Peer-to-Peer Device Fingerprinting for Low-Disruption Software Deployment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device fingerprinting methods require a Man-in-the-Middle (MitM) device or extensive active scanning, which is not feasible in real-world scenarios, leading to inefficiencies and network disruptions.
Innovation Solution
A system utilizing distributed software agents for passive and active data collection, combined with a hierarchical machine learning model, including XGBoost and neural networks, to classify endpoint devices into operating system families, types, and roles, enabling accurate device fingerprinting without a MitM device and minimizing network disruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If active fingerprinting with extensive network scanning is used, then device identification capability is improved, but network disruption and performance impact worsen
Solution Approach 1:
The system performs only the minimum necessary active scanning to obtain fingerprinting data, rather than exhaustive network scanning. Software agents on endpoint devices collect local network information passively and perform limited active probing only when necessary, reducing overall network disruption while maintaining identification capability.
Solution Approach 2:
Endpoint devices perform self-identification by running software agents that automatically collect their own fingerprinting data (OS version, hardware identifiers, network configuration) without requiring external scanners. This eliminates the need for disruptive external active scanning while maintaining accurate device identification.
2Measurement precision
If passive fingerprinting using MitM device is used, then device identification capability is improved, but system complexity and deployment difficulty worsen
Solution Approach 1:
The system extracts the fingerprinting capability from the network infrastructure and embeds it directly into software agents running on endpoint devices. This eliminates the need for a separate MitM device while maintaining passive identification capability, reducing system complexity.
Solution Approach 2:
The software agents serve multiple functions: they act as both endpoint management agents and fingerprinting collectors. This multi-functionality eliminates the need for separate MitM devices dedicated to fingerprinting, simplifying the overall system architecture.
3Ease of operation
If centralized software management systems are used, then software deployment control is improved, but deployment time and resource consumption worsen
Solution Approach 1:
The software deployment system is segmented into hierarchical levels: centralized management for policy definition and distributed software agents on endpoint devices for local execution. This allows centralized control while enabling parallel deployment across multiple devices, reducing overall deployment time.
Solution Approach 2:
Software agents on endpoint devices perform preliminary actions by continuously monitoring system state, pre-fetching software packages, and preparing deployment environments before centralized deployment commands are issued. This reduces the actual deployment execution time when commands are received.
Data Source
AI summary
Disclosed herein are embodiments of methods, devices and systems for device fingerprinting and automatic and dynamic software deployment to one or more endpoints on a computer network. The device fingerprinting systems and devices herein are configured to operate with limited data without sitting between network devices and the internet, without monitoring all network traffic, and without limited or no active scanning. The embodiments herein may passively collect information as distributed peers and may perform very limited active scans. In some embodiments, the information is used as an input to a custom hierarchical learning model to fingerprint devices on a network by identifying attributes of the devices such as the operating system family, operating system version, and device role. In some embodiments, a dynamic deployer selection process may be utilized to simply and efficiently deploy software. Some embodiments herein involve end-to-end encryption of credentials in a deployment process.