Device classification

Patent metadata

Field	Value
Publication number	US-12192080-B2
Application number	US-202318471974-A
Country	US
Kind code	B2
Filing date	Sep 21, 2023
Priority date	Dec 6, 2016
Publication date	Jan 7, 2025
Grant date	Jan 7, 2025

Abstract

Systems, methods, and related technologies for device classification are described. Methods include determining device information associated with a device coupled to a network, the device information including information obtained from one or more sources, classifying the device using the device information as input to a classifier, and applying a policy to the device based on the classification of the device.

First claim

What is claimed is:

1. A method comprising:
determining, by a processing device, device information associated with a device coupled to a network, wherein the device information comprises information obtained from one or more of a plurality of available sources;
classifying, by the processing device, the device using the device information as input to a classifier; and
applying a policy to the device based on the classification of the device.

2. The method of claim 1 , further comprising:
storing the classification of the device.

3. The method of claim 1 , further comprising:
determining whether the device comprises a local agent;
in response to determining that the device comprises a local agent, obtaining the device information from the local agent; and
in response to determining that the device does not comprise a local agent, obtaining the device information from an external source.

4. The method of claim 1 , further comprising aggregating the device information from the one or more of the plurality of available sources.

5. The method of claim 1 , wherein the device information comprises network traffic information associated with source and destination traffic information.

6. The method of claim 1 , wherein the device information is obtained through an active scan of the device.

7. The method of claim 1 , wherein the device information comprises user information associated with the device.

8. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
determine device information associated with a device coupled to a network, wherein the device information comprises information obtained from one or more of a plurality of available sources;
classify the device using the device information as input to a classifier; and
apply a policy to the device based on the classification of the device.

9. The system of claim 8 , wherein the processing device is further to:
store the classification of the device.

10. The system of claim 8 , wherein the processing device is further to:
determine whether the device comprises a local agent;
in response to determining that the device comprises a local agent, obtain the device information from the local agent; and
in response to determining that the device does not comprise a local agent, obtain the device information from an external source.

11. The system of claim 8 , wherein the processing device is further to aggregate the device information from the one or more of the plurality of available sources.

12. The system of claim 8 , wherein the device information comprises network traffic information associated with source and destination traffic information.

13. The system of claim 8 , wherein the device information is obtained through an active scan of the device.

14. The system of claim 8 , wherein the device information comprises user information associated with the device.

15. A non-transitory computer readable storage medium including instructions stored therein, that when executed by a processing device, cause the processing device to:
determine device information associated with a device coupled to a network, wherein the device information comprises information obtained from one or more of a plurality of available sources;
classify the device using the device information as input to a classifier; and
apply a policy to the device based on the classification of the device.

16. The non-transitory computer readable storage medium of claim 15 , wherein the processing device is further to:
store the classification of the device.

17. The non-transitory computer readable storage medium of claim 15 , wherein the processing device is further to:
determine whether the device comprises a local agent;
in response to determining that the device comprises a local agent, obtain the device information from the local agent; and
in response to determining that the device does not comprise a local agent, obtain the device information from an external source.

18. The non-transitory computer readable storage medium of claim 15 , wherein the processing device is further to aggregate the device information from the one or more of the plurality of available sources.

19. The non-transitory computer readable storage medium of claim 15 , wherein the device information comprises network traffic information associated with source and destination traffic information.

20. The non-transitory computer readable storage medium of claim 15 , wherein the device information is obtained through an active scan of the device.

21. The non-transitory computer readable storage medium of claim 15 , wherein the device information comprises user information associated with the device.

Assignees

• Forescout Tech Inc

Inventors

• Zhang Yang
• Yang Siying

Classifications

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04W12/71

  Hardware identity · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title

• H04W12/00

  Security arrangements; Authentication; Protecting privacy or anonymity · CPC title

• H04L41/046

  comprising network management agents or mobile agents therefor · CPC title