ASSET DETECTION SYSTEM

• US 20130275574A1
• Filed: 04/11/2012
• Published: 10/17/2013
• Est. Priority Date: 04/11/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hugard, James Michael IV, Keir, Robin, Rebelo, Joshua Cajetan, Arkin, Ofir, Schrecker, Sven
• Granted Patent: US 9,049,207 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A pluggable asset detection engine is used to identify devices within a network. The pluggable asset detection engine includes a set of pluggable discovery sensors and is adapted to identify particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors, and send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

Claims

1. A method comprising:

identifying, using an asset detection engine, address information of a particular computing device within a network, wherein identification of the address information is facilitated by a first pluggable discovery sensor in a set of discovery sensors included in the asset detection engine; and

sending an identification of the address information of the particular computing device to an asset management system for inclusion of the address information in an asset repository managed by the asset management system.

2. The method of claim 1, further comprising identifying additional attributes of the particular computing device using a second pluggable discovery sensor in the set of discovery sensors.

3. The method of claim 2, wherein a security policy is assigned to the particular computing device based on the identified attributes identified using pluggable discovery sensors in the set of discovery sensors.

4. The method of claim 3, wherein the additional attributes include at least one of active ports of the particular computing device, operating systems of the particular computing device, and applications of the particular computing device.

5. The method of claim 3, wherein the particular computing device is tagged to associate the particular computing device with a particular grouping of computing devices and the security policy is associated with the particular grouping of computing devices.

6. The method of claim 1, wherein each discovery sensor in the set of discovery sensors is a pluggable discovery sensor.

7. The method of claim 1, wherein the asset management system determines that the identified address information was not included in the asset repository, identification of the address information discovers the particular computing device within the network.

8. The method of claim 1, further comprising adding a pluggable discovery sensor to the set of discovery sensors.

9. The method of claim 1, further comprising replacing one pluggable discovery sensor in the set of discovery sensors with another pluggable discovery sensor.

10. The method of claim 1, wherein the set of discovery sensors includes an event-based pluggable discovery sensor adapted to identify address information of computing devices on the network from event record data describing events in the network identified by event management services on the network.

11. The method of claim 10, wherein the event-based pluggable discovery sensor is adapted to access event record data of at least one of dynamic host configuration protocol (DHCP) server events, Active Directory audit events, firewall events, and intrusion prevention system (IPS) events.

12. The method of claim 1, wherein the set of discovery sensors includes a latent-type pluggable discovery sensor adapted to identify address information of computing devices on the network from network traffic monitored by the passive-type pluggable discovery sensor.

13. The method of claim 12, wherein the latent-type pluggable discovery sensor is adapted to monitor at least one of NetBIOS broadcast packets in the network traffic, internet control message protocol version 6 (ICMPv6) network traffic, and network traffic via port mirroring.

14. The method of claim 1, wherein the set of discovery sensors includes an indirect-type pluggable discovery sensor adapted to query services of the network for data including address information of computing devices within the network.

15. The method of claim 14, wherein the indirect-type pluggable discovery sensor is adapted to at least one of query a simple network management protocol (SNMP) management information base (MIB), query a DHCP database, query a router table, and issue a netstat command on another computing device in the network.

16. The method of claim 1, wherein the set of discovery sensors includes an active-type pluggable discovery sensor adapted to send data to the particular computing device and monitor responses to the sent data by the particular computing device.

17. The method of claim 16, wherein the data sent by the active-type pluggable discovery sensor includes at least one of a set of internet control message protocol (ICMP) packets, a set of transmission control protocol (TCP) packets, and a set of user datagram protocol (UDP) packets.

18. The method of claim 16, wherein the set of discovery sensors includes the active-type pluggable discovery sensor and at least one passive-type pluggable discovery sensor, wherein the passive-type discovery sensor is one of a latent-type discovery sensor, event-based discovery sensor, and indirect-type discovery sensor.

19. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

identifying, using an asset detection engine, address information of a particular computing device within a network, wherein identification of the address information is facilitated by a first pluggable discovery sensor in a set of discovery sensors included in the asset detection engine; and

sending an identification of the address information of the particular computing device to an asset management system for inclusion of the address information in an asset repository managed by the asset management system.

20. A system comprising:

at least one processor device;

at least one memory element; and

a pluggable asset detection engine including a set of pluggable discovery sensors, adapted when executed by the at least one processor device to;

identify particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors; and

send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

21. The system of claim 20, further comprising the asset management system, the asset management system adapted when executed by the at least one processor device to:

receive the particular address information from the asset detection engine;

determine whether the address information is associated with devices described in the asset repository; and

supplement the asset repository with address information not included in the asset repository.

22. The system of claim 20, wherein the asset detection engine is a first asset detection engine in a plurality of asset detection engines in the system.

23. The system of claim 22, wherein the plurality of asset detection engines includes a second asset detection engine, the set of discovery sensors of the first asset detection engine is a first set, the second asset detection engine includes a second set of discovery sensors, and the first set of discovery sensors is different from the second set of discovery sensors.

24. The system of claim 23, wherein the first set of discovery sensors includes a particular discovery sensor also included in the second set of discovery sensors.