# US 2020/0401695 A1 · Determining a state of a network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401695 A1
- Document ID: US20200401695A1
- Status: Published application
- Kind: A1
- Application number: 16/899,020
- Filed: 2020-06-11
- Published: 2020-12-24
- Earliest claimed: 2019-06-20
- Assignees: 1E Limited
- Applicants: 1E Limited
- Inventors: Andrew MAYO
- Web page: https://patentgrep.com/patent/US20200401695A1

## CPC

- G06F 21/564: {by virus signature recognition}
- G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)}
- G06F 16/152: {using file content signatures, e.g. hash values}
- G06F 16/1748: {De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641)}
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 21/565: {by checking file integrity}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H03M 7/3088: {employing the use of a dictionary, e.g. LZ78}
- H04L 41/0853: by actively collecting configuration information or by backing up configuration information
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H03M: CODING; DECODING; CODE CONVERSION IN GENERAL (using fluidic means F15C4/00; optical analogue/digital converters G02F7/00; coding, decoding or code conversion, specially adapted for particular applications, see the relevant subclasses, e.g. G01D, G01R, G06F, G06T, G09G, G10L, G11B, G11C, H04B, H04L, H04M, H04N; ciphering or deciphering for cryptography or other purposes involving the need for secrecy G09C)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Certain examples described herein relate to components of a network computer system. These components may be one or more of a client computing device and a server computing device communicatively coupled to each other over a network. An example client computing device has a data storage device storing a plurality of files and a system agent. The system agent operates to apply a hash function to binary data read from the plurality of files to generate a set of data signatures. An example server computing device has a database interface to access a database representing a state of the network and data storage to store a set of exemplar data signatures resulting from a scan of one or more exemplar computing devices, each data signature being generated by applying a hash function to binary data representing a file. The client computing device is configured to receive the set of exemplar data signatures and compare these with the generated set of data signatures. The client computing device is also configured to transmit data to the server computing device based on the comparison. The server computing device is configured to obtain data received from the client computing device and update records in the database.

## Claims

### Claim 1

A method for determining a state of a computing device coupled to a network, the method comprising:
obtaining data signatures for a plurality of files that are stored on at least one volume of data storage accessible to the computing device, including applying a hash function to binary data read from the plurality of files to generate the data signatures;
receiving, at the computing device over the network, a set of exemplar data signatures;
generating, at the computing device, a state bitmap by comparing the generated data signatures with the set of exemplar data signatures; and
transmitting, from the computing device over the network, state data generated from the state bitmap.

### Claim 2 (depends on 1)

A method according to claim 1, wherein obtaining the data signatures comprises parsing, at the computing device, a file-system data file to obtain data locations for the plurality of files, wherein the hash function is applied to binary data read from the data locations.

### Claim 3 (depends on 1)

A method according to claim 1, comprising:
identifying, as a result of comparing the generated data signatures with the set of exemplar data signatures, one or more generated data signatures that are not present in the set of exemplar data signatures; and
transmitting additional state data, indicative of the said one or more generated data signatures, from the computing device over the network.

### Claim 4 (depends on 1)

A method according to claim 1, wherein the set of exemplar data signatures comprises a first set of exemplar data signatures, the method comprising:
receiving, at the computing device over the network, a second set of exemplar data signatures;
generating, at the computing device, a further state bitmap by comparing the generated data signatures with the second set of exemplar data signatures; and
transmitting, from the computing device over the network, state data generated based on the further state bitmap.

### Claim 5 (depends on 1)

A method according to claim 1, wherein the data signatures are obtained in response to receiving a request to obtain a state of the computing device, and wherein the method further comprises:
receiving, at the computing device over the network, a further state request;
comparing, in response to the further state request, a plurality of state bitmaps generated at the computing device in accordance with separately received requests to obtain the state of the computing device,
determining state update data based on differences between the plurality of state bitmaps; and
transmitting, from the computing device over the network, the state update data.

### Claim 6 (depends on 1)

A method according to claim 1, wherein the plurality of files each comprise executable code.

### Claim 7

A method of determining a state of a network of computing devices, the method comprising:
obtaining a set of exemplar data signatures resulting from a scan of one or more exemplar computing devices, each data signature in the set of exemplar data signatures being generated by applying a hash function to binary data from a file in a set of files accessible to the one or more exemplar computing devices;
transmitting the set of exemplar data signatures to the computing devices over the network;
receiving state data from the computing devices over the network;
processing the state data to extract state bitmaps for the computing devices, the state bitmaps indicating a presence or absence of each data signatures in the set of exemplar data signatures; and
using the state bitmaps to update a database representing the state of the network, the database comprising data records indicating which files are present in each of the computing devices.

### Claim 8 (depends on 7)

A method according to claim 7, wherein the set of exemplar data signatures comprises a first set of exemplar data signatures associated with a first set of files, and wherein the method comprises:
obtaining a second set of exemplar data signatures associated with a second set of files; and
transmitting the second set of exemplar data signatures to the computing devices over the network;
wherein the state bitmaps further indicate a presence or absence of each data signature in the second set of exemplar data signatures.

### Claim 9 (depends on 7)

A method according to claim 7, comprising:
transmitting a first state request to the computing devices over the network and receiving the state data in response to the first state request;
transmitting a further state request to the computing devices over the network;
receiving state update data from the computing devices over the network in response to the further state request,
wherein the state update data comprises differences between a plurality of state bitmaps generated at different times; and
using the state update data to update the database representing the state of the network.

