Systems and Methods for Automatic Device Detection

• US 20170288965A1
• Filed: 03/29/2017
• Published: 10/05/2017
• Est. Priority Date: 03/31/2016
• Status: Active Grant

• Current Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Original Assignee: Bitdefender IPR Management Limited (Bitdefender LLC)
• Inventors: CEBERE, Bogdan C.
• Granted Patent: US 10,644,949 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 12/2807 Exchanging configuration information on appliance services in a home automation network arrangements for maintenance or administration involving network analysis for automatically determining the actual topology of a network H04L41/12; hardware or software tools for network management using graphical user interfaces H04L41/22; address allocation H04L61/50
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]

Abstract

Described systems and methods enable an automatic device detection/discovery, particularly of ‘Internet of Things’ client devices such as wearables, mobile communication devices, and smart home appliances, among others. Device detection comprises assigning a target device to a device category, such as “tablet computer from an unknown manufacturer, running Android®”. Some embodiments determine multiple preliminary category assignments according to distinct inputs such as HTTP user agent data, DHCP data, mDNS data, and MAC data. Each preliminary category assignment may come with an associated score. A definitive category assignment may be made according to an aggregate score. Applications include computer security, software provisioning, and remote device management, among others.

Claims

1. A device detection appliance comprising a hardware processor and a memory, the hardware processor configured to:

analyze data received from a client device connected to the device detection appliance by a local network, to determine a set of features of the client device;

in response, select a category of devices according to the set of features;

determine a first score according to a first subset of the set of features, the first score indicative of a first degree to which the client device is representative of the category of devices;

determine a second score according to a second subset of the set of features, the second score indicative of a second degree to which the client device is representative of the category of devices;

combine the first and second scores to produce an aggregate score; and

in response to producing the aggregate score, determine whether to assign the client device to the category of devices according to the aggregate score.

2. The client system of claim 1, wherein determining whether to assign the client device to the category of devices comprises:

comparing the aggregate score to a third score indicative of a third degree to which the client device is representative of another category of devices, and

in response, determine whether to assign the client device to the category of devices according to a result of the comparison.

3. The client system of claim 1, wherein the aggregate score is determined according to:

σ

·

w,

wherein σ

denotes the first score and w denotes a numerical weight determined according to the first set of features.

4. The client system of claim 3, wherein weight w is determined further according to the device category.

5. The client system of claim 3, wherein weight w is determined further according to the first score.

6. The client system of claim 1, wherein the aggregate score is determined according to:

w·

f(σ

),

wherein σ

denotes the first score, w denotes a numerical weight determined according to the first set of features, and wherein f denotes an injective function.

7. The client system of claim 1, wherein the hardware processor is further configured to:

in response to determining whether to assign the client device to the category of devices, determine a third score according to a third subset of the set of features, the third score indicative of a third degree to which the client device is representative of the category of devices;

in response, combine the aggregate score and the third score to produce an adjusted aggregate score; and

in response to producing the adjusted aggregate score, determine whether to assign the client device to the category of devices according to the adjusted aggregate score.

8. The client system of claim 1, wherein assigning the client device to the device category comprises indicating a product category of the client device and an operating system of the client device.

9. The client system of claim 1, wherein the hardware processor is further configured to:

assign the client device to the category of devices; and

in response, transmit an indicator of a location of an agent installer to the client device, the agent installer selected from a plurality of agent installers according to the category of devices, wherein the agent installer is configured to install a software agent on the client device.

10. The client system of claim 1, wherein the hardware processor is further configured to:

assign the client device to the category of devices; and

in response, identify a computer security vulnerability of the client device according to the category of devices.

11. The client system of claim 1, wherein the hardware processor is further configured to:

assign the client device to the category of devices;

formulate a set of instructions according to the category of devices, wherein executing the instructions causes a disruption of a Dynamic Host Configuration Protocol (DHCP) server executing on the client device; and

in response to formulating the set of instructions, transmit the set of instructions to the client device.

12. A method comprising employing at least one hardware processor of a device detection appliance to:

analyze data received from a client device connected to the device detection appliance by a local network, to determine a set of features of the client device;

in response, employing the at least one hardware processor to select a category of devices according to the set of features;

employing the at least one hardware processor to determine a first score according to a first subset of the set of features, the first score indicative of a first degree to which the client device is representative of the category of devices;

employing the at least one hardware processor to determine a second score according to a second subset of the set of features, the second score indicative of a second degree to which the client device is representative of the category of devices;

employing the at least one hardware processor to combine the first and second scores to produce an aggregate score; and

in response to producing the aggregate score, employing the at least one hardware processor to determine whether to assign the client device to the category of devices according to the aggregate score.

13. The method of claim 12, wherein determining whether to assign the client device to the category of devices comprises:

employing the at least one hardware processor to compare the aggregate score to a third score indicative of a third degree to which the client device is representative of another category of devices, and

in response, employing the at least one hardware processor to determine whether to assign the client device to the category of devices according to a result of the comparison.

14. The method of claim 12, wherein the aggregate score is determined according to:

σ

·

w,

wherein σ

denotes the first score and w denotes a numerical weight determined according to the first set of features.

15. The method of claim 14, wherein weight w is determined further according to the device category.

16. The method of claim 14, wherein weight w is determined further according to the first score.

17. The method of claim 12, wherein the aggregate score is determined according to:

w·

f (σ

),

wherein σ

denotes the first score, w denotes a numerical weight determined according to the first set of features, and wherein f denotes an injective function.

18. The method of claim 12, further comprising:

in response to determining whether to assign the client device to the category of devices, employing the at least one hardware processor to determine a third score according to a third subset of the set of features, the third score indicative of a third degree to which the client device is representative of the category of devices;

in response, employing the at least one hardware processor to combine the aggregate score and the third score to produce an adjusted aggregate score; and

in response to producing the adjusted aggregate score, employing the at least one hardware processor to determine whether to assign the client device to the category of devices according to the adjusted aggregate score.

19. The method of claim 12, wherein assigning the client device to the device category comprises indicating a product category of the client device and an operating system of the client device.

20. The method of claim 12, further comprising:

employing the at least one hardware processor to assign the client device to the category of devices; and

in response, employing the at least one hardware processor to transmit an indicator of a location of an agent installer to the client device, the agent installer selected from a plurality of agent installers according to the category of devices, wherein the agent installer is configured to install a software agent on the client device.

21. The method of claim 12 further comprising:

employing the at least one hardware processor to assign the client device to the category of devices; and

in response, employing the at least one hardware processor to identify a computer security vulnerability of the client device according to the category of devices.

22. The method of claim 12, further comprising:

employing the at least one hardware processor to assign the client device to the category of devices;

employing the at least one hardware processor to formulate a set of instructions according to the category of devices, wherein executing the instructions causes a disruption of a Dynamic Host Configuration Protocol (DHCP) server of the client device; and

in response to formulating the set of instructions, employing the at least one hardware processor to transmit the set of instructions to the client device.

23. A non-transitory computer-readable medium storing instructions which, when executed by at least a hardware processor of a device detection appliance, cause the device detection appliance to:

analyze data received from a client device connected to the device detection appliance by a local network, to determine a set of features of the client device;

in response, select a category of devices according to the set of features;

determine a first score according to a first subset of the set of features, the first score indicative of a first degree to which the client device is representative of the category of devices;

determine a second score according to a second subset of the set of features, the second score indicative of a second degree to which the client device is representative of the category of devices;

combine the first and second scores to produce an aggregate score; and

in response to producing the aggregate score, determine whether to assign the client device to the category of devices according to the aggregate score.