Network Device Type Prediction for Dynamic Security Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network mapping technologies struggle to accurately and dynamically determine the type of devices within a network due to changes in device configurations and locations over time.
Innovation Solution
Utilizing a trained machine learning module to assign unique identification codes, calculate confidence scores, and determine type information for devices within a network, incorporating a semi-supervised model framework to predict and dynamically update device types based on digital fingerprints and historical data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network mapping methods are used to identify devices, then the process is simple and direct, but the accuracy of device type identification deteriorates due to device configuration changes and movements over time
Solution Approach 1:
The patent implements dynamic device type identification by continuously monitoring device behaviors, network traffic patterns, and configuration changes over time. The system updates device type classifications dynamically rather than using static initial identification, allowing accurate tracking of devices that move or change configurations within the network.
Solution Approach 2:
The system employs feedback mechanisms where identified device types and their behaviors are continuously monitored and fed back into the identification process. This feedback loop enables the system to refine and adjust device type classifications based on observed patterns, improving identification accuracy while adapting to changes in device configurations and locations.
2Measurement precision
If continuous monitoring of device behaviors is implemented to improve identification accuracy, then device type identification accuracy improves, but the computational resources and processing time increase
Solution Approach 1:
The patent performs preliminary actions by establishing baseline device type classifications early in the network mapping process. These preliminary identifications serve as initial references that reduce the need for extensive continuous analysis, allowing the system to focus computational resources on detecting significant changes rather than re-analyzing all device attributes constantly.
Solution Approach 2:
The system implements periodic monitoring and analysis of device behaviors rather than continuous real-time analysis. By sampling device activities at intervals and comparing them against established patterns, the system maintains high identification accuracy while significantly reducing computational overhead and processing time requirements.
3Measurement precision
If detailed device information is collected to enhance identification accuracy, then the precision of device type determination improves, but the quantity of data to be processed increases
Solution Approach 1:
The patent extracts and focuses on specific key attributes and behavioral patterns that are most indicative of device types, rather than processing all available device data. By selectively collecting and analyzing only the most relevant information such as network traffic patterns, service responses, and configuration characteristics, the system achieves high identification precision while minimizing data volume.
Solution Approach 2:
The system applies different levels of data collection and analysis depth to different device types and network segments. Rather than uniformly collecting detailed information from all devices, the system tailors the depth of information gathering to the specific identification needs of each device category, reducing overall data volume while maintaining identification precision where it matters most.
Data Source
AI summary
In some embodiments, the present disclosure provides an exemplary method that may include steps of obtaining data associated with a device within a network; determining a software being performed via type information of the device based on a scan of the network and data associated with the device; generating a type label for the device based on the software being performed; and generating, by the processor, a network security map that represents a topology of the network, wherein the network security map maps the device within the topology according to the type label so as to facilitate causing at least one security action with respect to the device within the network.