Composite Device Fingerprinting for Network Identification Accuracy

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current systems for identifying computing devices in a network are insufficient as they only analyze Ethernet traffic and RF signals, leading to incorrect profiling and inadequate protection against external threats.

Innovation Solution

The method involves continuously classifying temporal communication data using preprocessing models and neural networks to derive device properties, creating a device fingerprint that is refined over time, and can reverse-predict MAC addresses and generate composite fingerprints to accurately identify and profile devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional identification methods using only Ethernet traffic and RF signals are used, then the system complexity is low, but the identification accuracy and reliability are insufficient

Engineering Contradiction:
Improveidentification accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent combines multiple data sources including Ethernet traffic data, RF signal data, device profile data, and behavioral data into a unified device fingerprint. This merging of diverse data types enables more accurate identification and profiling of computing devices while maintaining system manageability through integrated processing.

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The device fingerprinting system serves multiple functions including device identification, behavior profiling, security threat detection, and network analytics. By creating a universal identification mechanism that works across different data types and application scenarios, the system achieves high identification accuracy without proportionally increasing complexity.

Inventive Principle:
Principle #6Universality (Multi-functionality)

2Measurement precision

If comprehensive temporal communication data is collected and analyzed, then the device profiling accuracy improves, but the data processing time and computational resources increase

Engineering Contradiction:
Improveprofiling accuracyVSAvoiddata processing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary processing of communication data by extracting relevant features and creating device fingerprints in advance. Preprocessing models prepare the data beforehand, so when analysis is needed, the system can quickly retrieve and evaluate pre-computed fingerprints rather than processing raw data from scratch, reducing real-time processing time.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent employs neural networks and machine learning models to automatically analyze temporal communication data patterns. These intelligent systems replace manual or rule-based analysis methods, enabling the processing of comprehensive data sets with improved efficiency and accuracy by automatically identifying relevant features and relationships.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If device fingerprints are continuously refined with additional data, then the identification reliability improves, but the computational overhead increases

Engineering Contradiction:
Improveidentification reliabilityVSAvoidcomputational overhead
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system implements continuous but incremental refinement of device fingerprints by incorporating additional temporal communication data over time. Rather than reprocessing all data continuously, the system selectively updates fingerprints with new relevant information, achieving improved reliability through cumulative learning while limiting computational overhead by avoiding redundant processing.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentUS11558378B2Systems and methods for device fingerprinting
Publication Date: 2023.01.17 NETSKOPE INC
  • US11558378B2 patent drawing
  • US11558378B2 patent drawing
  • US11558378B2 patent drawing

AI summary

Systems and methods to generate a device composite fingerprint associated with a computing device are described. In one embodiment, communication data associated with the computing device is accessed. The communication data includes device identification data, device group data, and device operational data. A device identity fingerprint associated with the computing device is generated using the device identification data. A device group fingerprint associated with the computing device is generated using the device group data. A device operational fingerprint associated with the computing device is generated using the device operational data. The device identity fingerprint, the device group fingerprint, and the device operational fingerprint are combined to generate a device composite fingerprint.