further comprises selecting a score based algorithm, and wherein determining the classification result of the device further includes referencing a configuration file that includes a first score associated with the first source and a second score associated with the second source. ### Claim 3 (depends on 2) The method of claim 2, wherein the configuration file includes a respective score for each property of a plurality of devices as determined by each of a plurality of sources. ### Claim 4 (depends on 1) The method of claim 1, wherein determining the classification result of the device includes selecting the first classification to provide a first property of the device and selecting the second classification to provide a second property of the device. ### Claim 5 (depends on 1) The method of claim 1, wherein determining the classification result of the device further comprises translating at least one of the first classification or the second classification to a standard nomenclature. ### Claim 6 (depends on 1) The method of claim 1, further comprising publishing the classification result and a source of the classification result. ### Claim 7 A system, comprising: a computer-readable memory; and a processing device, operatively coupled to the computer-readable memory, to: obtain a first classification of a device on a network from a first source; obtain a second classification of the device on the network from a second source wherein the first classification and the second classification are different, and wherein the first source determines the first classification based on a fingerprint in network traffic and the second source determines the second classification based on applying a machine learning algorithm to the network traffic; select a source selection algorithm including to select a depth based algorithm, based at least on a property of the first classification or the second classification; determine a classification result of the device based on applying the source selection algorithm to select at least one of the first classification or the second classification, including to apply the depth based algorithm to select one of the first classification or the second classification based on a depth of the first classification and a depth of the second classification, wherein the classification result indicates at least a role or a vendor of the device; and store the classification result to the computer-readable memory, wherein a new classification is obtainable from a new source in response to the new source being added to a source configuration file, wherein the source configuration file identifies a plurality of sources that a respective classification is obtainable from, and identifies a respective property name that is associated with each of the plurality of sources. ### Claim 8 (depends on 7) The system of claim 7, wherein to select the source selection algorithm further comprises to select a score based algorithm, and wherein to determine the classification result of the device further includes to reference a configuration file that includes a first score associated with the first source and a second score associated with the second source. ### Claim 9 (depends on 8) The system of claim 8, wherein the configuration file includes a respective score for each property of a plurality of devices as determined by each of a plurality of sources. ### Claim 10 (depends on 7) The system of claim 7, wherein to determine the classification result of the device includes select the first classification to provide a first property of the device and selecting the second classification to provide a second property of the device. ### Claim 11 (depends on 7) The system of claim 7, wherein to determine the classification result of the device comprises to translate at least one of the first classification or the second classification to a standard nomenclature. ### Claim 12 A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to: obtain a first classification of a device on a network from a first source; obtain a second classification of the device on the network from a second source wherein the first classification and the second classification are different, and wherein the first source determines the first classification based on a fingerprint in network traffic and the second source determines the second classification based on applying a machine learning algorithm to the network traffic; select a source selection algorithm including to select a depth based algorithm, based at least on a property of the first classification or the second classification; determine a classification result of the device based on applying the source selection algorithm to select at least one of the first classification or the second classification, including to apply the depth based algorithm to select one of the first classification or the second classification based on a depth of the first classification and a depth of the second classification, wherein the classification result indicates at least a role or a vendor of the device; and storing the classification result to computer-readable memory, wherein a new classification is obtainable from a new source in response to the new source being added to a source configuration file, wherein the source configuration file identifies a plurality of sources that a respective classification is obtainable from, and identifies a respective property name that is associated with each of the plurality of sources. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, wherein the instructions further configure the processing device to publish the classification result and a source of the classification result. ### Claim 14 (depends on 12) The non-transitory computer readable medium of claim 12, wherein to select the source selection algorithm further comprises to select a score based algorithm, and wherein to determine the classification result of the device further includes to reference a configuration file that includes a first score associated with the first source and a second score associated with the second source. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the configuration file includes a respective score for each property of a plurality of devices as determined by each of a plurality of sources. ### Claim 16 (depends on 12) The non-transitory computer readable medium of claim 12, wherein to determine the classification result of the device includes to select the first classification to provide a first property of the device and to select the second classification to provide a second property of the device. ### Claim 17 (depends on 12) The non-transitory computer readable medium of claim 12, wherein to determine the classification result of the device further comprises to translate at least one of the first classification or the second classification to a standard nomenclature.