Network system role determination

• US 20060069805A1
• Filed: 07/30/2004
• Published: 03/30/2006
• Est. Priority Date: 07/30/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Dow, Ramsey, Santerre, Pierre-Yves, LeBlanc, David
• Granted Patent: US 7,912,940 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The role of a system in a network may be categorized as a networking system, a security system, a systems management system, a mail system, a database system, a web system, a file/print system, a communication and collaboration system, and/or any other system in the network. The role of a target system may be determined by sending test probes to one or more systems in a target network. The test probes may be data packets crafted to produce a particular response from a target system. The received responses may be compared to signature responses of a basis system with known operating system, services, and/or roles. By matching the received responses with signature responses, a role resolver may associate a role with the target system.

Claims

1. A computer readable medium having computer executable instructions for performing steps comprising:

(a) accessing a target response of a target system, the target response being at least a portion of a reply to a test probe;

(b) comparing the target response with a signature response of a basis system having a first role;

(c) associating the first role with the target system based on the comparison of the target response and the signature response.

2. The computer readable medium of claim 1, further comprising sending a test probe to an Internet Protocol address of the target system, and receiving the target response to the test probe.

3. The computer readable medium of claim 1, wherein the test probe includes an Internet control message protocol packet.

4. The computer readable medium of claim 1, further comprising sending a test probe to a port of the target system, receiving the target response to the test probe, and storing the target response in a target data store.

5. The computer readable medium of claim 4, wherein the test probe includes a transmission control protocol/Internet protocol connection request.

6. The computer readable medium of claim 5, wherein the test probe includes a web page request.

7. The computer readable medium of claim 4, wherein the target response indicates at least one service provided by the target system.

8. The computer readable medium of claim 7, further comprising determining a provider of the at least one service.

9. The computer readable medium of claim 1, further comprising determining an operating system of the target system based on the comparison of the target response and the signature response.

10. The computer readable medium of claim 1, wherein the first role is one of a group consisting of networking, collaboration and communication, security, systems management, file/print, mail, database, and web.

11. The computer readable medium of claim 1, further comprising determining a second role of the target system.

12. The computer readable medium of claim 11, wherein the first role is a general role and the second role is a specific instance of the general role.

13. The computer readable medium of claim 11, wherein the first role is a general role and the second role is an other general role different from the first role.

14. The computer readable medium of claim 1, further comprising determining a confidence level of the first role.

15. The computer readable medium of claim 1, further comprising associating the target response with the first role.

16. The computer readable medium of claim 1, further comprising storing a plurality of target responses in a target data store.

17. A computer readable medium having stored thereon a data structure comprising:

(a) a first data field containing data representing a role of a basis system;

(b) a second data field associated with the first data field containing data representing a test probe identifier indicative of a test probe; and

(c) a third data field associated with the second data field containing data representing a signature response of the basis system in response to the test probe.

18. The computer readable medium of claim 17, wherein the role is one of a group consisting of networking, collaboration and communication, security, systems management, file/print, mail, database, and web.

19. The computer readable medium of claim 17, further comprising a fourth data field associated with the second data field containing data representing a provider of the role.

20. The computer readable medium of claim 17, further comprising a fifth data field associated with the second data field containing data representing a confidence level of the role.

21. The computer readable medium of claim 17, further comprising a sixth data field associated with the second data field containing data representing an operating system identifier.

22. A computer readable medium having computer executable components comprising:

(a) a signature data store component for storing a role identifier associated with at least one test probe identifier, each test probe identifier being associated with a signature response;

(b) a probe engine component for sending a test probe to a target system, and for receiving a response from the target system in response to the test probe; and

(c) a role resolver for determining a role of the target system based on a comparison of the response from the target system with the signature response.

23. The computer readable medium of claim 22, further comprising a test probe data store component accessed by the probe engine component, for storing the test probe identifier associated with at least one test packet.

24. The computer readable medium of claim 23, where at least one test packet is an Internet control message protocol packet.

25. The computer readable medium of claim 23, wherein at least one test packet is a transmission control protocol/Internet protocol packet.

26. The computer readable medium of claim 23, wherein at least one test packet is a request for a service from the target system.

27. The computer readable medium of claim 22, wherein the role is a general role which is one of a group consisting of networking, collaboration and communication, security, systems management, file/print, mail, database, and web.

28. The computer readable medium of claim 27, wherein the role resolver determines a specific type of general role.

29. The computer readable medium of claim 22, wherein the role resolver determines a plurality of different roles of the target system.

30. The computer readable medium of claim 29, wherein the plurality of roles includes a first role and a second role that is different from the first role.

31. The computer readable medium of claim 22, wherein the role resolver determines at least one of the group consisting of an operating system of the target system, a version of the operating system of the target system, a provider of the operating system, at least one service supported by the target system, a provider of the at least one service, a confidence level of the role, and an activity indicator of the target system.

32. A system for managing systems comprising:

(a) a database component that stores a role associated with a test probe identifier indicative of a test probe sendable to a target system, and a signature response to the test probe;

(b) a memory in which machine instructions are stored; and

(c) a processor that is coupled to the database and the memory, the processor executing the machine instructions to carry out a plurality of functions including;

(i) sending a plurality of test packets to a target system;

(ii) receiving at least one response from the target system;

(iii) matching the at least one response to a signature response of a basis system; and

(iv) associating a role of the basis system with the target system.

33. The system of claim 32, wherein the at least one response indicates at least one service provided by the target system.

34. The system of claim 33, further comprising determining a provider of the at least one service.

35. The system of claim 32, wherein the first role is one of a group consisting of a networking, collaboration and communication, security, systems management, file/print, mail, database, and web.

36. The system of claim 32, further comprising determining a second role of the target system.

37. The system of claim 32, further comprising determining a confidence level of the first role.

38. The system of claim 32, wherein associating a role includes associating multiple roles with the target system.

39. The system of claim 38, further comprising associating at least one confidence level with the first role