NETWORK DEVICE IDENTIFICATION

An apparatus in a computer network system extracts network traffic metadata related to a client computing device of a local network. The network traffic metadata is required by a device fingerprinting process. In response to detecting a multicast DNS (mDNS) packet query in the network traffic metadata, the apparatus collects an mDNS hostname related to the client computing device from the mDNS packet query. In response to determining, at a first point in time, that a dynamic host configuration protocol (DHCP) hostname related to the client computing device is unavailable in the network traffic metadata, the apparatus assigns the mDNS hostname to the client computing device.

FIELD

The present application relates generally to a network security, and specifically to identifying devices in a computer network.

BACKGROUND

It is vital to identify network devices in a computer network to enable, for example, controlling access to computer networks or services, applying required communication policies, and/or preventing and monitoring unauthorized access. Thus, it is desirable to provide automated techniques for identifying new devices in computer networks.

SUMMARY

DETAILED DESCRIPTION

The figures and the following description relate to the example embodiments by way of illustration only. Alternative embodiments of the structures and methods disclosed herein will be readily recognized as viable alternatives that may be employed without departing from the principles of what is claimed.

FIG.1illustrates schematically an example of a system environment for a network apparatus120. The system environment illustrated inFIG.1includes a computer network100, such as a local network, that may include one or more computer devices110, the network apparatus120, a local router/switch150, and an analysis engine and a database160. The computer devices110may also comprise any number of client applications180, however, this is not required. The example system also includes a service cloud130, such as a network operator's cloud and the internet140. The analysis engine/database160may reside in the computer network, in the service cloud130, or elsewhere in the network. There may also be more than one analysis engines160thus enabling at least part of the analysis being processed in more than one analysis engines. Alternative embodiments may include more, fewer, or different components from those illustrated inFIG.1, and the functionality of each component may be divided between the components differently from the description below. Additionally, each component may perform their respective functionalities in response to a request from a human, or automatically without human intervention.

In an embodiment, the device110may communicate (A) via the network apparatus120residing in the computer network100. In another embodiment, the device110may communicate (B) directly via a network gateway or a modem150, for example when the device is not in the computer network100.

In an embodiment, the network operators may deploy a service platform on their broadband gateways150provided to customers and in their own cloud environments130. The user device(s)110may also be configured to use the services provided by the service cloud130by one or more applications/operating systems180installed on the device(s)110.

The device110may be any computer device, such a smart device, a smart appliance, a smartphone, a laptop, or a tablet having a network interface and an ability to connect to the network apparatus120and/or the local network router150with it. The network apparatus120collects information about the computer network100, for example, including data about the network traffic through the computer network100and data identifying devices in the computer network100, such as any smart appliances and user devices110. The network apparatus120is configured to receive traffic control instructions from the analysis engine160and to process network traffic based on the traffic control instructions. Processing the network traffic through the computer network100, for example, can include enforcing network or communication policies on devices, restricting where network traffic can travel, blocking network traffic from entering the computer network100, redirecting a copy of network traffic packet or features of those packets to the analysis engine160for analysis (e.g., for a malicious behavior), or quarantining the network traffic to be reviewed by a user (e.g., via the user device110) or a network administrator. In some embodiments, the functionality of the network apparatus120is performed by a device that is a part of the computer network100, while in other embodiments, the functionality of the network apparatus120is performed by a device outside of the computer network100.

The network apparatus120may be configured to monitor traffic that travels through the computer network100. In some embodiments, the network apparatus120can be a device that is a part of the computer network100. The network apparatus120can be connected to the computer network100using a wired connection (e.g., via an Ethernet cable connected to a router) or using a wireless connection (e.g., via a Wi-Fi connection). In some embodiments, the network apparatus120can comprise multiple devices. In some embodiments, the network apparatus120can also perform the functions of the local network router150for the computer network100.

In some embodiments, the network apparatus120may intercept traffic in the computer network100by signaling to the user device110that the network apparatus120is a router150. In some embodiments, the network apparatus120replaces the default gateway or gateway address of the computer network100with its own internet protocol address. In some embodiments, the computer network100can be structured such that all network traffic passes through the network apparatus120, allowing the network apparatus120to physically intercept the network traffic. For example, the network apparatus120can serve as a bridge through which ail network traffic must travel to reach the router150of the computer network100.

