System and method to identifying network appliances by data endpoints

A system for identifying network appliances on a network, the system comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the instructions comprising:
• instructions to intercept network communications from one or more devices between a first network and a second network;
• instructions to store the information about each connection in a database, the information including a Client Id and a destination address;
• instructions to query the database for a list of all destination addresses which were attempted to be contacted for each Client Id;
• instructions to generate metadata for each Client Id;
• instructions to analyze each Client Id, the associated metadata for each Client Id, and the destination addresses associated with each Client Id using a device identification tree, the device identification tree having one or more rules, the one or more rules defining a set of conditions to identify the one or more devices;
• and
• instructions to assign a device label to the Client Id of the one or more devices on the first network based on the one or more Client Ids matching all conditions of one or more of the rules in the device identification tree.

A computer program product for identifying network appliances on a network, the computer program product comprising:

• a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method, comprising:
• intercepting network communications from one or more devices between a first network and a second network;
• storing the information about each connection in a database, the information including a Client Id and a destination address;
• querying the database for a list of all destination addresses which were attempted to be contacted for each Client Id;
• generating metadata for each Client Id;
• analyzing each Client Id, the associated metadata for each Client Id, and the destination addresses associated with each Client Id using a device identification tree, the device identification tree having one or more rules, the one or more rules defining a set of conditions to identify the one or more devices;
• and
• assigning a device label to the Client Id of the one or more devices on the first network based on the one or more Client Ids matching all conditions of one or more of the rules in the device identification tree.