Systems and methods for determining characteristics of a network and assessing confidence
First Claim
1. A method for selecting an operating system of a network device from the results of two or more operating system identification techniques used in a passive network detection system, comprising:
- employing the two or more operating system identification techniques to create two or more operating system results;
assigning each of the two or more operating system results a confidence value;
comparing confidence values of the two or more operating system results; and
selecting a result with a highest confidence value as the operating system of the network device,wherein the confidence values are pre-determined numeric weights based respectively on the two or more operating system identification techniques used to produce the two or more operating system results, further,if the selected result is equivalent to a previous selected result for the network device, adding a confirming increment value to a confidence value of the previous selected result to produce a confidence value of the result, wherein the confirming increment value is calculated as one half an absolute value of a difference between the confidence value of the previous selected result and the confidence value of the result;
if the result is not equivalent to the previous selected result for the network device, calculating a detracting increment value as one half of the confirming increment value and subtracting the detracting increment value from the confidence value of the previous selected result to produce the confidence value of the result.
3 Assignments
0 Petitions
Accused Products
Abstract
A packet transmitted on a network is read and decoded. A network device and its operating system are identified by analyzing the decoded packet. If more than one operating system is identified from the decoded packet, the operating system is selecting by comparing confidence values assigned to the operating systems identified. A service running on the network device is identified from the decoded packet or subsequent packets that are read, decoded and analyzed. The network topology of a network is determined by reading, decoding, and analyzing a plurality of packets. A flow between two network devices is determined by reading, decoding, and analyzing a plurality of packets. Vulnerabilities are assigned to operating systems and services identified by reading, decoding, and analyzing packets. Network configuration policy is enforced on operating systems and services identified by reading, decoding, and analyzing packets.
126 Citations
20 Claims
-
1. A method for selecting an operating system of a network device from the results of two or more operating system identification techniques used in a passive network detection system, comprising:
-
employing the two or more operating system identification techniques to create two or more operating system results; assigning each of the two or more operating system results a confidence value; comparing confidence values of the two or more operating system results; and selecting a result with a highest confidence value as the operating system of the network device, wherein the confidence values are pre-determined numeric weights based respectively on the two or more operating system identification techniques used to produce the two or more operating system results, further, if the selected result is equivalent to a previous selected result for the network device, adding a confirming increment value to a confidence value of the previous selected result to produce a confidence value of the result, wherein the confirming increment value is calculated as one half an absolute value of a difference between the confidence value of the previous selected result and the confidence value of the result; if the result is not equivalent to the previous selected result for the network device, calculating a detracting increment value as one half of the confirming increment value and subtracting the detracting increment value from the confidence value of the previous selected result to produce the confidence value of the result. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method for selecting a service of a network device from the results of two or more service identification techniques used in a passive network detection system, comprising:
-
employing the two or more service identification techniques to create two or more service results; assigning each of the two or more service results a confidence value; comparing confidence values of the two or more service results; and selecting a result with a highest confidence value as the service of the network device, wherein the confidence values are two or more predetermined numeric weights based respectively on the two or more service identification techniques used to produce the two or more service results, further if the selected result is equivalent to a previous selected result for the network device, adding a confirming increment value to a confidence value of the previous selected result to produce a confidence value of the result, wherein the confirming increment value is calculated as one half an absolute value of a difference between the confidence value of the previous selected result and the confidence value of the result; if the result is not equivalent to the previous selected result for the network device, calculating a detracting increment value as one half of the confirming increment value and subtracting the detracting increment value from the confidence value of the previous selected result to produce the confidence value of the result. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17)
-
-
18. A method for determining a confidence value of a result for one of an operating system and a service by considering previous results, comprising:
-
identifying a result from a first one or more packets by an identifying technique; if the result is equivalent to a previous result for a previous packet, adding a confirming increment value to a confidence value of the previous result to produce a confidence value of the result, wherein the confirming increment value is calculated as one half an absolute value of a difference between the confidence value of the previous result and the confidence value of the result; if the result is not equivalent to a previous result, calculating a detracting increment value as one half of the confirming increment value and subtracting the detracting increment value from the confidence value of the previous result to produce the confidence value of the result; identifying a subsequent result from a second one or more packets by a second identifying technique; if the subsequent result is equivalent to the result, calculating the confirming increment value as one half an absolute value of a difference between the confidence value of the previous result and the confidence value of the result and adding the confirming increment value to the confidence value of the result to produce a confidence value of the subsequent result; if the subsequent result is not equivalent to the result and the result is not equivalent to a previous result, doubling the detracting increment value and subtracting the detracting increment value from the confidence value of the result to produce the confidence value of the subsequent result; and if the subsequent result is not equivalent to the result and the result is equivalent to a previous result, calculating the detracting increment value as one half of the confirming increment value and subtracting the detracting increment value from the confidence value of the result to produce the confidence value of the subsequent result, wherein the confidence value is a numeric weight based on the identifying technique, wherein the first one or more packets, the second one or more packets, and the previous packet are from a same network device, wherein the identifying technique is used to identify an operating system or service of the network device. - View Dependent Claims (19, 20)
-
Specification