Asset detection system

• US 9,049,207 B2
• Filed: 04/11/2012
• Issued: 06/02/2015
• Est. Priority Date: 04/11/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hugard, James Michael IV, Keir, Robin, Rebelo, Joshua Cajetan, Arkin, Ofir, Schrecker, Sven
• Primary Examiner(s): Golabbakhsh, Ebrahim
• Application Number:
  US13/444,143
• Publication Number:
  US 20130275574A1
• Time in Patent Office: 1,147 Days
• Field of Search: 709/220, 709/224
• US Class Current: 1/1
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A pluggable asset detection engine is used to identify devices within a network. The pluggable asset detection engine includes a set of pluggable discovery sensors and is adapted to identify particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors, and send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify, using an asset detection engine, address information of a particular computing device within a network, wherein identification of the address information is facilitated by a first pluggable discovery sensor in a set of discovery sensors included in the asset detection engine, and the first pluggable discovery sensor comprises a passive-type discovery sensor;

identify, using the asset detection engine, other address information for at least one other computing device within the network, wherein identification of the other address information is facilitated by a second pluggable discovery sensor in the set of discovery sensors, and the second pluggable discovery sensor comprises an active discovery sensor; and

send an identification of the address information of the particular computing device to an asset management system for inclusion of the address information in an asset repository managed by the asset management system.

2. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to identify additional attributes of the particular computing device using another pluggable discovery sensor in the set of discovery sensors.

3. The storage medium of claim 2, wherein a security policy is assigned to the particular computing device based on the identified attributes identified using pluggable discovery sensors in the set of discovery sensors.

4. The storage medium of claim 3, wherein the additional attributes include at least one of active ports of the particular computing device, operating systems of the particular computing device, and applications of the particular computing device.

5. The storage medium of claim 3, wherein the particular computing device is tagged to associate the particular computing device with a particular grouping of computing devices and the security policy is associated with the particular grouping of computing devices.

6. The storage medium of claim 1, wherein each discovery sensor in the set of discovery sensors is a pluggable discovery sensor.

7. The storage medium of claim 1, wherein the asset management system determines that the identified address information was not previously included in the asset repository, and determines discovery of the particular computing device within the network based on identification of the address information.

8. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to add a pluggable discovery sensor to the set of discovery sensors.

9. The storage medium of claim 1, wherein the instructions, when executed, further cause the machine to replace one pluggable discovery sensor in the set of discovery sensors with another pluggable discovery sensor.

10. The storage medium of claim 1, wherein the passive type-discovery sensor comprises an event-based pluggable discovery sensor adapted to identify address information of computing devices on the network from event record data describing events in the network identified by event management services on the network.

11. The storage medium of claim 10, wherein the event-based pluggable discovery sensor is adapted to access event record data of at least one of dynamic host configuration protocol (DHCP) server events, Active Directory audit events, firewall events, and intrusion prevention system (IPS) events.

12. The storage medium of claim 1, wherein the passive-type pluggable discovery sensor is adapted to identify address information of computing devices on the network from network traffic monitored by the passive-type pluggable discovery sensor.

13. The storage medium of claim 12, wherein the passive-type pluggable discovery sensor is adapted to monitor at least one of NetBIOS broadcast packets in the network traffic, internet control message protocol version 6 (ICMPv6) network traffic, and network traffic via port mirroring.

14. The storage medium of claim 1, wherein the passive-type discovery sensor comprises an indirect-type pluggable discovery sensor adapted to query services of the network for data including address information of computing devices within the network.

15. The storage medium of claim 14, wherein the indirect-type pluggable discovery sensor is adapted to at least one of query a simple network management protocol (SNMP) management information base (MIB), query a DHCP database, query a router table, and issue a netstat command on another computing device in the network.

16. The storage medium of claim 1, wherein the active-type pluggable discovery sensor adapted to send data to the particular computing device and monitor responses to the sent data by the particular computing device.

17. The storage medium of claim 16, wherein the data sent by the active-type pluggable discovery sensor includes at least one of a set of internet control message protocol (ICMP) packets, a set of transmission control protocol (TCP) packets, and a set of user datagram protocol (UDP) packets.

18. The storage medium of claim 16, wherein the set of discovery sensors includes the active-type pluggable discovery sensor, the passive-type pluggable discovery sensor, wherein the passive-type discovery sensor is one of a latent-type discovery sensor, event-based discovery sensor, and indirect-type discovery sensor.

19. A method comprising:

identifying, using an asset detection engine, address information of a particular computing device within a network, wherein identification of the address information is facilitated by a first pluggable discovery sensor in a set of discovery sensors included in the asset detection engine, and the first pluggable discovery sensor is to comprise a passive-type discovery sensor;

identifying, using the asset detection engine, other address information for at least one other computing device within the network, wherein identification of the other address information is facilitated by a second pluggable discovery sensor in the set of discovery sensors, and the second pluggable discovery sensor is to comprise an active discovery sensor; and

sending an identification of the address information of the particular computing device to an asset management system for inclusion of the address information in an asset repository managed by the asset management system.

20. A system comprising:

at least one processor device;

at least one memory element; and

a pluggable asset detection engine including a set of pluggable discovery sensors, adapted when executed by the at least one processor device to;

identify particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors, wherein the first pluggable discovery sensor comprises a passive-type discovery sensor;

identify other address information for at least one other computing device within the network, using a second pluggable discovery sensor in the set of discovery sensors, wherein the second pluggable discovery sensor is to comprise an active discovery sensor; and

send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

21. The system of claim 20, further comprising the asset management system, the asset management system adapted when executed by the at least one processor device to:

receive the particular address information from the asset detection engine;

determine whether the address information is associated with devices described in the asset repository; and

supplement the asset repository with address information not included in the asset repository.

22. The system of claim 20, wherein the asset detection engine is a first asset detection engine in a plurality of asset detection engines in the system.

23. The system of claim 22, wherein the plurality of asset detection engines includes a second asset detection engine, the set of discovery sensors of the first asset detection engine is a first set, the second asset detection engine includes a second set of discovery sensors, and the first set of discovery sensors is different from the second set of discovery sensors.

24. The system of claim 23, wherein the first set of discovery sensors includes a particular discovery sensor also included in the second set of discovery sensors.