US 12,652,224 B2 · Device type discovery based on network address translated network traffic

Abstract

Device type discovery for a private network can be performed based on network address translated (NAT′d) network traffic generated from the network. A security solution analyzes data of network traffic from network devices using a binary classifier to determine whether the network traffic is from a NAT device. A network traffic dataset for a first time interval is preprocessed to generate a feature vector for the binary classifier, the output of which indicates whether the traffic is NAT′d. For NAT′d traffic, the security solution analyzes subsets of the network traffic dataset of smaller intervals within the first time interval. The security solution determines feature values from each network traffic data subset and generates feature vectors which are input to a multiclass classifier to obtain a device classification for each network traffic data subset.

Claims20

Dependent claims

A method comprising:

determining values of a first set of features of network traffic from a network device to generate a first feature vector;
and
inputting the first feature vector into a first classifier to obtain an indication of whether or not the network device performed network address translation on the network traffic;
based on an indication that the network device performed network address translation on the network traffic by the first classifier, for each subset of the network traffic in a corresponding time interval of the network traffic,
determining values of a second set of features for the subset of the network traffic to generate a second feature vector;
and
inputting the second feature vector into a second classifier to obtain at least one device classification for the subset of the network traffic;
and
generating a profile of the network traffic based, at least in part, on the device classifications.

6 more elements

An apparatus comprising:

a processor;
and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
analyze behavior of network traffic from a network device to detect network address translation (NAT) behavior with a binary classifier, wherein the network traffic behavior is represented by a first set of features;
and
identify device types in a private network behind the network device based on device classifications of samples of the network traffic for which NAT behavior is detected, wherein the instructions to identify types of devices in the private network comprise instructions to,
for each sample of the network traffic for which NAT behavior is detected, identify a device classification based on a second set of features and a multiclass classifier;
and
indicate the device classifications of the samples with detected NAT behavior as the types of devices in the private network.

6 more elements

Dependencies are inferred from the claim text.

Device type discovery based on network address translated network traffic

Life of this patent

Device type discovery based on network address translated network traffic

Life of this patent

Abstract

Claims20