Method and system for managing suspicious devices on network

Patent metadata

Field	Value
Publication number	US-9769185-B2
Application number	US-201213605383-A
Country	US
Kind code	B2
Filing date	Sep 6, 2012
Priority date	Sep 8, 2011
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

A method and system for managing suspicious devices on a network. The method includes, setting based on a manager's input or selection a suspicious group corresponding to each of at least one suspicious management item for managing a plurality of devices on a network via a user interface; accessing the devices and reading information corresponding to the suspicious management item; determining whether each device is a suspicious device based on the information corresponding to the suspicious management item, and registering the device in the suspicious group if the device is determined as a suspicious device; checking whether an error of the device comprised in the suspicious group is resolved; and eliminating the device from the suspicious group if the error of the device is resolved.

First claim

What is claimed is:

1. A method comprising:
by at least one processor:
obtaining at least one suspicious management item information indicating a suspicious status of a device on a network, the at least one suspicious management item being an information item from among items of a serial number, a count value, and a firmware version;
setting a suspicious group including at least one suspicious subgroup corresponding to each of the at least one suspicious management item, wherein the at least one suspicious subgroup is generated by a user based on one or more conditions set by the user via a user interface when the at least one suspicious management item is obtained;
accessing a plurality of devices on a network and reading information corresponding to the obtained at least one suspicious management item;
determining whether any of the plurality of devices has a suspicious status based on the read information corresponding to the obtained at least one suspicious management item;
registering the device, from the plurality of devices, in a suspicious subgroup corresponding to a determined suspicious status of the device, wherein the registering includes
registering the device in an invalid serial number subgroup when the read information corresponds to an invalid serial number,
registering the device in a negative count value subgroup when the read information corresponds to a negative count value, and
registering the device in a old version subgroup when the read information corresponds to a previous firmware version;

receiving an input for selecting one of the at least one suspicious subgroup;
updating status information regarding devices of the selected suspicious subgroup in response to obtaining the status information of the devices of the selected suspicious subgroup by performing at least one of unicasting or multicasting communication;
checking whether a device in the selected suspicious subgroup has an error corresponding to a suspicious management item of the selected suspicious subgroup and whether the error is resolved by using the updated status information; and
eliminating the device in the suspicious subgroup if the error is resolved.

2. The method of claim 1 , wherein the information item from among items further includes at least one of device response, collection data, and a status.

3. The method of claim 1 , wherein the setting of the suspicious subgroups further includes adding or eliminating suspicious subgroups by the user via the user interface.

4. The method of claim 1 , wherein the obtaining of the at least one suspicious management item further includes selectively modifying the least one suspicious management item by the user.

5. The method of claim 1 , further comprising scheduling the accessing and reading the information corresponding to the obtained at least one suspicious management item.

6. The method of claim 1 , wherein the determining whether each of the plurality of devices is suspicious and grouping abnormal devices into the suspicious group is performed without intervention by the user.

7. The method of claim 1 , further comprising suggesting to the user a solution to the error based on the checking.

8. The method of claim 1 , wherein the user interface is configured to add a device to the suspicious group, and wherein the user interface is configured to eliminate a device from the suspicious group.

9. The method of claim 1 , further comprising outputting a status of an error resolution to the user indicating that an error resolution is progressing while the error is not resolved.

10. A system comprising:
at least one hardware processor configured to:
obtain at least one suspicious management item information indicating a suspicious status of a device on a network, and set a suspicious group including at least one suspicious subgroup corresponding to each of the at least one suspicious management item, wherein
the at least one suspicious management item being an information from among the items of a serial number, a count value, and a firmware version, and
the at least one suspicious subgroup is generated by a user based on one or more conditions set by the user via a user interface when the at least one suspicious management item is obtained;

access a plurality of devices on a network and read information corresponding to the obtained at least one suspicious management item;
determine whether any of the plurality of devices has a suspicious status based on the read information corresponding to the obtained at least one suspicious management item;
register the device, from the plurality of devices, in the suspicious subgroup group corresponding to a determined suspicious status of the device, wherein to register the device includes
register the device in an invalid serial number subgroup when the read information corresponds to an invalid serial number,
register the device in a negative count value subgroup when the read information corresponds to a negative count value, and
register the device in an old version subgroup when the read information corresponds to a previous firmware version;

receive an input for selecting one of the at least one suspicious subgroup;
update status information regarding devices of the selected suspicious subgroup in response to obtaining the status information of the devices of the selected suspicious subgroup by performing at least one of unicasting or multicasting communication;
check whether a device in the selected suspicious subgroup has an error corresponding to a suspicious management item of the selected suspicious subgroup and whether the error is resolved by using the updated status information; and
eliminate the device in the suspicious subgroup if the error is resolved.

11. The system of claim 10 , wherein the information item from among items further includes at least one of device response, collection data, and a status.

12. The system of claim 10 , wherein the at least one hardware processor is further configured to add or eliminate the suspicious subgroups by the user via the user interface.

13. The system of claim 10 , wherein the at least one hardware processor is further configured to selectively modify the at least one suspicious management item by the user.

14. The system of claim 10 , wherein the at least one hardware processor is further configured to schedule the access and read the information corresponding to the obtained at least one suspicious management item.

15. The system of claim 10 , wherein the at least one hardware processor is further configured to determine whether each of the plurality of devices is suspicious and groups abnormal devices into the suspicious group without intervention by the user.

16. The system of claim 10 , wherein the at least one hardware processor is further configured to suggest to the user a solution to the error based on the checking of whether the device comprises the error.

17. The system of claim 10 , wherein the user interface is configured to add a device to the suspicious group, and wherein the user interface is configured to eliminate a device from the suspicious group.

18. The system of claim 10 , wherein the at least one hardware processor is further configured to output a status of an error resolution to the user indicating that an error resolution is progressing while the error is not resolved.

19. At least one non-transitory computer readable medium comprising computer readable instructions that control at least one processor to implement a method, the method comprisin

Assignees

• Lee Sung-Woo
• Han Ji-Yeon
• S Printing Solution Co Ltd

Inventors

• Lee Sung-Woo
• Han Ji-Yeon

Classifications

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L41/0681

  Configuration of triggering conditions · CPC title

• H04L41/00

  Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks · CPC title