System and method for classifying network devices

Abstract

A method and system for classifying a device accessing a computer network. The method including: providing a framework of models configured to classify the device; reviewing a network traffic flow associated with a device; extracting flow attributes associated with a network traffic flow; deriving further flow attributes based on the extracted flow attributes; determining at least one model of the framework of models based on the derived flow attributes and extracted encrypted flow attributes; and classifying the device associated with the network traffic flow based on the at least one model. The system includes: a learning engine configured to provide a framework of models; a packet processing engine configured to review a network traffic flow associated with a device; a device classification engine configured to extract flow attributes, derive further flow attributes and determine at least one model; and a device information aggregator configured to classify the device.

Dependencies are inferred from the claim text.