NETWORK VISIBILITY

• US 20200136919A1
• Filed: 12/27/2019
• Published: 04/30/2020
• Est. Priority Date: 01/31/2017
• Status: Active Grant

• Current Assignee: ForeScout Technologies Incorporated
• Original Assignee: ForeScout Technologies Incorporated
• Inventors: Fainberg, Ilya, Lam, Anderson, Sudakovitch, Mihael
• Granted Patent: US 11,240,114 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Systems, methods, and related technologies for device monitoring are described. In certain aspects, network traffic data is analyzed to determine one or more devices associated with a network. The network may be a remote network. The network traffic data may further be used to determine one or more non-active devices associated with the network.

Claims

1. A method comprising:

receiving device data associated with one or more devices coupled to a first network, wherein the device data comprises data of one or more active devices coupled to the first network;

receiving network traffic data associated with the first network at a device coupled to a second network; and

determining, by a processing device, based on the network traffic data associated with the first network one or more devices that were coupled to the first network, wherein the determining based on the network traffic data is operative to determine one or more non-active devices associated with the first network.

2. The method of claim 1, wherein the first network is a remote network from the processing device. The method of claim 1, wherein the one or more non-active devices comprises a virtual machine.

4. The method of claim 1, wherein the first network is a cloud computing network.

5. The method of claim 4, wherein the data associated with the one or more devices coupled to the first network is from a cloud management system.

6. The method of claim 1, wherein the data associated with the one or more devices coupled to the first network is from a hypervisor.

7. The method of claim 1 further comprising:

storing information comprising a first data associated with the one or more active devices coupled to the first network and a second data associated with the one or more non-active devices associated with the first network.

8. The method of claim 1 further comprising:

initiating an action based on the data of one or more active devices coupled to the first network and data associated with the one or more non-active devices associated with the first network.

9. The method of claim 8, wherein the action comprises changing network access of a non-active device.

10. A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to;

receive device data associated with one or more devices coupled to a first network, wherein the device data comprises data of one or more active devices coupled to the first network;

receive network traffic data associated with the first network;

determine based on the network traffic data associated with the first network one or more devices coupled to the first network;

determine, based on the network traffic data and the device data, one or more non-active devices associated with the first network; and

store information comprising a first data associated with the one or more active devices coupled to the first network and a second data associated with the one or more non-active devices associated with the first network.

11. The system of claim 10, wherein the processing device further to:

initiate an action based on the data comprising the data of one or more active devices coupled to the first network and data associated with the one or more non-active devices associated with the first network.

12. The system of claim 11, wherein the action comprises sending a notification associated with the one or more non-active devices.

13. The system of claim 10, wherein the determination of the one or more non-active devices associated with the first network is based on a comparison of the network traffic data and the device data.

14. The system of claim 10, wherein the first network is a cloud computing network.

15. The system of claim 10, wherein the processing device is part of a network access control (NAC) device.

16. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

send a request for network traffic data to a remote network;

receive the network traffic data; and

determine a set of one or more devices associated with the remote network based on the network traffic data, wherein the one or more devices comprises one or more active devices associated with the remote network and one or more non-active devices associated with the remote network.

17. The non-transitory computer readable medium of claim 16, wherein the processing device further to:

store the set of one or more devices associated with the remote network.

18. The non-transitory computer readable medium of claim 16, wherein the processing device further to:

initiate an action based on the set of one or more devices associated with the remote network.

19. The non-transitory computer readable medium of claim 16, wherein the processing device further to:

request device data associated with one or more devices coupled to a first network, wherein the device data comprises data of one or more active devices coupled to the first network at a first interval.

20. The non-transitory computer readable medium of claim 19, wherein the processing device further to:

send the request for network traffic data at a second interval.