Dynamic Time Weighted Network Identification and Fingerprinting for IP Based Networks Based on Collection

• US 20100318633A1
• Filed: 06/16/2009
• Published: 12/16/2010
• Est. Priority Date: 06/16/2009
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Panchapagesan, Seshagiri, Carpenter, Todd L., Abzarian, David
• Application Number:
  US12/485,773
• Publication Number:
  US 20100318633A1
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

Techniques described herein describe a dynamic time weighted network identification and/or fingerprinting method. A method includes identifying one or more machines connected to a network of machines; performing an address resolution procedure on each of the one or more machines to determine one or more machine specific identifiers associated with each of the one or more machines; and applying a dynamic weighting to each identified machine on the network of machines as a function of a determined transience of each identified machine.

Claims

1. One or more computer-readable media storing computer-executable instructions that, when executed on one or more processors, perform acts comprising:

identifying one or more machines connected to a network of machines;

performing an address resolution procedure on each of the one or more machines to determine one or more machine specific identifiers associated with each of the one or more machines; and

applying a dynamic weighting to each identified machine on the network of machines as a function of a determined transience of each identified machine.

2. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for performing acts including identifying one or more machines connected to a network of machines further perform acts including:

scanning the network of machines for internet protocol (IP) addresses associated with the one or more machines.

3. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for performing acts including identifying one or more machines connected to a network of machines further perform acts including:

remotely connecting to one of the one or more machines operating as a router or a switch for the network of machines.

4. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for performing acts including identifying one or more machines connected to a network of machines further perform acts including:

transmitting a network data listing associated with the network of machines to a remote server.

5. The one or more computer-readable media as recited in claim 4, wherein the one or more computer-executable instructions configured for performing acts including transmitting a network data listing associated with the network of machines to a remote server further perform acts including:

receiving external internet protocol (IP) address data and the determined transience data from the external server to enable identification of the one or more machines.

6. The one or more computer-readable media as recited in claim 4, wherein the one or more computer-executable instructions configured for performing acts including transmitting a network data listing associated with the network of machines to a remote server further perform acts including:

receiving one or more external internet protocol (IP) addresses; and

performing an inverse query to identify one or more media access control (MAC) addresses associated with the one or more external IP addresses.

7. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for identifying one or more machines connected to a network of machines further perform acts including:

compiling a network data list of active internet protocol (IP) addresses of the one or more machines on the network; and

sharing the network data list with each of the one or more machines and with a remote entity.

8. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for performing an address resolution procedure on each of the one or more machines to determine one or more machine specific identifiers associated with each of the one or more machines further perform acts including:

collecting one or more medium access control (MAC) addresses of the one or more machines at one of the machines operating as a router for the one or more machines.

9. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for performing an address resolution procedure on each of the one or more machines to determine one or more machine specific identifiers associated with each of the one or more machines further perform acts including:

collecting the one or more machine specific identifiers including one or more of machine manufacturer, machine serial number, machine owner identification, and machine internet provider data, and machine associated internet protocol (IP) data.

10. The one or more computer-readable media as recited in claim 1, wherein the one or more computer-executable instructions configured for applying a dynamic weighting to each identified machine on the network of machines as a function of a determined transience of each identified machine is further configured for:

performing a cryptographic function on one or more of the one or more machine specific identifiers.

11. The one or more computer-readable media as recited in claim 10, wherein the one or more computer-executable instructions configured for performing a cryptographic function on one or more of the one or more machine specific identifiers is further configured for:

performing a hash on one or more of a media access control (MAC) address, an IP address, a serial number or machine specific metadata.

12. A computer-readable medium having computer-executable components comprising:

an identification module configured to identify one or more machines connected to a network of machines;

an address resolution module coupled to the identification module, the address resolution module configured to determine one or more machine specific identifiers associated with each of the one or more machines on the network of machines; and

a dynamic weighting module coupled to the identification module, the identification module configured to assign a weight to each of the one or more machines as a function of a determined transience of each identified machine.

13. The computer-readable medium of claim 12 having computer-executable components further comprising:

a data store coupled the dynamic weighting module, the data store configured to store a prior determined weighting accorded the one or more machines connected to the network.

14. The computer-readable medium of claim 13 having computer-executable components wherein the identification module is further configured with one or more computer-executable instructions configured for

receiving transience data from the one or more machines associated with the network of machines;

comparing the transience data to stored transience data related to two or more networks of machines; and

identifying the network of machines according to a statistical function applied to the compared transience data and the stored transience data.

15. The computer-readable medium of claim 13 having computer-executable components wherein the data store is located in a remote server coupled to the network via an internet connection, the data store configured to store one or more hash values representing the one or more machine specific identifiers.

16. A method for determining machine-specific statistics associated with a network, the method comprising:

receiving network identification data from one or more machines in a network;

transmitting externally available network data to the one or more machines on the network to enable identification of the one or more machines;

receiving transience data from the one or more machines, the transience data indicative of a transience associated with the one or more machines; and

generating transience statistical data from the transience data from the one or more machines and stored transience data.

17. The method of claim 16 further comprising:

transmitting the transience statistical data to the one or more machines.

18. The method of claim 16 wherein the receiving network identification data from one or more machines in a network includes cryptographically altering the network identification data.

19. The method of claim 16 wherein the receiving network identification data from one or more machines in a network includes receiving metadata from the one or more machines, including at least a media access control (MAC) address for each of the one or more machines.

20. The method of claim 16 wherein the generating transience statistical data from the transience data from the one or more machines and stored transience data includes applying a dynamic weighting to the transience data, the dynamic weighting including one or more of a linear weighting according to a time value, an exponential weighting, an administrator determined weighting, or an automatic weighting according to a self-learning weighting scheme.