# US 12,192,080 B2 · Device classification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,080 B2 - Document ID: US12192080B2 - Status: Granted - Kind: B2 - Application number: 18/471,974 - Filed: 2023-09-21 - Published: 2024-01-11 - Granted: 2025-01-07 - Earliest claimed: 2016-12-06 - Assignees: Forescout Technologies, Inc. - Applicants: Forescout Technologies, Inc. - Inventors: Yang Zhang; Siying Yang - Web page: https://patentgrep.com/patent/US12192080B2 ## CPC - H04L 43/065: related to network devices - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04W 12/00: Security arrangements; Authentication; Protecting privacy or anonymity - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L 41/046: comprising network management agents or mobile agents therefor - H04W 12/71: Hardware identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, methods, and related technologies for device classification are described. Methods include determining device information associated with a device coupled to a network, the device information including information obtained from one or more sources, classifying the device using the device information as input to a classifier, and applying a policy to the device based on the classification of the device. ## Claims ### Claim 1 A method comprising: determining, by a processing device, device information associated with a device coupled to a network, wherein the device information comprises information obtained from one or more of a plurality of available sources; classifying, by the processing device, the device using the device information as input to a classifier; and applying a policy to the device based on the classification of the device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: storing the classification of the device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining whether the device comprises a local agent; in response to determining that the device comprises a local agent, obtaining the device information from the local agent; and in response to determining that the device does not comprise a local agent, obtaining the device information from an external source. ### Claim 4 (depends on 1) The method of claim 1, further comprising aggregating the device information from the one or more of the plurality of available sources. ### Claim 5 (depends on 1) The method of claim 1, wherein the device information comprises network traffic information associated with source and destination traffic information. ### Claim 6 (depends on 1) The method of claim 1, wherein the device information is obtained through an active scan of the device. ### Claim 7 (depends on 1) The method of claim 1, wherein the device information comprises user information associated with the device. ### Claim 8 A system comprising: a memory; and a processing device, operatively coupled to the memory, to: determine device information associated with a device coupled to a network, wherein the device information comprises information obtained from one or more of a plurality of available sources; classify the device using the device information as input to a classifier; and apply a policy to the device based on the classification of the device. ### Claim 9 (depends on 8) The system of claim 8, wherein the processing device is further to: store the classification of the device. ### Claim 10 (depends on 8) The system of claim 8, wherein the processing device is further to: determine whether the device comprises a local agent; in response to determining that the device comprises a local agent, obtain the device information from the local agent; and in response to determining that the device does not comprise a local agent, obtain the device information from an external source. ### Claim 11 (depends on 8) The system of claim 8, wherein the processing device is further to aggregate the device information from the one or more of the plurality of available sources. ### Claim 12 (depends on 8) The system of claim 8, wherein the device information comprises network traffic information associated with source and destination traffic information. ### Claim 13 (depends on 8) The system of claim 8, wherein the device information is obtained through an active scan of the device. ### Claim 14 (depends on 8) The system of claim 8, wherein the device information comprises user information associated with the device. ### Claim 15 A non-transitory computer readable storage medium including instructions stored therein, that when executed by a processing device, cause the processing device to: determine device information associated with a device coupled to a network, wherein the device information comprises information obtained from one or more of a plurality of available sources; classify the device using the device information as input to a classifier; and apply a policy to the device based on the classification of the device. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the processing device is further to: store the classification of the device. ### Claim 17 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the processing device is further to: determine whether the device comprises a local agent; in response to determining that the device comprises a local agent, obtain the device information from the local agent; and in response to determining that the device does not comprise a local agent, obtain the device information from an external source. ### Claim 18 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the processing device is further to aggregate the device information from the one or more of the plurality of available sources. ### Claim 19 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the device information comprises network traffic information associated with source and destination traffic information. ### Claim 20 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the device information is obtained through an active scan of the device. ### Claim 21 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the device information comprises user information associated with the device.