Asset detection system

• US 9,847,965 B2
• Filed: 06/02/2015
• Issued: 12/19/2017
• Est. Priority Date: 04/11/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Hugard, IV, James Michael, Keir, Robin, Rebelo, Joshua Cajetan, Arkin, Ofir, Schrecker, Sven
• Primary Examiner(s): DOAN, DUYEN MY
• Application Number:
  US14/728,612
• Publication Number:
  US 20160057101A1
• Time in Patent Office: 931 Days
• Field of Search: 709224-225
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

A pluggable asset detection engine is used to identify devices within a network. The pluggable asset detection engine includes a set of pluggable discovery sensors and is adapted to identify particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors, and send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

Claims

1. A method comprising:

determining, using an asset detection engine, address information of a particular computing device within a network using a first pluggable discovery sensor in a set of discovery sensors included in the asset detection engine, wherein the first pluggable discovery sensor comprises a passive-type discovery sensor;

adding a second pluggable discovery sensor to the set of discovery sensors included in the asset detection engine, wherein the second pluggable discovery sensor comprises an active-type discovery sensor;

determining address information of another computing device within the network using the second pluggable discovery sensor; and

sending an identification of the address information of the particular computing device to an asset management system for inclusion of the address information in an asset repository managed by the asset management system.

2. The method of claim 1, further comprising identifying additional attributes of the particular computing device using another pluggable discovery sensor in the set of discovery sensors.

3. The method of claim 2, wherein a security policy is assigned to the particular computing device based on the identified attributes identified using pluggable discovery sensors in the set of discovery sensors.

4. The method of claim 3, wherein the additional attributes include at least one of active ports of the particular computing device, operating systems of the particular computing device, and applications of the particular computing device.

5. The method of claim 3, wherein the particular computing device is tagged to associate the particular computing device with a particular grouping of computing devices and the security policy is associated with the particular grouping of computing devices.

6. The method of claim 1, wherein each discovery sensor in the set of discovery sensors is a pluggable discovery sensor.

7. The method of claim 1, wherein the asset management system determines that the identified address information was not previously included in the asset repository, and determines discovery of the particular computing device within the network based on identification of the address information.

8. The method of claim 1, further comprising replacing one pluggable discovery sensor in the set of discovery sensors with another pluggable discovery sensor.

9. The method of claim 1, wherein the passive-type discovery sensor comprises an event-based pluggable discovery sensor adapted to identify address information of computing devices on the network from event record data describing events in the network identified by event management services on the network.

10. The method of claim 9, wherein the event-based pluggable discovery sensor is adapted to access event record data of at least one of dynamic host configuration protocol (DHCP) server events, Active Directory audit events, firewall events, and intrusion prevention system (IPS) events.

11. The method of claim 1, wherein the passive-type discovery sensor comprises a latent-type pluggable discovery sensor adapted to identify address information of computing devices on the network from network traffic monitored by the passive-type pluggable discovery sensor.

12. The method of claim 11, wherein the latent-type pluggable discovery sensor is adapted to monitor at least one of NetBIOS broadcast packets in the network traffic, internet control message protocol version 6 (ICMPv6) network traffic, and network traffic via port mirroring.

13. The method of claim 1, wherein the passive-type discovery sensor comprises an indirect-type pluggable discovery sensor adapted to query services of the network for data including address information of computing devices within the network.

14. The method of claim 13, wherein the indirect-type pluggable discovery sensor is adapted to at least one of query a simple network management protocol (SNMP) management information base (MIB), query a DHCP database, query a router table, and issue a netstat command on another computing device in the network.

15. The method of claim 1, wherein the active-type pluggable discovery sensor is adapted to send data to the particular computing device and monitor responses to the sent data by the particular computing device.

16. The method of claim 15, wherein the data sent by the active-type pluggable discovery sensor includes at least one of a set of internet control message protocol (ICMP) packets, a set of transmission control protocol (TCP) packets, and a set of user datagram protocol (UDP) packets.

17. The method of claim 1, wherein the passive-type discovery sensor is one of a latent-type discovery sensor, event-based discovery sensor, and indirect-type discovery sensor.

18. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

determine, using an asset detection engine, address information of a particular computing device within a network using a first pluggable discovery sensor in a set of discovery sensors included in the asset detection engine, wherein the first pluggable discovery sensor comprises a passive-type discovery sensor;

add a second pluggable discovery sensor to the set of discovery sensors included in the asset detection engine, wherein the second pluggable discovery sensor comprises an active-type discovery sensor;

determine address information of another computing device within the network using the second pluggable discovery sensor; and

send an identification of the address information of the particular computing device to an asset management system for inclusion of the address information in an asset repository managed by the asset management system.

19. A system comprising:

at least one processor device;

at least one memory element; and

a pluggable asset detection engine including a set of pluggable discovery sensors, adapted when executed by the at least one processor device to;

determine particular address information of a particular computing device within a network, using a first pluggable discovery sensor in the set of discovery sensors, wherein the first pluggable discovery sensor comprises a passive-type discovery sensor;

add a second pluggable discovery sensor to the set of discovery sensors included in the asset detection engine, wherein the second pluggable discovery sensor comprises an active-type discovery sensor;

determine address information of another computing device within the network using the second pluggable discovery sensor; and

send an identification of the particular address information of the particular computing device to an asset management system for inclusion of the particular address information in an asset repository managed by the asset management system.

20. The system of claim 19, further comprising the asset management system, the asset management system adapted when executed by the at least one processor device to:

receive the particular address information from the asset detection engine;

determine whether the address information is associated with devices described in the asset repository; and

supplement the asset repository with address information not included in the asset repository.

21. The system of claim 19, wherein the asset detection engine is a first asset detection engine in a plurality of asset detection engines in the system.

22. The system of claim 21, wherein the plurality of asset detection engines includes a second asset detection engine, the set of discovery sensors of the first asset detection engine is a first set, the second asset detection engine includes a second set of discovery sensors, and the first set of discovery sensors is different from the second set of discovery sensors.

23. The system of claim 22, wherein one of the first pluggable discovery sensor and second pluggable discovery sensor is also included in the second set of discovery sensors.