Network system role determination

• US 7,912,940 B2
• Filed: 07/30/2004
• Issued: 03/22/2011
• Est. Priority Date: 07/30/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Dow, Ramsey, Santerre, Pierre-Yves, LeBlanc, David
• Primary Examiner(s): Nguyen; Quang N.
• Application Number:
  US10/903,875
• Publication Number:
  US 20060069805A1
• Time in Patent Office: 2,426 Days
• Field of Search: 709/223, 709/224, 709/226, 709/228, 709/237, 713/151
• US Class Current: 709/224
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The role of a system in a network may be categorized as a networking system, a security system, a systems management system, a mail system, a database system, a web system, a file/print system, a communication and collaboration system, and/or any other system in the network. The role of a target system may be determined by sending test probes to one or more systems in a target network. The test probes may be data packets crafted to produce a particular response from a target system. The received responses may be compared to signature responses of a basis system with known operating system, services, and/or roles. By matching the received responses with signature responses, a role resolver may associate a role with the target system.

Claims

1. A computer readable memory device having computer executable instructions that when executed by a processor of a computing system perform a method comprising:

accessing a target response of a target system, the target response comprising at least a portion of a reply to a test probe;

determining a service supported by the target system by comparing the target response with a signature response;

comparing the service supported by the target system with one or more roles associated with the service supported to determine at least one role of the target system; and

determining a confidence level of the target system functioning in the at least one role of the target system;

wherein the confidence level is a function of a number of roles to which the target response corresponds; and

wherein the confidence level is indicated with a confidence level indicator comprising a numerical weight value.

2. The computer readable memory device of claim 1, comprising sending the test probe to an Internet Protocol address of the target system and receiving the target response in response to the test probe.

3. The computer readable memory device of claim 1, wherein the test probe comprises an Internet control message protocol packet.

4. The computer readable memory device of claim 1, comprising sending the test probe to a port of the target system, receiving the target response in response to the test probe, and storing the target response in a target data store.

5. The computer readable memory device of claim 4, wherein the test probe comprises a transmission control protocol/Internet protocol connection request.

6. The computer readable memory device of claim 5, wherein the test probe comprises a web page request.

7. The computer readable memory device of claim 1, comprising sending the test probe to a network name of the target system and receiving the target response in response to the test probe.

8. The computer readable memory device of claim 1, comprising determining a provider of the service supported.

9. The computer readable memory device of claim 1, comprising determining an operating system of the target system based on the comparison of the target response and the signature response.

10. The computer readable memory device of claim 1, wherein the at least one role is from a group consisting of networking, collaboration and communication, security, systems management, file/print, mail, database, and web.

11. The computer readable memory device of claim 1, wherein the confidence level indicator comprises a value of high, medium, or low.

12. A computer readable memory device having computer executable instructions that when executed cause a computer to store:

a first data field comprising data representing a target response of a target system, the target response comprising at least a portion of a reply to a test probe;

a second data field associated with the first data field comprising data representing a service supported by the target system as determined by comparing the target response with a signature response;

a third data field associated with the second data field comprising data representing at least one role of the target system as determined by comparing the service supported by the target system with one or more roles associated with the service supported; and

a fourth data field associated with the third data field comprising data representing a confidence level of the target system functioning in the at least one role of the target system;

wherein the confidence level is a function of a number of roles to which the target response corresponds; and

wherein the confidence level is indicated with a confidence level indicator comprising a numerical weight value.

13. A computer readable memory device having computer executable components comprising:

a role resolver for determining at least one role of a target system by determining a service supported by the target system based on a comparison of a response of the target system to a test probe with a signature response and comparing the service supported by the target system with one or more roles associated with the service supported to determine at least one role of the target system; and

a confidence determiner for determining a confidence level of the target system functioning in the at least one role of the target system;

wherein the confidence level is a function of a number of roles to which the target response corresponds; and

wherein the confidence level is indicated with a confidence level indicator comprising a numerical weight value.

14. The computer readable storage memory device of claim 13, comprising a test probe data store component configured to store the test probe associated with at least one test packet.

15. The computer readable memory device of claim 14, wherein the at least one test packet is an Internet control message protocol packet.

16. The computer readable memory device of claim 14, wherein the at least one test packet is a transmission control protocol/Internet protocol packet.

17. The computer readable memory device of claim 13, wherein the at least one role is from a group consisting of networking, collaboration and communication, security, systems management, file/print, mail, database, and web.

18. The computer readable memory device of claim 13, wherein the role resolver determines at least one of an operating system of the target system, a version of the operating system of the target system, a provider of the operating system, a provider of the service supported, and an activity indicator of the target system.

19. A system for managing systems comprising:

a memory in which machine instructions are stored; and

a processor that is coupled to the memory, the processor executing the machine instructions to perform acts comprising;

accessing a target response of a target system, the target response comprising at least a portion of a reply to a test probe;

determining a service supported by the target system by comparing the target response with a signature response;

comparing the service supported by the target system with one or more roles associated with the service supported to determine at least one role of the target system; and

determining a confidence level of the target system functioning in the at least one role of the target system;

wherein the confidence level is a function of a number of roles to which the target response corresponds; and

wherein the confidence level is indicated with a confidence level indicator comprising a numerical weight value;

comparing the service supported by the target system with one or more roles associated with the services supported to determine at least one role of the target system.

20. The system of claim 19, wherein the at least one role is from a group consisting of a networking, collaboration and communication, security, systems management, file/print, mail, database, and web.