Network visibility

• US 10,560,336 B2
• Filed: 01/31/2017
• Issued: 02/11/2020
• Est. Priority Date: 01/31/2017
• Status: Active Grant

• Current Assignee: ForeScout Technologies Incorporated
• Original Assignee: ForeScout Technologies Incorporated
• Inventors: Fainberg, Ilya, Lam, Anderson, Sudakovitch, Mihael
• Primary Examiner(s): Nguyen, Dustin
• Assistant Examiner(s): Nguyen, Hao H
• Application Number:
  US15/420,471
• Publication Number:
  US 20180219742A1
• Time in Patent Office: 1,106 Days
• Field of Search: 709223, 709224, 709225, 709238, 709240, 723 2, 723 3, 723 4, 370235, 370252, 370255, 707758, 707776
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Systems, methods, and related technologies for device monitoring are described. In certain aspects, network traffic data is analyzed to determine one or more devices associated with a network. The network may be a remote network. The network traffic data may further be used to determine one or more non-active devices associated with the network.

Claims

1. A method comprising:

Receiving, at a first time interval, dev ice data associated with one or more devices coupled to a first network, wherein the device data comprises a number of devices and device information that can be used to identify one or more active devices coupled to the first network;

receiving, at a second time interval, network traffic data associated with the first network at a device coupled to a second network, wherein the first time interval and the second time interval are independent;

determining, by a processing device, based on the network traffic data, associated with the first network, one or more devices that were coupled to the first network, wherein the determining based on the network traffic data is operative to determine one or more non-active devices associated with the first network by comparing the device data with the network traffic data, wherein one or more non-active devices comprise one or more active devices that are presently in the network traffic data but are not presently active in the device data; and

initiating an action based on the device information and data associated with the one or more non-active devices, wherein the action comprises changing network access of a non-active device.

2. The method of claim 1, wherein the first network is a remote network from the processing device.

3. The method of claim 1, wherein the one or more non-active devices comprises a virtual machine.

4. The method of claim 1, wherein the first network is a cloud computing network.

5. The method of claim 4, wherein the device data associated with the one or more devices coupled to the first network is from a cloud management system.

6. The method of claim 1, wherein the device data associated with the one or more devices coupled to the first network is from a hypervisor.

7. The method of claim 1 further comprising:

storing information comprising a first data associated with the one or more active devices coupled to the first network and a second data associated with the one or more non-active devices associated with the first network.

8. A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to;

receive, at a first time interval, device data associated with one or more devices coupled to a first network, wherein the device data comprises a number of devices and device information that can be used to identify one or more active devices coupled to the first network;

receive, at a second time interval, network traffic data associated with the first network, wherein the first time interval and the second time interval are independent;

determine based on the network traffic data, associated with the first network, one or more devices coupled to the first network;

determine, based on a comparison of the network traffic data and the device data, one or more non-active devices associated with the first network, wherein one or more non-active devices comprise one or more active devices that are presently in the network traffic data but are not presently active in the device data;

store information comprising a first data associated with the one or more active devices coupled to the first network and a second data associated with the one or more non-active devices associated with the first network; and

initiate an action based on the comparison of the network traffic data and the device data, wherein the action comprises send a notification associated with the one or more non-active device.

9. The system of claim 8, wherein the first network is a cloud computing network.

10. The system of claim 8, wherein the processing device is part of a network access control (NAC) device.

11. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

request, at a first interval, device data associated with one or more devices, wherein the device data comprises a number of devices and device information that can be used to identify one or more active devices coupled to a first network;

send, at a second time interval, a request for network traffic data to a remote network, wherein the first time interval and the second time interval are independent;

receive the device data and the network traffic data;

determine a set of one or more devices associated with the remote network based on a comparison of the device data and the network traffic data, wherein the set of one or more devices comprises one or more active devices associated with the remote network and one or more non-active devices associated with the remote network, wherein one or more non-active devices comprise one or more active devices that are presently in the network traffic data but are not presently active in the device data; and

initiate an action based on the comparison of the device data and the network traffic data, wherein the action comprises send a notification associated with the one or more non-active device.

12. The non-transitory computer readable medium of claim 11, wherein the processing device further to:

store the set of one or more devices associated with the remote network.