Network Device Classification via Telemetry Gap Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computer networks, especially in IoT environments, the increasing variety and number of devices make it difficult for networks to accurately classify device types, leading to misconfigurations and inefficient access control policies, as traditional methods rely on static rules and heuristics, resulting in a high percentage of devices being classified as 'UNKNOWN' and causing oscillations in classification.
Innovation Solution
A device classification service that compares traffic telemetry data across networks to identify missing traffic characteristics, determines configuration changes for networking entities, and implements these changes to gather necessary data for accurate device type classification, using machine learning-based classifiers and matrix completion techniques to recover missing features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If static rules and heuristics are used for device classification, then the classification method is simple to implement, but the classification accuracy deteriorates with increasing device variety
Solution Approach 1:
The patent implements a closed-loop feedback mechanism where classification results are continuously monitored and used to refine classification rules. The system collects classification outcomes, identifies misclassified devices, analyzes their traffic characteristics, and updates the classification rules accordingly. This feedback loop enables the system to adapt to new device types and improve accuracy over time while maintaining the simplicity of rule-based classification.
Solution Approach 2:
The system performs preliminary actions by pre-collecting and analyzing traffic characteristics from known device types before encountering unknown devices. It builds a database of traffic patterns, protocols, and behaviors in advance, which are then used as reference data for classifying new devices. This preliminary data collection and analysis enables faster and more accurate classification when new devices join the network.
2Measurement precision
If more traffic characteristics are collected for device classification, then classification accuracy improves, but network configuration complexity increases
Solution Approach 1:
The patent creates a universal traffic collection framework that gathers multiple types of traffic characteristics (protocols, ports, packet sizes, timing patterns, application-layer data) through a single multi-functional collection mechanism. This universal approach consolidates what would otherwise require multiple separate configuration settings into one unified system, reducing configuration complexity while enabling comprehensive data collection for accurate device classification.
3Measurement precision
If device classification is performed manually, then control precision is high, but the time and resources required increase significantly
Solution Approach 1:
The system implements self-service automation where the classification mechanism automatically performs data collection, analysis, and rule generation without manual intervention. The system autonomously monitors network traffic, extracts relevant characteristics, compares them against known device profiles, and assigns device types automatically. This self-service approach maintains high classification precision while dramatically improving efficiency and reducing the time and resources required compared to manual classification methods.
Data Source
AI summary
In one embodiment, a device receives traffic telemetry data captured by a plurality of networks and used by device classification services in the networks to classify endpoints in the networks with device types. The device compares the telemetry data from a particular one of the networks to the telemetry data from the other networks to identify one or more traffic characteristics that are missing from the telemetry data for one or more endpoints of the particular network. The device identifies a networking entity in the particular network that is common to the one or more endpoints for which the one or more characteristics are missing. The device determines a configuration change for the networking entity by comparing a current configuration of the entity to those of one or more entities in the other networks. The device initiates implementation of the determined configuration change for the entity in the particular network.