Network device identification

Patent metadata

Field	Value
Publication number	US-11212183-B1
Application number	US-201916441880-A
Country	US
Kind code	B1
Filing date	Jun 14, 2019
Priority date	Jun 14, 2019
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

Briefly, embodiments, such as methods and/or systems for network device identification, for example, are described.

First claim

The invention claimed is:

1. An apparatus comprising:
one or more processors coupled to one or more physical memory devices to store executable instructions and to store binary digital signal quantities as physical memory states, wherein the executable instructions being accessible from the one or more physical memory devices for execution by the one or more processors;
the one or more processors able to store in at least one of the physical memory devices, binary signal quantities, if any, that are to result from execution of the instructions on the one or more processors;
wherein the accessed executable instructions to identify a particular network device;
wherein the particular network device is to be engaged in network communications via a network;
the particular network device identifying instructions further to:
monitor for a period of time respective network communication flows to be engaged in by the particular network device, wherein a respective monitored network communication flow to comprise flow detail records that include a set of network flow communication parameters;
process in a time sequenced order selected network flow communication parameters of the set for the respective monitored network communication flows with respect to the particular network device for the period of time, and to process the remaining selected network communication flow parameters after removing at least one domain name suffix or at least one domain prefix from the selected network communication flow parameters;
vectorize a count of the processed network flow communication parameters of the set captured over the period of time after having monitored a particular number of respective network communication flows for the period of time with respect to the particular network device;
identify the particular network device based at least in part on the vectorized count for the particular network device over the period of time; and
block access to the particular network device based at least in part on an abnormal vectorized count for the particular network device, wherein

the particular network device identifying instructions to vectorize the count of the processed network flow communication parameters further comprise executable instructions to vectorize one or more formed pre-vectorization units (PVUs) for the particular network device;
wherein the executable instructions to vectorize further comprise instructions to:
identify within the one or more PVUs for the particular network device a number of instances of respective selected network flow communication parameters;
count within the one or more PVUs for the particular network device the number of instances of the respective selected network flow communication parameters; and
weight the count of the number of instances of the respective selected network flow communication parameters within the one or more PVUs for the particular network device; and
wherein the executable instructions to weight the count of the number of instances of the respective selected network flow communication parameters within the one or more PVUs for the particular network device further comprise executable instructions to employ a term-frequency weighting operation with respect to the count of the number of instances of the respective selected network flow communication parameters within the one or more PVUs for the particular network device.

2. The apparatus of claim 1 , wherein the particular network device identifying instructions further to process in the time sequenced order selected network flow communication parameters of the set for the respective monitored network communication flows, wherein the executable instructions further comprise executable instructions to process the selected network flow communication parameters, wherein the processed network flow communication parameters comprise at least one of the following: a time stamp, a source IP address, a destination IP address, an IP protocol; a source port at least for UDP or TCP, a destination port at least for UDP or TDP, an IP type of service, an identifier or any combination thereof.

3. The apparatus of claim 2 , wherein the particular network device identifying instructions to process in the time sequenced order selected network flow communication parameters of the set for the respective monitored network communication flows further comprise executable instructions to:
accumulate and sort the monitored network flow detail records for the particular network device over the period of time; and
process the selected network flow communication parameters of the monitored network flow detail records for the particular network device over the period of time.

4. The apparatus of claim 1 , wherein the at least one domain name suffix comprises .com, .net, .org, and wherein the at least one domain name prefix comprises www, example, time, ntp, pool, digits 0-9, dashes, or any combination thereof.

5. The apparatus of claim 1 , wherein the particular network device identifying instructions to process the remaining network communication flow parameters further include executable instructions to concatenate the remaining network communication flow parameters for a grouping of flow detail records to form a pre-vectorization unit.

6. The apparatus of claim 1 , wherein the particular network device identifying instructions comprise executable instructions to identify the particular network device further include executable instructions to employ multiple trained machine learning classifiers with respect to one or more vectorized pre-vectorization units (PVUs) for the particular network device.

7. The apparatus of claim 1 , wherein the executable instructions to employ multiple trained machine learning classifiers further comprise executable instructions to employ at least one of the following machine learning classification types with respect to the multiple trained machine learning classifiers: support vector machine classification; logistic regression classification and/or neural network classification.

8. An apparatus comprising:
one or more processors coupled to one or more physical memory devices to store executable instructions and to store binary digital signal quantities as physical memory states, wherein the executable instructions being accessible from the one or more physical memory devices for execution by the one or more processors;
the one or more processors able to store in at least one of the physical memory devices, binary signal quantities, if any, that are to result from execution of the instructions on the one or more processors, wherein the accessed executable instructions to train a machine learning classifier for a particular network device;
wherein the particular network device and other network devices are to be engaged in network communications via a network;
the accessed executable instructions further to:
monitor for a period of time respective network communication flows to be engaged in by the particular network device and the other network devices, wherein a respective monitored network communication flow to comprise flow detail records that include a set of network flow communication parameters;
process in a time sequenced order selected network flow communication parameters of the set for the respective monitored network communication flows with respect to the particular network device and the other network devices for the period of time, and to process the remaining selected network communication flow parameters after removing at least one domain name suffix or at least one domain prefix from the selected network communication flow parameters;
vectorize a count of the processed network flow communication parameters of the set captured over th

Assignees

• Palisade Networks Inc
• Zscaler Inc

Inventors

• Hankins Scott Andrew
• Geisler Iii Thomas James

Classifications

• G06N3/0499

  Feedforward networks · CPC title

• G06N3/09

  Supervised learning · CPC title

• H04L41/34

  Signalling channels for network management communication · CPC title

• H04L41/12 Primary

  Discovery or management of network topologies · CPC title

• H04L43/026 Primary

  using flow identification · CPC title