Agentless Device Identification Using ML on Sparse Network Traffic

The system performs preliminary actions by collecting and storing flow detail records (FDRs) over time before classification is needed. This allows the machine learning model to accumulate sufficient training data from sparse network traffic, improving identification accuracy without requiring complex real-time data processing. The FDR storage acts as a buffer that decouples data collection from analysis.

The patent introduces flow detail records as an intermediary data structure that captures network traffic characteristics without requiring direct complex analysis of raw traffic. These FDRs serve as a simplified representation that the machine learning model can process efficiently, reducing the complexity gap between sparse input data and accurate classification output.

The system implements self-service by extracting device identification information passively from network traffic flows without requiring devices to run software agents. The machine learning model analyzes characteristics of network packets and flow details that devices generate naturally, allowing IoT and OT devices to be classified without any modification or additional software installation.

The patent replaces the mechanical approach of deploying physical software agents on devices with a field-based approach using machine learning analysis of network traffic. Instead of installing code on diverse devices (mechanical intervention), the system observes and classifies devices through their network communication patterns, achieving agentless identification across heterogeneous device types.

The system implements self-service by enabling the machine learning model to automatically classify devices without requiring manual expert intervention. The model learns from stored flow detail records and independently performs classification, eliminating the bottleneck of manual analysis while maintaining high accuracy. This automation allows parallel processing of multiple devices simultaneously.

The patent uses copying by training the machine learning model on copies of flow detail records from various devices. Once trained, the model can rapidly classify new devices by comparing their traffic patterns against the learned patterns, achieving high throughput without requiring manual expertise for each classification decision.