Systems and methods for estimating ages of network devices

• US 9,571,372 B1
• Filed: 01/24/2013
• Issued: 02/14/2017
• Est. Priority Date: 01/24/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kienzle, Darrell, Evans, Nathan, Elder, Matthew
• Primary Examiner(s): Bates, Kevin
• Assistant Examiner(s): Siddiqi, Emad
• Application Number:
  US13/749,667
• Time in Patent Office: 1,482 Days
• Field of Search: 709/224, 709/223, 726/13
• US Class Current: 1/1
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

A computer-implemented method for estimating ages of network devices may include (1) identifying at least one networked device that may be attached to a network, (2) identifying a media access control address of the networked device, the media access control address comprising an organizational unique identifier, (3) querying an organizational-unique-identifier database with the organizational unique identifier and receiving, in response, device-age information relating to an estimated age of the networked device and (4) determining the estimated age of the networked device based at least in part on the device-age information. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for estimating ages of network devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying at least one networked device that is attached to a network;

identifying a media access control address of the networked device, the media access control address comprising an organizational unique identifier;

querying an organizational-unique-identifier database with the organizational unique identifier and receiving, in response, device-age information relating to an estimated age of the networked device, wherein the device-age information is derived from an assignment date of the organizational unique identifier to an organization;

determining the estimated age of the networked device by using the device-age information by positing that a creation of the networked device by the organization does not precede the assignment date of the organizational unique identifier to the organization and therefore limiting the estimated age of the networked device by the assignment date of the organizational unique identifier; and

performing at least one of a security scan of the networked device and a compliance analysis of the networked device based at least in part on the estimated age of the networked device.

2. The computer-implemented method of claim 1, further comprising performing a security scan on the networked device based at least in part on the estimated age of the networked device.

3. The computer-implemented method of claim 1, further comprising:

configuring a security scan of the networked device with an old-device rule based at least in part on the estimated age of the networked device;

performing the security scan on the networked device.

4. The computer-implemented method of claim 1, further comprising:

identifying a compliance policy to which the networked device is subject;

determining that the networked device is not compliant with the compliance policy based at least in part on the estimated age of the networked device.

5. The computer-implemented method of claim 1, further comprising:

determining, based on the estimated age of the networked device, that the networked device is due for replacement;

alerting an administrator of the network that the networked device is due for replacement.

6. The computer-implemented method of claim 1, further comprising enhancing a network topology report of the network with the estimated age of the networked device.

7. The computer-implemented method of claim 1, wherein positing that the creation of the networked device does not precede the assignment date of the organizational unique identifier to the organization is based at least in part on an inference that the networked device did not exist earlier than the assignment date of the organizational unique identifier to the organization.

8. The computer-implemented method of claim 1, wherein limiting the estimated age of the networked device by the assignment date of the organizational unique identifier comprises estimating that the networked device was created a predefined period of time after the assignment date based on an estimated turnaround time between the organizational unique identifier being assigned to the organization and the organization making use of the organizational unique identifier for new devices.

9. A system for estimating ages of network devices, the system comprising:

an identification module programmed to;

identify at least one networked device that is attached to a network; and

identify a media access control address of the networked device, the media access control address comprising an organizational unique identifier;

a querying module programmed to query an organizational-unique-identifier database with the organizational unique identifier and receive, in response, device-age information relating to an estimated age of the networked device, wherein the device-age information is derived from an assignment date of the organizational unique identifier to an organization;

a determination module programmed to determine the estimated age of the networked device by using the device-age information by positing that a creation of the networked device by the organization does not precede the assignment date of the organizational unique identifier to the organization and therefore limiting the estimated age of the networked device by the assignment date of the organizational unique identifier;

an analysis module programmed to perform at least one of a security scan of the networked device and a compliance analysis of the networked device based at least in part on the estimated age of the networked device; and

at least one hardware processor configured to execute the identification module, the querying module, the determination module, and the analysis module.

10. The system of claim 9, wherein the analysis module is programmed to perform a security scan on the networked device based at least in part on the estimated age of the networked device.

11. The system of claim 9, wherein the analysis module is programmed to:

configure a security scan of the networked device with an old-device rule based at least in part on the estimated age of the networked device;

perform the security scan on the networked device.

12. The system of claim 9, wherein the analysis module is programmed to:

identify a compliance policy to which the networked device is subject;

determine that the networked device is not compliant with the compliance policy based at least in part on the estimated age of the networked device.

13. The system of claim 9, wherein the analysis module is programmed to:

determine, based on the estimated age of the networked device, that the networked device is due for replacement;

alert an administrator of the network that the networked device is due for replacement.

14. The system of claim 9, wherein the analysis module is programmed to enhance a network topology report of the network with the estimated age of the networked device.

15. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify at least one networked device that is attached to a network;

identify a media access control address of the networked device, the media access control address comprising an organizational unique identifier;

query an organizational-unique-identifier database with the organizational unique identifier and receiving, in response, device-age information relating to an estimated age of the networked device, wherein the device-age information is derived from an assignment date of the organizational unique identifier to an organization;

determine the estimated age of the networked device by using the device-age information by positing that a creation of the networked device by the organization does not precede the assignment date of the organizational unique identifier to the organization and therefore limiting the estimated age of the networked device by the assignment date of the organizational unique identifier; and

perform at least one of a security scan of the networked device and a compliance analysis of the networked device based at least in part on the estimated age of the networked device.

16. The non-transitory computer-readable-storage medium of claim 15, wherein the one or more computer-readable instructions further cause the computing device to perform a security scan on the networked device based at least in part on the estimated age of the networked device.

17. The non-transitory computer-readable-storage medium of claim 15, wherein the one or more computer-readable instructions further cause the computing device to:

configure a security scan of the networked device with an old-device rule based at least in part on the estimated age of the networked device;

perform the security scan on the networked device.

18. The non-transitory computer-readable-storage medium of claim 15, wherein the one or more computer-readable instructions further cause the computing device to:

identify a compliance policy to which the networked device is subject;

determine that the networked device is not compliant with the compliance policy based at least in part on the estimated age of the networked device.