Network Inventory System with Passive Endpoint Reporting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network inventory systems are incomplete and prone to overlapping due to the lack of passive analysis of network endpoints, failing to account for undocumented IT applications and irregularities such as malicious attempts, viruses, and malware, which are not detected unless actively participating in network traffic.
Innovation Solution
A network inventory system that passively collects information from network endpoints using commands like 'ifconfig', 'arp', 'netstat', and 'nslookup' to create an actual list of endpoints, compare it with a target list to identify new endpoints, and iteratively update the inventory, flagging duplicates and anomalies for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network inventory is done by analyzing network devices and active traffic, then network analysis can be performed, but the inventory remains incomplete and depends on active elements
Solution Approach 1:
Instead of having the inventory server actively scan and query network endpoints (traditional approach), the patent inverts the approach by having endpoints passively report their own information to the inventory server. This is achieved through agents installed on endpoints that automatically collect and send inventory data, eliminating the need for active scanning while achieving complete inventory coverage.
Solution Approach 2:
The patent implements self-service by enabling network endpoints to automatically generate and report their own inventory information without external intervention. Agents on endpoints autonomously collect data about installed software, hardware configurations, and network parameters, then transmit this information to the central inventory server, making the inventory process self-sufficient.
2Reliability
If network endpoints are passively analyzed, then complete inventory can be achieved without active participation, but traditional passive analysis methods lack knowledge of endpoints and applications
Solution Approach 1:
The patent introduces an intermediary agent component that runs on each network endpoint. This agent acts as a mediator between the passive endpoint and the inventory server, actively collecting detailed information about the endpoint's software, hardware, and applications, then transmitting this enriched data to the inventory server. This resolves the information loss problem while maintaining passive endpoint analysis.
Solution Approach 2:
The patent applies preliminary action by having agents on endpoints pre-collect and prepare inventory information before the inventory server needs it. The agents continuously monitor and gather data about installed applications, system configurations, and hardware, so when the inventory server requests information, complete and up-to-date data is already available, eliminating information gaps.
3Reliability
If network scans are performed to detect endpoints, then undocumented applications can be found, but active scanning requires endpoint participation and increases network traffic
Solution Approach 1:
The patent inverts the traditional network scanning approach by replacing active scanning with passive information collection. Instead of sending scan requests across the network that require endpoint responses, endpoints autonomously generate and transmit their inventory data. This eliminates the need for network-wide scanning traffic while achieving complete detection of all applications and endpoints.
Solution Approach 2:
The implementation uses self-service mechanisms where each endpoint's agent automatically collects and reports its own application inventory without external scanning. This eliminates the energy consumption and network traffic associated with active scanning while ensuring all undocumented applications are detected through their own self-reported data.
4Reliability
If inventory checks are performed to ensure completeness, then all endpoints can be identified, but overlaps and duplicates may occur in the inventory data
Solution Approach 1:
The patent implements feedback mechanisms where the inventory server receives inventory data from multiple endpoints and cross-validates the information. The server compares reported endpoints and applications against received data, identifies duplicates or conflicting information, and requests clarification or correction from relevant agents. This feedback loop ensures complete endpoint identification while maintaining high data accuracy by eliminating overlaps.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a network inventory system (100) with a plurality of computers which form network endpoints (110, 120, 130) in a computer network (101), wherein each network endpoint (110, 120, 130) comprises at least one interface (111, 112, 213) to the computer network (101) which is assigned a network address (IP1, IP2, IP3) and a physical address (MAC1, MAC2, MAC3); and an inventory server (160) for inventorying the computer network (101), wherein the inventory server (160) is aware of an initial number of network endpoints (110) of the computer network (101), and wherein the inventory server (160) is configured to receive the following network information from the network endpoints (110) known to it: the respective network address (IP1, IP2, IP3) and physical address (MAC1, MAC2, MAC3) of the at least one interface (111, 112, 213) of the known network endpoints (110), interfaces (121,331) with associated network address and physical address of further network endpoints (120, 330) located in a local network environment (103) of the known network endpoints (110), network addresses of interfaces (131, 421, 511) reachable for the known network endpoints (110) of further network endpoints (130, 420, 510) located outside the local network environment (103) of the known network endpoints (110), and based on the received network information to determine new network endpoints (120, 130, 330, 420, 510) that are not among the known network endpoints (110), to add the newly determined network endpoints (120, 130, 330, 420, 510) to the known network endpoints (110) and successively to further new network endpoints of the computer network (101) to determine.