Identifying Multi-NIC Devices via Traffic Log Clustering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing device inventory services face challenges in accurately counting and identifying multi-NIC devices in networks, leading to false device counts and unclear identities due to each NIC being counted separately.

Innovation Solution

A multi-NIC device identification service that collects traffic logs, extracts features from device names, generates feature vectors, and uses unsupervised learning to cluster these vectors, allowing for the identification of multi-NIC devices by analyzing cluster sizes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If device inventory is taken on a per-NIC basis, then each NIC can be individually tracked and monitored, but false device counts occur and device identities become unclear due to multi-NIC devices being counted once per each NIC

Engineering Contradiction:

Improvedevice counting accuracyVSAvoiddevice identity clarity

Core Design Contradiction:

Measurement precisionVSLoss of information

Solution Approach 1:

The patent segments the device identification problem by separating NIC-level identification from device-level identification. It introduces a new abstraction layer that groups multiple NICs under a single device identity by analyzing traffic patterns and correlating NICs that belong to the same physical device, thereby resolving the contradiction between per-NIC tracking accuracy and overall device identity clarity

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary analysis layer that processes traffic log data to establish relationships between NICs and their parent devices. This intermediary layer correlates NIC identifiers with device identifiers by analyzing communication patterns, allowing the system to maintain per-NIC tracking while preventing duplicate device counts by identifying which NICs belong to the same device

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If device names are used to identify unique devices, then device identification becomes simpler, but false positives occur because model or default names may be shared across multiple devices

Engineering Contradiction:

Improvedevice identification simplicityVSAvoiddevice identification accuracy

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent replaces the mechanical/name-based device identification system with a data-driven identification system. Instead of relying solely on device names (which can be misleading), the system analyzes traffic log data, communication patterns, and NIC behavior to dynamically determine device identity, thereby maintaining simplicity while eliminating false positives from shared default names

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the identification parameters from static device names to dynamic traffic-based identifiers. By analyzing traffic patterns, communication frequencies, and NIC usage behaviors, the system creates more reliable device identifiers that adapt to actual network usage, preventing misidentification caused by generic or shared device names

Inventive Principle:

Principle #35Parameter changes

3Productivity

If multiple NICs of the same device are identified as separate devices, then each NIC can be individually managed, but device counts become inflated and resource allocation becomes inefficient

Engineering Contradiction:

Improvenetwork management efficiencyVSAvoiddevice count

Core Design Contradiction:

ProductivityVSQuantity of substance

Solution Approach 1:

The patent merges multiple NIC identifiers into a single device identity by analyzing traffic correlations and identifying which NICs belong to the same physical device. This merging process consolidates the device count while maintaining the ability to individually manage each NIC, preventing inflation of device quantities while preserving management granularity

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent creates a universal device identification framework that can handle both single-NIC and multi-NIC devices uniformly. The system provides multi-functionality by enabling per-NIC management when needed while simultaneously providing aggregated device-level views for efficient resource allocation, thereby improving overall network management productivity without sacrificing either granularity or efficiency

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20250139043A1Identifying devices with multiple network interface cards in a network

Publication Date: 2025.05.01 PALO ALTO NETWORKS INC

AI summary

A service obtains traffic logs for traffic of a network that has been sent according to a Layer 7 protocol (e.g., SNMP or DNS). The service identifies from the traffic logs device names that appear to correspond to different devices/NICs as names of candidate multi-NIC devices. The service extracts features from names of the candidate multi-NIC devices and generates respective feature vectors. The service can generate “documents” representing each device name from which it extracts features by determining n-grams of each device name, where a set of n-grams of a device name is treated as a document, and each n-gram is treated as a term in the document. Exemplary features that can be extracted based on a device name document include within-document and cross-document uniqueness scores. The service clusters the feature vectors with unsupervised learning and identifies clusters of a size that satisfies a criterion as corresponding to multi-NIC devices.