Systems and methods for automatic device detection

• US 10,644,949 B2
• Filed: 03/29/2017
• Issued: 05/05/2020
• Est. Priority Date: 03/31/2016
• Status: Active Grant

• Current Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Original Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Inventors: Cebere, Bogdan C.
• Primary Examiner(s): Taylor, Nicholas R
• Assistant Examiner(s): Pena-Santana, Tania M
• Application Number:
  US15/472,515
• Publication Number:
  US 20170288965A1
• Time in Patent Office: 1,133 Days
• Field of Search: None
• CPC Class Codes: H04L 12/2807 Exchanging configuration information on appliance services in a home automation network arrangements for maintenance or administration involving network analysis for automatically determining the actual topology of a network H04L41/12; hardware or software tools for network management using graphical user interfaces H04L41/22; address allocation H04L61/50
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]

Abstract

Described systems and methods enable an automatic device detection/discovery, particularly of ‘Internet of Things’ client devices such as wearables, mobile communication devices, and smart home appliances, among others. Device detection comprises assigning a target device to a device category, such as “tablet computer from an unknown manufacturer, running Android®”. Some embodiments determine multiple preliminary category assignments according to distinct inputs such as HTTP user agent data, DHCP data, mDNS data, and MAC data. Each preliminary category assignment may come with an associated score. A definitive category assignment may be made according to an aggregate score. Applications include computer security, software provisioning, and remote device management, among others.

Claims

1. A device detection appliance comprising a hardware processor and a memory, the hardware processor configured to:

in response to receiving a set of data from a client device connected to the device detection appliance by a local network, select a candidate category from a plurality of pre-determined device categories, the candidate category characterized by a selected hardware device type co-occurring with a selected operating system;

determine a first score according to a first subset of the set of data, the first score indicative of a first degree to which the client device is representative of the candidate category;

determine a second score according to a second subset of the set of data, the second score indicative of a second degree to which the client device is representative of the candidate category;

combine the first and second scores to produce an aggregate score computed according to σ

·

w, wherein σ

denotes the first score and w denotes a numerical weight determined according to the candidate category; and

in response to producing the aggregate score, determine whether the client device belongs to the candidate category according to the aggregate score.

2. The device detection appliance of claim 1, wherein the aggregate score is determined according to:

w·

ƒ

(σ

),

wherein σ

denotes the first score, w denotes a numerical weight determined according to the first set of features, and wherein ƒ

(σ

) denotes a modified first score determined by applying an injective function ƒ

to the first score.

3. The device detection appliance of claim 1, wherein the hardware processor is further configured to:

in response to determining whether the client device belongs to the candidate category, when the client device belongs to the candidate category, transmit an indicator of a location of an agent installer to the client device, the agent installer selected from a plurality of agent installers according to the candidate category, wherein the agent installer is configured to install a software agent on the client device, the software agent configured to protect the client device against computer security threats.

4. The device detection appliance of claim 1, wherein the hardware processor is further configured to:

in response to determining whether the client device belongs to the candidate category, when the client device belongs to the candidate category, identify a computer security vulnerability of the client device according to the candidate category.

5. The device detection appliance of claim 1, wherein the client device is configured to assign network addresses to other client devices connected to the local network, and wherein the hardware processor is further configured to:

in response to determining whether the client device belongs to the candidate category, when the client device belongs to the candidate category, formulate a set of instructions according to the candidate category, the set of instructions configured, when executed by the client device, to render the client device unable to assign network addresses to the other client systems; and

in response to formulating the set of instructions, transmit the set of instructions to the client device.

7. The device detection appliance of claim 1, wherein the aggregate score is determined according to:

w·

ƒ

(σ

),

wherein σ

denotes the first score, w denotes a numerical weight determined according to the first set of features, and wherein ƒ

(σ

) denotes a modified first score determined by applying an injective function ƒ

to the first score.

12. The device detection appliance of claim 1, wherein the hardware processor is further configured to:

in response to receiving the set of data, select another candidate category from the plurality of pre-determined device categories, the other candidate category characterized by the selected hardware device type co-occurring with another operating system;

determine a third score indicative of a third degree to which the client device is representative of the other candidate category; and

in response, determine whether the client device belongs to the other candidate category according to the aggregate score and the third score.

14. The device detection appliance of claim 1, wherein the selected hardware device type is selected from a group consisting of a personal computer, a mobile telephone, a tablet computer, a printer, a router, a media player, a television set, a home appliance, and a wearable computer.