### Claim 10 (depends on 9)

A method according to claim 9, wherein receiving state update data from the computing devices over the network comprises:
receiving a first subset of the state update data, corresponding to a first subset of the computing devices, at a first time;
receiving a second subset of the state update data, corresponding to a second subset of the computing devices, at a second time that is separated from the first time by a predefined time period.

### Claim 11 (depends on 9)

A method according to claim 9, wherein the update request comprises a count request, the method comprising, before receiving the state update data:
receiving count data from the computing devices over the network, the count data indicating a number of differences to be sent in the state update data;
determining that the number of differences for one or more of the computing devices exceeds a predetermined threshold; and
in response to the determining, retransmitting the set of exemplar data signatures to the said one or more of the computing devices.

### Claim 12 (depends on 7)

A method according to claim 7, comprising:
receiving, from one or more computing devices over the network, additional state data indicative of one or more data signatures which correspond, respectively, to one or more files present on the one or more computing devices that do not have a representative data signature in the set of exemplar data signatures; and
using the additional state data to update the database representing the state of the network.

### Claim 13 (depends on 12)

A method according to claim 12, comprising receiving additional state data from a plurality of computing devices;
determining, based on the received additional state data, that a file not having a representative data signature in the set of exemplar data signatures is present on a number of the plurality of computing devices, the number exceeding a predetermined threshold; and
adding the data signature representing the file to the set of exemplar data signatures for subsequently transmitting to the computing devices over the network.

### Claim 14

A method of generating a set of exemplar data signatures for use in determining a state of a network of computing devices, the method comprising:
initiating an installation of a predefined operating system on a virtual computing device;
during the installation, determining whether a set of primary files for the operating system have been extracted;
responsive to the extraction of the set of primary files, pausing the installation;
copying data stored on a virtual storage device for the virtual computing device to a prepared volume of data storage;
generating the set of exemplar data signatures by parsing a file-system data file for the prepared volume of data storage to obtain data locations for a plurality of files and applying a hash function to binary data read from the obtained data locations.

### Claim 15 (depends on 14)

A method according to claim 14, wherein the set of exemplar data signatures comprises a first set of exemplar data signatures, and wherein the method comprises:
generating a second set of exemplar data signatures, including:
scanning a computing device, having a predetermined configuration, to obtain a superset of data signatures for a plurality of files that are stored on at least one volume of data storage accessible by the computing device;
removing data signatures present in the first set of exemplar data signatures from the superset of data signatures to obtain the second set of exemplar data signatures.

### Claim 16

A client computing device comprising:
a network interface to communicatively couple the client computing device to at least one network;
at least one volume of data storage comprising a plurality of files;
a memory comprising computer program code for a system agent;
at least one processor configured to execute the computer program code for the system agent to:
apply a hash function to binary data read from the plurality of files to generate a set of data signatures;
receive, at the network interface, a set of exemplar data signatures;
generate a state bitmap by comparing the set of generated data signatures with the set of exemplar data signatures; and
transmit, from the network interface, state data generated from the state bitmap.

### Claim 17 (depends on 16)

The client computing device of claim 16, wherein the at least one volume of data storage comprises a file-system data file, and the at least one processor is configured to execute the computer program code for the system agent to:
obtain data locations for the plurality of files from the file-system data file; and
apply the hash function to binary data read from the obtained data locations to generate the set of data signatures for the plurality of files.

### Claim 18

A server computing device comprising:
a database interface to access a database representing a state of a network;
data storage to store a set of exemplar data signatures resulting from a scan of one or more exemplar computing devices, each data signature being generated by applying a hash function to binary data representing a file;
a memory comprising computer program code for a network server;
at least one processor configured to execute the computer program code for the network server to:
instruct a transmission of the set of exemplar data signatures to one or more computing devices coupled to the network;
obtain state data communicated from the computing devices over the network;
process the state data to extract state bitmaps for the computing devices, the state bitmaps indicating a presence or absence of each of the set of exemplar data signatures; and
update data records for the database using the state bitmaps, the data records indicating which files are present in each of the computing devices coupled to the network.

### Claim 19

A network computer system comprising:
a plurality of client computing devices, each client computing device comprising:
a data storage device comprising a plurality of files and a file-system data file; and
a system agent operating at a kernel level to:
parse the file-system data file to obtain data locations for the plurality of files; and
generate a set of file hashes from binary data located at the obtained data locations;
a server computing device communicatively coupled to the plurality of client computing devices over one or more networks, the server computing device comprising:
a first data interface to access a set of exemplar file hashes; and
a second data interface to access a state database, each record in a set of state records in the state database identifying one of the plurality of client computing devices and a file hash, the state records indicating the presence of one or more files across the network computer system;
wherein each client computing device is configured to:
receive the set of exemplar file hashes;
compare the set of exemplar file hashes with the generated set of file hashes; and
transmit data to the server computing device based on the comparison, the data comprising a compressed state bitmap indicating matches between the set of exemplar file hashes and the generated set of file hashes, and
wherein the server computing device is configured to:
obtain a set of state bitmaps from data received from the plurality of client computing devices; and
use the set of state bitmaps to update the set of state records in the state database.

### Claim 20 (depends on 19)

The network computer system of claim 19, wherein the set of exemplar data signatures are transmitted to a selected one of the plurality of client computing devices and wherein other ones of the plurality of client computing devices obtain the set of exemplar data signatures from the selected one of the plurality of client computing devices.