Abandoned Machine Detection Through Network Telemetry Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Abandoned machines continue to consume resources and pose security risks due to their active but unused state, making it difficult for users to identify and deactivate them.
Innovation Solution
A system and method using network telemetry data to identify active machines, analyze their usage patterns, and determine abandoned machines, with the option to automatically or manually deactivate them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If machines are left active after use without deactivation, then ease of operation is improved (users can quickly deploy and abandon machines), but resource consumption increases and security risks arise
Solution Approach 1:
The system automatically monitors machine activity patterns and identifies abandoned machines without requiring user intervention. The machine's usage status is self-reported through telemetry data, and the system autonomously determines when a machine has been abandoned based on predefined activity thresholds and time periods.
Solution Approach 2:
The system continuously collects telemetry data from machines and provides feedback about their activity status. By analyzing usage patterns over time, the system generates feedback signals that indicate whether a machine is actively used or abandoned, enabling automatic identification and subsequent deactivation.
2Ease of operation
If machines are left active after use without deactivation, then ease of operation is improved (users can quickly deploy and abandon machines), but security risks increase
Solution Approach 1:
The system automatically monitors machine activity patterns and identifies abandoned machines without requiring user intervention. The machine's usage status is self-reported through telemetry data, and the system autonomously determines when a machine has been abandoned based on predefined activity thresholds and time periods.
Solution Approach 2:
The system continuously collects telemetry data from machines and provides feedback about their activity status. By analyzing usage patterns over time, the system generates feedback signals that indicate whether a machine is actively used or abandoned, enabling automatic identification and subsequent deactivation.
3Measurement precision
If network telemetry data is analyzed to identify abandoned machines, then measurement precision is improved (accurate identification of abandoned machines), but device complexity increases
Solution Approach 1:
The system extracts only the essential telemetry data elements needed for abandonment detection, such as activity timestamps, usage patterns, and connection status. By focusing on specific critical data points rather than analyzing entire telemetry datasets, the system achieves accurate identification while minimizing processing complexity.
Solution Approach 2:
The system transforms raw telemetry data into meaningful parameters for abandonment detection, such as calculating time-since-last-activity, activity frequency, and usage intensity metrics. By changing the parameter representation from raw data to derived indicators, the system simplifies the detection logic while improving identification accuracy.
Data Source
AI summary
A system and method for obtaining, using one or more processors, network telemetry data; identifying, using the one or more processors, a set of active machines based on network telemetry data; analyzing, using the one or more processors, traffic associated with the set of active machines; determining, using the one or more processors, one or more abandoned machines in the set of active machines; and outputting, using the one or more processors, an identification of the one or more abandoned machines.