Predicted-Filename Network Inspection for Remote Device Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems, such as UPnP and SSDP, are limited to local area networks and cannot effectively classify devices outside the broadcast domain, hindering comprehensive device classification across computer networks.
Innovation Solution
A network monitor entity that predicts filenames for open port numbers using statistical models, allowing it to request and classify devices beyond the local area network by sending HTTP requests with the most likely filename and port number combinations, thereby bypassing the limitations of UPnP and SSDP.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If UPnP and SSDP protocols are used for device discovery, then device classification within local area network is enabled, but device classification outside broadcast domain is prevented
Solution Approach 1:
The patent introduces HTTP requests as an intermediary mechanism to bridge the gap between local broadcast domain limitations and remote device discovery. By using HTTP requests to directly access device description files on remote devices, the system bypasses the broadcast domain restriction of traditional UPnP/SSDP while maintaining reliable device classification capabilities across extended networks.
2Adaptability or versatility
If statistical models are used to predict filenames for open ports, then device description retrieval across networks is enabled, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-collecting and storing statistical data about filename patterns associated with specific open port numbers. This statistical model is built in advance from observed device behaviors, allowing the system to make informed predictions about device description file locations without requiring complex real-time analysis during device discovery operations.
3Loss of information
If HTTP requests are sent to retrieve device descriptions from remote devices, then comprehensive device classification is achieved, but network traffic increases
Solution Approach 1:
The patent implements partial action by selectively sending HTTP requests only to devices and ports where statistical probability indicates a high likelihood of successful device description retrieval. Rather than exhaustively querying all possible devices and ports, the system focuses network traffic on the most promising targets based on pre-built statistical models, reducing overall network bandwidth consumption while maintaining information completeness.
Data Source
AI summary
Systems, methods, and related technologies for a proactive inspection system for improved classification of devices are described. A device is discovered on a network that has a first open port number. A filename is obtained based on a likelihood that the filename is being used as a name for file content, in association with the first open port number. The file content is obtained from the device with the first open port number and the filename. The device is classified with the file content.