Back to results
US 2017/0250879 A1Published application
Self-learning device classifier
AssigneeGuavus, Inc.
InventorsNaunidh Singh CHADHA, Deepak JAIN, Ankush GARG
Life of this patent
Estimating the term…
Abstract
Systems and methods classify unknown devices communicating over a packet-switched network based on traffic-borne characteristics comprising packet parameters, flow parameters, and/or operating-system parameters. Embodiments utilize “self-learning” to optimize the level of classification accuracy.
Claims16
A system for identifying unknown devices communicating over a computer network, the system comprising:
- a computer network comprising a plurality of intercommunicating forwarding devices for receiving packets from originating devices via one or more ingress ports and forwarding packets via one or more egress ports to destination devices;
- at least one listening node connected to the network and comprising:
- a) a network interface for receiving packet information from one or more of the forwarding devices;
- b) a first database mapping device identifiers to traffic-borne packet characteristics associated therewith;
- c) a second database mapping traffic-borne packet characteristics to a plurality of device classifications, each record of the second database specifying, for at least one traffic-borned packet characteristic, a population fraction of devices within the device classifications that exhibit the at least one traffic-borned packet characteristic;
- d) a feature-extraction module for extracting the traffic-borne packet characteristics from the received packet information;
- e) a classification module for identifying, from the first database, originating devices from the traffic-borne packet characteristics extracted by the feature-extraction module from packet flows associated with the originating devices, and further identifying unknown originating devices for which no identification can be made from entries in the first database;
- and
- f) an analysis module for classifying the unknown devices identified by the classification module to a user-supplied degree of accuracy within at least one selected device classification, the analysis module being configured to:
- i. identify, for the unknown devices, a plurality of traffic-borne packet characteristics each having an associated population fraction in the second database above a predictiveness threshold for the selected device classification;
- ii. identify a subset of the identified traffic-borne packet characteristics that produces a selected classification accuracy level;
- and
- iii. determine, based on the identified subset of traffic-borne packet characteristics, whether the unknown device is within at least one said selected device classification at the selected classification accuracy level, and, if so, classifying the device.
10 more elements
A method of identifying unknown devices communicating over a computer network comprising a plurality of intercommunicating forwarding devices for receiving packets from originating devices via one or more ingress ports and forwarding packets via one or more egress ports to destination devices, the method comprising the steps of:
- providing a first database mapping device identifiers to traffic-borne packet characteristics associated therewith;
- providing a second database mapping traffic-borne packet characteristics to a plurality of device classifications, each record of the second database specifying, for at least one traffic-borned packet characteristic, a population fraction of devices within the device classifications that exhibit the at least one traffic-borned packet characteristic;
- receiving packets over the network and extracting traffic-borne packet characteristics therefrom;
- identifying, using the first database, originating devices from the extracted traffic-borne packet characteristics thereof;
- identifying unknown originating devices for which no identification can be made from entries in the first database;
- and
- classifying the unknown devices to a user-supplied degree of accuracy within at least one selected device classification by:
- a) identifying, for the unknown devices, a plurality of traffic-borne packet characteristics each having an associated population fraction in the second database above a predictiveness threshold for the selected device classification;
- b) identifying a subset of the identified traffic-borne packet characteristics that produces a selected classification accuracy level;
- and
- c) based on the identified subset of traffic-borne packet characteristics, determining whether the unknown device is within at least one said selected device classification at the selected classification accuracy level, and, if so, classifying the device.
8 more elements
Dependencies are inferred from the claim text.