Active Probing Device Classification Service
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing device classification methods in computer networks are inefficient, particularly in the IoT context, as they rely on passive observation and rule generation, which can be slow and inadequate for classifying new devices, leading to delays in network access control and security policy enforcement.
Innovation Solution
A device classification service that determines eligibility for expedited classification based on policy, actively probes endpoint devices to gather telemetry data, and uses machine learning to generate device classification rules when existing rules do not match, enabling fast and accurate device type assignment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If passive observation and rule generation methods are used for device classification, then the system can handle a wide variety of devices, but the classification process takes too long
Solution Approach 1:
The system performs preliminary actions by actively probing devices with multiple protocols (SNMP, SSH, Telnet, ICMP) to gather classification data immediately upon device detection, rather than waiting for passive observation. This preliminary data collection enables faster initial classification while maintaining the ability to handle diverse device types through multi-protocol support.
2Productivity
If active probing is used to gather telemetry data quickly, then classification speed improves, but system complexity increases
Solution Approach 1:
The classification system is segmented into modular protocol handlers (SNMP, SSH, Telnet, ICMP) that can be independently selected and executed. This segmentation allows the system to attempt classification through multiple specialized protocols rather than using a single complex monolithic approach, improving speed while managing complexity through modular design.
Solution Approach 2:
The device classification service is designed with multi-functionality to support multiple probing protocols and classification methods within a single system. This universal approach allows the system to adapt to different device types using appropriate protocols, improving classification speed across diverse devices without requiring separate specialized systems for each protocol.
3Adaptability or versatility
If machine learning is implemented for automatic rule generation, then adaptability to new devices improves, but processing time increases
Solution Approach 1:
The system performs preliminary active probing to gather telemetry data immediately when a new device is detected. This preliminary data collection provides sufficient information for rapid initial classification using existing rules, avoiding the need for time-consuming machine learning rule generation for every new device. Machine learning is reserved for cases where active probing data is insufficient.
4Measurement precision
If multiple probing protocols are used to gather comprehensive telemetry data, then classification accuracy improves, but the time required increases
Solution Approach 1:
The system implements partial action by attempting classification through multiple protocols but stopping as soon as sufficient data is obtained from any single protocol. The active probing gathers comprehensive telemetry data through SNMP, SSH, Telnet, and ICMP, but the classification process does not require all protocols to succeed - it uses data from the first successful protocol that provides adequate classification information, thus improving accuracy without proportionally increasing time.
Data Source
AI summary
In various embodiments, a device classification service makes a determination that an endpoint device in a network is eligible for expedited device classification based on a policy. The device classification service obtains, after making the determination that the endpoint device in the network is eligible for expedited device classification, telemetry data regarding the endpoint device generated by actively probing the endpoint device. The device classification service determines whether the telemetry data regarding the endpoint device matches any existing device classification rules. The device classification service generates, based on the telemetry data, a device classification rule that assigns a device type to the endpoint device, when the telemetry data does not match any existing device classification rules.