NETWORK DNA

• US 20120066381A1
• Filed: 11/21/2011
• Published: 03/15/2012
• Est. Priority Date: 02/06/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Pradeep, Corbett, Christopher J., Khaki, Mohamed Jawad
• Granted Patent: US 8,676,969 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Network DNA may be determined for a computer network that taxonomically classifies the computer network. Network DNA may include derived network DNA components and raw network DNA components. Raw network DNA components may be acquired from local or remote sources. Derived network DNA components may be generated according to derived network DNA component specifications. Derived network DNA component specifications may reference raw network DNA components. Network DNA determined for the computer network may include a network species component capable of indicating network species classifications for computer networks. Network species classifications may include enterprise network, home network and public place network. Network species classifications may be determined as a function of network security, network management and network addressing. One or more network DNA stores may be configured to store network DNA for computer networks. Network DNA stores may store network DNA history as well as current network DNA.

Claims

1-44. -44. (canceled)

45. A computer-storage medium having thereon computer-executable instructions that, when executed on a computer connected to a computer network, the method comprising:

acquiring at least one network attribute corresponding to an attribute of the computer network;

generating a value for at least one derived network DNA component using at least one derived network DNA component specification and the at least one network attribute;

determining a network DNA for the computer network, the network DNA classifying the computer network, and the network DNA comprising the at least one derived network DNA component;

selecting a network DNA policy action to execute based on the at least one derived network DNA component meeting at least one condition specified in a network DNA policy; and

executing, on the computer connected to the computer network, the network DNA policy action of the network DNA policy, wherein executing the network DNA policy action comprises configuring network security settings of the computer based on the network DNA.

46. The computer-storage medium of claim 45, wherein:

the at least one derived network DNA component specification specifies a linear transformation of the at least one network attribute.

47. The computer-storage medium of claim 45, wherein:

acquiring at least one network attribute comprises acquiring a plurality of network attributes; and

the at least one derived network DNA component specification specifies a combination of the at least one network attribute and at least one other network attribute of the plurality of network attributes.

48. The computer-storage medium of claim 45, wherein:

the at least one derived network DNA component specification specifies a structured query language statement.

49. The computer-storage medium of claim 45, wherein:

the at least one derived network DNA component specification specifies an object-oriented language statement.

50. The computer-storage medium of claim 45, wherein:

the at least one derived network DNA component specification specifies a scripting language statement.

51. The computer-storage medium of claim 45, wherein acquiring at least one network attribute comprises acquiring a plurality of network attributes in an order specified by an acquisition priority list, wherein the plurality of network attributes comprise at least a subset of a domain name, one or more IP addresses, a verified presence of network infrastructure elements, parameters received from a network server, a communications media type, a service provider, a nominal available communications bandwidth, a measured available communications bandwidth, logical network location and physical network location.

52. The computer-storage medium of claim 45, wherein generating at least one derived network DNA component comprises generating each derived network DNA component referenced by a derived network DNA refresh list, the derived network DNA refresh list referencing at least one derived network DNA component dependent upon at least one acquired network attribute.

53. A method performed on a computer connected to a computer network, the method comprising:

acquiring at least one network attribute corresponding to an attribute of the computer network;

generating a value for at least one derived network characteristic using at least one derived network characteristic specification and the at least one network attribute;

determining a classification for the computer network, the classification classifying the computer network, and the classification comprising the at least one derived network characteristic;

selecting a classification policy action to execute based on the at least one derived network characteristic meeting at least one condition specified in a classification policy; and

executing, on the computer connected to the computer network, the classification policy action of the classification policy, wherein executing the classification policy action comprises configuring network security settings of the computer based on the classification.

54. The method of claim 53, wherein:

the at least one derived network characteristic indicates a type of network selected from among a plurality of network types.

55. The method of claim 54, wherein:

the plurality of network types comprise an enterprise network, a home network and a public place network.

56. The method of claim 53, wherein:

acquiring at least one network attribute comprises acquiring a plurality of network attributes; and

the at least one derived network characteristic specification specifies a combination of the at least one network attribute and at least one other network attribute of the plurality of network attributes.

57. The method of claim 53, wherein:

the at least one derived network characteristic specification specifies an object-oriented language statement.

58. The method of claim 53, wherein:

the at least one derived network characteristic specification specifies a scripting language statement.

59. The method of claim 53, wherein acquiring at least one network attribute comprises acquiring a plurality of network attributes in an order specified by an acquisition priority list, wherein the plurality of network attributes comprise at least a subset of a domain name, one or more IP addresses, a verified presence of network infrastructure elements, parameters received from a network server, a communications media type, a service provider, a nominal available communications bandwidth, a measured available communications bandwidth, logical network location and physical network location.

60. The method of claim 53, wherein generating at least one derived network characteristic comprises generating each derived network characteristic referenced by a derived network characteristic refresh list, the derived network characteristic refresh list referencing at least one derived network characteristic dependent upon at least one acquired network attribute.

61. A computerized system, comprising:

at least one computer connected to at least one computer network;

at least one classification store configured to store a classification for the at least one computer network, the classification classifying the at least one computer network, and the classification comprising at least one derived network characteristic;

at least one network classification policy store configured to store at least one network classification policy, the at least one network classification policy referencing the at least one derived network characteristic;

a network classification policy enforcer configured to;

select a network classification policy action to execute based on the at least one derived network characteristic meeting at least one condition specified in the at least one network classification policy; and

execute the network classification policy action of the network classification policy, wherein executing the network classification policy action comprises configuring network security settings of the computer based on the classification.

62. The computerized system of claim 61, further comprising:

a network characteristic generator configured to generate the at least one derived network characteristic according to at least one derived network characteristic specification, wherein the at least one derived network characteristic specification references at least one network attribute associated with the computer network.

63. The computerized system of claim 62, further comprising:

a network attribute acquirer configured to acquire a plurality of network attributes in an order specified by an acquisition priority list, wherein the plurality of network attributes comprise the at least one network attribute.

64. The computerized system of claim 62, wherein:

the at least one network attribute is selected from the group consisting of a domain name, one or more IP addresses, a verified presence of network infrastructure elements, parameters received from a network server, a communications media type, a service provider, a nominal available communications bandwidth, a measured available communications bandwidth, logical network location and physical network location.