DHCP Change Detection in Sparse Network Traffic Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based security solutions struggle to accurately identify device changes due to DHCP in sparsely populated log data, as MAC addresses are often anonymized and unavailable, making it difficult to determine if a given IP address belongs to the same device over time, especially for mobile devices.
Innovation Solution
A method and system for detecting device changes by monitoring network traffic data, identifying outlier time gaps, and analyzing network traffic characteristics such as hostnames and user agents before and after these gaps to determine DHCP changes, using a cloud-based system that includes enforcement nodes and a central authority for policy management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC addresses are anonymized for privacy protection, then user privacy is protected, but device identification accuracy deteriorates
Solution Approach 1:
The patent uses DHCP lease data as an intermediary to bridge the gap between anonymized MAC addresses and device identification. By capturing MAC addresses during DHCP transactions (when devices first connect) and linking them to subsequent IP address assignments, the system creates a temporary mapping that enables device tracking without requiring continuous MAC address visibility. This intermediary approach allows accurate device identification while maintaining MAC address anonymization for privacy protection.
Solution Approach 2:
The system performs preliminary capture of MAC addresses during the DHCP lease acquisition phase, before the device begins its normal network operations. By obtaining the MAC address at this preliminary stage and storing it associated with the assigned IP address, the system prepares identification data in advance. This preliminary action ensures that when the device communicates later using only its IP address, the system already has the MAC address information needed for accurate device identification, without requiring real-time MAC address access.
2Adaptability or versatility
If DHCP is used for dynamic IP assignment, then network flexibility and device mobility are improved, but device tracking accuracy deteriorates
Solution Approach 1:
The patent implements a feedback mechanism by continuously monitoring DHCP lease events and updating device identification records in real-time. When a DHCP lease is issued, renewed, or revoked, the system receives feedback about IP address assignments and updates its device tracking data structures accordingly. This feedback loop ensures that even as devices move in and out of the network and IP addresses are dynamically reassigned, the system maintains accurate mappings between current IP addresses and device identities, preserving tracking accuracy while supporting device mobility.
Solution Approach 2:
The system adds a temporal dimension to device tracking by incorporating DHCP lease timing information. Instead of simply mapping IP addresses to devices, the system records when leases were issued, their duration, and renewal status. This temporal information creates a multi-dimensional view of device presence and activity patterns, enabling more accurate device tracking by considering not just which IP address a device has, but also when it obtained the address and how long it is expected to retain it. This dimensional enrichment helps distinguish between devices that may temporarily share IP addresses.
Data Source
AI summary
Systems and methods for detecting device change due to Dynamic Host Configuration Protocol (DHCP) in sparsely populated log data include monitoring and logging network traffic data; identifying one or more outlier time gaps associated with an Internet Protocol (IP) address used to communicate over the network within the logged network traffic data; and determining the occurrence of a DHCP change based on one or more network traffic characteristics of the IP address before and after the outlier time gap.