SYSTEM AND METHOD FOR RESOLVING OPERATING SYSTEM OR SERVICE IDENTITY CONFLICTS

• US 20110314143A1
• Filed: 06/22/2010
• Published: 12/22/2011
• Est. Priority Date: 06/22/2010
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Sourcefire Incorporated (Cisco Systems, Inc.)
• Inventors: Vogel, William Andrew III, Baker, Andrew
• Granted Patent: US 8,671,182 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system includes a processor device. The processor device is configured to receive reports of operating system identities for a single host; determine which of the operating system identities are an intersection of the reported operating system identities; and assign the intersection of the reported operating system identities as a resolved operating system identity.

Claims

1. A system, comprising:

a processor device configured to;

receive reports of operating system identities for a single host;

determine which of the operating system identities are an intersection of the reported operating system identities; and

assign the intersection of the reported operating system identities as a resolved operating system identity.

2. The system of claim 1, one report of operating systems being one set of identities to which a host fingerprint maps, the intersection of the reported operating system identities being calculated as a set intersection among the reports of operating system identities for the single host.

3. The system of claim 1, further comprising assigning more weight to a more reliable type of fingerprint, and providing a confidence level to the resolved operating system identity.

4. The system of claim 1, further comprising assigning different weights to a same operating system identity based on a fingerprinting method that was used to relate the operating system to a reciprocating host.

5. The system of claim 1,

the reports being a passively detected report, an actively identified report and a manually input report,

further comprising pre-defining a preference relationship among the passively detected report, the actively identified report and the manually input report that defines which type of report to prefer when there is an un-resolvable conflict among the reports of operating system identities for the single host.

6. The system of claim 5, further comprising generating an alert when it is determined that there is the un-resolvable conflict among the reports of operating system identities for the single host.

7. A method, comprising:

in a processor device, receiving reports of operating system identities for a single host;

in the processor device, determining which of the operating system identities are an intersection of the reported operating system identities; and

assigning the intersection of the reported operating system identities as a resolved operating system identity.

8. The method of claim 7, one report of operating systems being one set of identities to which a host fingerprint maps, the intersection of the reported operating system identities being calculated as a set intersection among the reports of operating system identities for the single host.

9. The method of claim 7, further comprising assigning more weight to a more reliable type of fingerprint, and providing a confidence level to the resolved operating system identity.

10. The method of claim 7, further comprising assigning different weights to a same operating system identity based on a fingerprinting method that was used to relate the operating system to a reciprocating host.

11. The method of claim 7,

the reports being a passively detected report, an actively identified report and a manually input report,

further comprising pre-defining a preference relationship among the passively detected report, the actively identified report and the manually input report that defines which type of report to prefer when there is an un-resolvable conflict among the reports of operating system identities for the single host.

12. The method of claim 11, further comprising generating an alert when it is determined that there is the un-resolvable conflict among the reports of operating system identities for the single host.

13. An apparatus configured to perform the method of claim 7.

14. A computer readable medium comprising executable instructions for performing the method of claim 7.

15. A computer-readable storage medium comprising non-transitory computer-executable instructions for performing the steps of:

in a processor device, receiving reports of service identities for a single host;

in the processor device, determining which of the service identities are an intersection of the reported service identities; and

assigning the intersection of the reported service identities as a resolved service identity.

16. The medium of claim 15, one report of services being one set of identities to which a host fingerprint maps, the intersection of the reported service identities being calculated as a set intersection among the reports of service identities for the single host.

17. The medium of claim 15, further comprising assigning more weight to a more reliable type of fingerprint, and providing a confidence level to the resolved service identity.

18. The medium of claim 15, further comprising assigning different weights to a same service identity based on a fingerprinting method that was used to relate the service to a reciprocating host.

19. The medium of claim 15,

the reports being a passively detected report, an actively identified report and a manually input report,

further comprising pre-defining a preference relationship among the passively detected report, the actively identified report and the manually input report that defines which type of report to prefer when there is an un-resolvable conflict among the reports of service identities for the single host.

20. The medium of claim 19, further comprising generating an alert when it is determined that there is the un-resolvable conflict among the reports of service identities for the single host.