Cloaked device scan

Abstract

The invention described herein provides a method and system for the detection and location of unauthorized or otherwise targeted network devices on a network. According to aspects of the invention, the method disclosed herein consists of gathering a logical mapping of the devices on a computer network (which can be faked, spoofed or easily hidden) by mining data from the routers and switches on the network, and matching the logical mapping of the devices to the physical reality of the network environment which can't be easily hidden or spoofed. Based on the physical information acquired about the devices on the network, it is possible to identify devices that are either unauthorized or are otherwise targeted.

Description

technical field [0001] The present invention relates to systems and methods for locating unauthorized or other target devices on a network by using passive scanning, utilizing available information from switches and routers. Background technique [0002] Networks and enterprise systems are becoming increasingly distributed and complex. From a network management standpoint, this means that network devices are increasingly difficult to keep track of and manage from a central location. In addition, computers and other network devices are now equipped with additional capabilities, such as built-in firewalls and network address translation (NAT), which make it impossible to manage security settings on devices connected to the network. [0003] In an enterprise environment, network managers typically attempt to keep workstations and other network devices updated and protected with one or more of the various anti-virus capabilities available. However, viruses and worms crop up on...

AI Technical Summary

Problems solved by technology

[0004] Existing commercial products require the relocation of a device or proxy on each local segment of the network and are not cost effective for large networks with multiple remote locations

Also, more products on the market only utilize traffic information from switches or routers on the local segment, if so

Such a situation can be used to monitor traffic (but can be expensive), time density in setup and training, and is generally not user friendly from a network scanning point of view

Images