Back to results
US 7,398,310 B1Granted
Method and system for tracking entities in a computer network
AssigneeCisco Technology, Inc.
InventorsKirby L. Kuehl, Erik J. Ginorio, Adam James Baldwin
Life of this patent
Estimating the term…
Abstract
A method and system for tracking entities in a computer network. A method includes receiving node information related to a node coupled to a computer network. The method further includes determining whether an entity associated with the node has been previously identified in the computer network. If the entity has been previously identified in the computer network, the node information is linked to an entry for the entity in the database. If the entity has not been previously identified in the computer network, a new entry is created in the database, and the node information is linked to the new entry.
Claims27
A method comprising:
- receiving node information for a node coupled to a computer network;
- analyzing the received node information to identify a unique identifier;
- selecting at least a security identified provided by an operating system of the node for the unique identifier when the analysis indicates that the node information includes the security identifier;
- selecting at least a serial number provided by a basic input output system of the node for the unique identifier when the analysis indicates that the node information does not include the security identifier;
- selecting at least a physical address for the unique identifier when the analysis indicates that the node information does not include either of the security identifier and the serial number;
- determining whether to issue an alarm indicating a network intrusion responsive to receiving the node information by comparing the unique identifier to a database;
- automatically linking at least a portion of said node information to an existing database entry in the database and not issuing the alarm when the comparison indicates a tracked entity that corresponds to the node;
- and
- issuing the alarm indicating the network intrusion and creating a new database entry when the comparison indicates that the node is a new entity.
6 more elements
A method comprising:
- receiving node information for a node coupled to a computer network;
- selecting from the received node information a security identifier for use in a unique identifier when the security identifier is available, and when the security identifier is not available, selecting a substitute value for use in the unique identifier, the substitute value being at least one value selected from the group of a serial number, a physical address and another statically assigned value;
- determining whether to issue an alarm indicating a network intrusion responsive to receiving the node information by comparing the unique identifier to a database;
- automatically linking at least a portion of said node information to an existing database entry in the database and not issuing the alarm when the comparison indicates a tracked entity that corresponds to the node;
- and
- issuing the alarm indicating the network intrusion and creating a new database entry when the comparison indicates that the node is a new entity.
3 more elements
An apparatus comprising:
- one or more processors;
- and
- a memory coupled to the processors comprising instructions executable by the processors, the processors operable when executing the instructions to:
- receive node information for a node coupled to a computer network;
- select from the received node information a security identifier for use in a unique identifier when the security identifier is available, and when the security identifier is not available, select a substitute value for use in the unique identifier, the substitute value being at least one value selected from the group of a serial number, a physical address and another statically assigned value;
- determine whether to issue an alarm indicating a network intrusion responsive to receiving the node information by comparing the unique identifier to a database;
- automatically link at least a portion of said node information to an existing database entry in the database and not issuing the alarm if the comparison indicates a tracked entity that corresponds to the node;
- and
- issue the alarm indicating the network intrusion and create a new database entry if the comparison indicates that the node is a new entity.
6 more elements
A system, comprising:
- means for receiving node information related to a node on said computer network;
- means for selecting from the received node information a security identifier for use in a unique identifier when the security identifier is available, and if the security identifier is not available, selecting a substitute value for use in the unique identifier, the substitute value being at least one value selected from the group of a serial number, a physical address and another statically assigned value;
- means for determining whether to issue an alarm indicating a network intrusion responsive to receiving the node information by comparing the unique identifier to a database;
- means for linking at least a portion of said node information to an existing database entry in the database and not issuing the alarm if the comparison indicates a tracked entity that corresponds to the node;
- and
- means for issuing the alarm indicating the network intrusion and creating a new database entry if the comparison indicates that the node is a new entity.
3 more elements
Dependencies are inferred from the claim text.