15. The device detection appliance of claim 1, wherein the weight is determined according to the selected hardware device type.

16. The device detection appliance of claim 1, wherein the candidate category is further characterized by a selected manufacturer co-occurring with the selected hardware device type and the selected operating system, and wherein the weight is determined according to the selected manufacturer.

17. The device detection appliance of claim 16, wherein the weight is determined according to a count of distinct device models produced by the selected manufacturer.

22. The device detection appliance of claim 1, wherein the aggregate score is determined according to a weighted sum of the first and second scores, wherein both weights multiplying the first and second scores, respectively, are determined according to the candidate category.

6. A method comprising employing at least one hardware processor of a device detection appliance to:

in response to receiving a set of data from a client device connected to the device detection appliance by a local network, select a candidate category from a plurality of pre-determined device categories, the candidate category characterized by a selected hardware device type co-occurring with a selected operating system;

employing the at least one hardware processor to determine a first score according to a first subset of the set of data, the first score indicative of a first degree to which the client device is representative of the candidate category;

employing the at least one hardware processor to determine a second score according to a second subset of the set of data, the second score indicative of a second degree to which the client device is representative of the candidate category;

employing the at least one hardware processor to combine the first and second scores to produce an aggregate score computed according to σ

·

w, wherein σ

denotes the first score and w denotes a numerical weight determined according to the candidate category; and

in response to producing the aggregate score, employing the at least one hardware processor to determine whether the client device belongs to the candidate category according to the aggregate score.

8. The method of claim 6, further comprising:

in response to determining whether the client device belongs to the candidate category, when the client device belongs to the candidate category, employing the at least one hardware processor to transmit an indicator of a location of an agent installer to the client device, the agent installer selected from a plurality of agent installers according to the candidate category of devices, wherein the agent installer is configured to install a software agent on the client device, the software agent configured to protect the client device against computer security threats.

9. The method of claim 6 further comprising:

in response to determining whether the client device belongs to the candidate category, when the client device belongs to the candidate category, employing the at least one hardware processor to identify a computer security vulnerability of the client device according to the candidate category.

10. The method of claim 6, wherein the client device is configured to assign network addresses to other client devices connected to the local network, the method further comprising:

in response to determining whether the client device belongs to the candidate category, when the client device belongs to the candidate category, employing the at least one hardware processor to formulate a set of instructions according to the candidate category, the set of instructions configured, when executed by the client device, to render the client system unable to assign network addresses to the other client systems; and

in response to formulating the set of instructions, employing the at least one hardware processor to transmit the set of instructions to the client device.

13. The method of claim 6, further comprising employing the at least one hardware processor to:

in response to receiving the set of data, select another candidate category from the plurality of pre-determined device categories, the other candidate category characterized by the selected hardware device type co-occurring with another operating system;

determine a third score indicative of a third degree to which the client device is representative of the other candidate category; and

in response, determine whether the client device belongs to the other candidate category according to the aggregate score and the third score.

18. The method of claim 6, wherein the selected hardware device type is selected from a group consisting of a personal computer, a mobile telephone, a tablet computer, a printer, a router, a media player, a television set, a home appliance, and a wearable computer.

19. The method of claim 6, wherein the weight is determined according to the selected device type.

20. The method of claim 6, wherein the candidate category is further characterized by a selected manufacturer co-occurring with the selected hardware device type and the selected operating system, and wherein the weight is determined according to the selected manufacturer.

21. The method of claim 20, wherein the weight is determined according to a count of distinct device models produced by the selected manufacturer.

23. The method of claim 6, wherein wherein the aggregate score is determined according to a weighted sum of the first and second scores, wherein both weights multiplying the first and second scores, respectively, are determined according to the candidate category.

11. A non-transitory computer-readable medium storing instructions which, when executed by at least a hardware processor of a device detection appliance, cause the device detection appliance to:

in response to receiving a set of data from a client device connected to the device detection appliance by a local network, select a candidate category from a plurality of pre-determined device categories, the candidate category characterized by a selected hardware device type co-occurring with a selected operating system;

determine a first score according to a first subset of the set of data, the first score indicative of a first degree to which the client device is representative of the candidate category;

determine a second score according to a second subset of the set of data, the second score indicative of a second degree to which the client device is representative of the candidate category;

combine the first and second scores to produce an aggregate score computed according to σ

·

w, wherein σ

denotes the first score and w denotes a numerical weight determined according to the candidate category; and

in response to producing the aggregate score, determine whether the client device belongs to the candidate category according to the aggregate score.