Network Device Identification via Application Usage Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to reliably identify and track devices in computer networks due to frequent application updates that change networking behavior, leading to complications in determining active application usage time and enforcing security measures.
Innovation Solution
A system and method that generates and maintains device application usage profiles based on network traffic data, using machine learning to identify unknown devices by comparing their application usage patterns with known devices, enabling accurate deduplication and security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional device identification methods (MAC addresses, device types) are used, then device identification can be implemented, but reliability deteriorates due to MAC randomization and frequent application updates changing networking behavior
Solution Approach 1:
The patent changes the identification parameters from static characteristics (MAC address, device type) to dynamic behavioral parameters (application usage patterns, networking behavior). By monitoring how applications are used and when they are active, the system creates profiles that adapt to changes in networking behavior while maintaining reliable device identification through consistent behavioral patterns.
Solution Approach 2:
The patent replaces traditional mechanical/protocol-based identification methods with machine learning-based pattern recognition. Instead of relying on fixed identification protocols that are vulnerable to randomization, the system uses AI/ML algorithms to analyze and recognize device behavior patterns, substituting deterministic identification with probabilistic pattern matching that is more resilient to changes.
2Extent of automation
If device identification is enhanced to track application usage patterns, then security measures can be enforced, but system complexity increases due to profile generation and comparison operations
Solution Approach 1:
The patent performs preliminary actions by generating device profiles in advance through continuous monitoring of application usage patterns. These profiles are created and maintained before security enforcement is needed, storing characteristic behavioral data that can be quickly compared against observed behavior. This preliminary profiling reduces the complexity of real-time security decisions by having pre-computed reference data available for comparison.
Solution Approach 2:
The system implements self-service by automatically generating, updating, and maintaining device profiles without requiring manual intervention. The machine learning components autonomously learn from observed networking behavior and adjust profiles accordingly, enabling the system to adapt to changing device behavior patterns while automatically enforcing security policies based on these self-maintained profiles.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A device identification method where a device application usage profile is generated (200) and maintained for each one or more known computing devices of a local network based on network traffic data. In response to detecting (201) an unknown computing device in the local network, network traffic data related to the unknown computing device is collected (202), and a device application usage profile for the unknown computing device is generated (203) based on the network traffic data related to the unknown computing device. The device application usage profile of the unknown computing device is compared (204) with the device application usage profile of the one or more known computing devices of the local network. In response to detecting a difference between the device application usage profile of the unknown computing device and the device application usage profile of the one or more known computing devices of the local network satisfying a predetermined threshold, the unknown device is identified (205) as one of the known computing devices of the local network.