Determining model information of devices based on network device identifiers

• US 9,135,293 B1
• Filed: 05/20/2013
• Issued: 09/15/2015
• Est. Priority Date: 05/20/2013
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kienzle, Darrell M., Elder, Matthew Cruz, Evans, Nathan S.
• Primary Examiner(s): Vy, Hung T
• Application Number:
  US13/897,891
• Time in Patent Office: 848 Days
• Field of Search: 707/609, 370/255, 370/400, 370/254
• US Class Current: 1/1
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for determining the model information of a device. A mapping database that maps a plurality of network device identifiers of a set of devices to model information of the devices may be automatically created. A request to determine model information of an unknown based on a network device identifier of the unknown device may then be received. The database may be analyzed to determine the model information of the unknown device. For example, the model information of the unknown device may be determined by extrapolating it based on the network device identifier of the device and the database information.

Claims

1. A method comprising:

receiving a request to determine model information of an unknown first device of a plurality of devices connected to a network, each of the plurality of devices having a corresponding network device identifier;

in response to receiving the request;

analyzing a database to determine the model information of the unknown first device, wherein the database includes database information that maps one or more of the plurality of network device identifiers to model information of one or more corresponding devices of the plurality of devices;

in response to determining a device identifier for the unknown first device is not already mapped to model information in the database, determining model information for the unknown first device without communicating with the unknown first device by;

extrapolating model information of the unknown first device based on portions of a device identifier associated with the request and the database information; and

determining a confidence level indicating a level of confidence that the extrapolated model information of the first device is correct;

returning the extrapolated model information of the first device and the confidence level in response to the request.

2. The method of claim 1, wherein said extrapolating the model information of the first device comprises:

determining a set of network device identifiers within a threshold range of the network device identifier of the first device; and

analyzing the database information to determine common model information to which at least a subset of the network device identifiers within the threshold range are mapped, wherein the model information of the first device is extrapolated to be the common model information.

3. The method of claim 1, further comprising:

prior to said receiving the request, analyzing the database information to generate pattern information indicating one or more patterns of mappings between the network device identifiers of the other devices and the model information of the other devices; and

storing the pattern information;

wherein said analyzing the database to determine the model information of the first device comprises extrapolating the model information of the first device based on the network device identifier of the first device and the pattern information.

4. The method of claim 1, wherein said extrapolating the model information of the first device comprises dynamically analyzing the database information in response to the request to identify one or more patterns of mappings between network device identifiers of devices other than the first device and the model information of the other devices.

5. The method of claim 1, further comprising creating the database prior to said receiving the request, wherein creating the database comprises:

for each device of a plurality of devices;

a) determining a network device identifier of the device;

b) determining model information identifying a model of the device; and

c) storing information in the database that maps the network device identifier of the device to the model information of the device.

6. The method of claim 5, wherein determining the model information identifying the model of a given device comprises automatically determining the model information without receiving user input specifying the model information.

7. The method of claim 5, wherein determining the model information identifying the model of a given device comprises communicating over the network with a software agent executing on the given device to receive the model information from the software agent.

8. The method of claim 5, wherein determining the model information identifying the model of a given device comprises passively intercepting model information transmitted by the given device over a network without communicating with the given device.

9. The method of claim 1, further comprising:

detecting that the first device is coupled to the network;

determining the network device identifier of the first device in response to said detecting; and

issuing the request to determine the model information of the first device, wherein the request includes the network device identifier of the first device.

10. The method of claim 1, wherein the model information specifies a family name of the first device and a model name of the first device.

11. The method of claim 1, wherein the network device identifier of the first device is a media access control (MAC) address of the first device, and wherein the database information maps a plurality of MAC addresses of the other devices to the model information of the other devices.

12. A computer accessible storage medium storing program instructions executable by one or more processors to:

receive a request to determine model information of an unknown first device of a plurality of devices connected to a network, each of the plurality of devices having a corresponding network device identifier;

in response to receiving the request;

analyze a database to determine the model information of the first device, wherein the database includes database information that maps one or more of the plurality of network device identifiers to model information of one or more corresponding devices of the plurality of devices;

in response to determining a device identifier for the unknown first device is not already mapped to model information in the database, determining model information for the unknown first device without communicating with the unknown first device by;

extrapolating model information of the unknown first device based on portions of a device identifier associated with the request and the database information; and

determining a confidence level indicating a level of confidence that the extrapolated model information of the first device is correct;

return the extrapolated model information of the first device and the confidence level in response to the request.

13. The computer accessible storage medium of claim 12, wherein the program instructions are further executable by the one or more processors to:

add new information to the database that maps the network device identifier of the first device to the extrapolated model information of the first device.

14. The computer accessible storage medium of claim 13, wherein the program instructions are further executable by the one or more processors to:

subsequent to said adding the new information to the database, receive a change request to change the model information to which the network device identifier of the first device is mapped in the database, wherein the change request specifies different model information; and

change the database information to map the network device identifier of the first device to the different model information.

15. The computer accessible storage medium of claim 13, wherein the program instructions are further executable by the one or more processors to:

mark the new information added to the database to indicate that the model information to which the network device identifier of the first device is mapped was extrapolated from the database.

16. A system comprising:

one or more processors; and

memory storing program instructions, wherein the program instructions are executable by the one or more processors to;

receive a request to determine model information of a first device of a plurality of devices connected to a network, each of the plurality of devices having a corresponding network device identifier;

in response to communicating with the first device receiving the request;

analyze a database to determine the model information of the first device, wherein the database includes database information that maps one or more of the plurality of network device identifiers to model information of one or more corresponding devices of the plurality of devices;

in response to at least determining a device identifier for the unknown first device is not already mapped to any model information in the database, determine model information for the unknown first device without communicating with the unknown first device by whereby the system is configured to;

extrapolate model information of the unknown first device based on portions of a device identifier associated with the request and the database information; and

determine a confidence level indicating a level of confidence that the extrapolated model information of the first device is correct;

return the extrapolated model information of the first device and the confidence level in response to the request.