The analysis engine160may receive and analyze network traffic data (e.g., forwarded by the network apparatus120) associated with devices on the computer network. The analysis engine160may be implemented within a remote system (e.g., a cloud server) or within the computer network100. The analysis engine160may perform operations that are computationally expensive for the network apparatus120to perform. In some embodiments, the analysis engine160replaces the network apparatus120by performing the functionalities of the network apparatus120. In these embodiments, the computer network router150may be configured to forward network traffic to the analysis engine160. In some embodiments, the analysis engine160communicates with other devices on the computer network. In some embodiments, the analysis engine160is integrated into the network apparatus120.

The computer network100may be a local area network (LAN) that comprises the one or more devices110, the network apparatus120, and the local network router150. The computer network100may be used for a number of purposes, including a home network or a network used by a business. The computer network100is connected to the internet or other Inter-autonomous network infrastructure140, allowing devices within the computer network100, including the user device110, to communicate with devices outside of the computer network100. The computer network100may be a private network that may require devices to present credentials to join the network, or it may be a public network allowing any device to join. In some embodiments, other devices, like personal computers, smartphones, or tablets, may join computer network100.

The internet140and the computer network100may comprise any combination of LANs and wide area networks (WANs), using both wired and wireless communication systems. In some embodiments, the internet140and the computer network100use standard communications technologies and protocols. Data exchanged over the internet140and the computer network100may be represented using any suitable format, such as hypertext markup language (HTML) or extensible markup language (XML) or any other presentation or application layer format suitable for transporting data over a network. In some embodiments, all or some of the communication links of the internet140and the computer network100may be encrypted using any suitable technique or techniques.

The computer device110may be a computing device capable of receiving user input as well as transmitting and/or receiving data via the internet140or the computer network100. In some embodiments, the device110is a conventional computer system, such as a desktop or a laptop computer. Alternatively, the device110may be a device having computer functionality, such as a personal digital assistant (PDA), a mobile telephone, a smartphone, or another suitable device. The device110is a network device configured to communicate with the internet140or computer network100. In some embodiments, the device110executes an application (e.g., the application180) allowing a user of the user device110to interact with other network devices, such as the smart appliances, the network apparatus120, the router150, or the analysis engine160. For example, the device110executes a browser application to enable interaction between the device110and the network apparatus120via the computer network100.

The client application180is a computer program or software application configured to run on the user device110. For example, the application180is a web browser, a mobile game, an email client, or a mapping program. The device110can have any number of applications180installed. The application180may communicate, via the user device110, with devices inside and outside of the computer network100.

The computer network100can also be a small office and/or a domestic network that comprises several Internet of Things (IoT) and smart devices as well as portable computers and tablet computers, for example. At least part of these devices are connected to the internet140, for example, via one or more Wi-Fi (based on IEEE 802.11 standards) access points.

Device identification enriches end-user experience by using hostnames. In computer networking, a hostname is a label assigned to a device connected to a computer network and used to identify the device in various forms of electronic communication. Hostnames may be derived from DHCP (Dynamic Host Configuration Protocol) packets received upon connection. However, hostname does not always have a value in the DHCP packet. Also, according to recent changes in some mobile operating systems, the hostname is not received. For end-users, seeing the hostname gives more personality and diversification since a household can have several same device models which may make identifying devices belonging to different persons more difficult based on just seeing the device model information. With the internet privacy issues getting more and more aggressive worldwide (thereby masking more data), it is important not to lose the end-user experience. Thus, getting data related to the device identification is crucial.

The described embodiments overcome the drawbacks of the previous solutions by applying new capabilities and methods targeted to enable identification of devices based on the network traffic data and also enable an exact device hostname identification. Further, the embodiments not only identify the device hostname but can also identify which hostname should be set for each device. The embodiments propose an automated way to configure hostnames for devices in a computer network. The embodiments enable using multiple protocols to assign a hostname for a device.

The identification of the devices is improved, and, at the same time, user-friendly names are assigned for the end-users to see. For example: specific devices with newest operating system versions do not send DHCP hostnames and thus extracting the hostname from the mDNS (Multicast Domain Name System) protocol can be used.

FIG.2is a flow diagram illustrating an embodiment of a method.

In an embodiment, one or more data fragments relating to a device fingerprinting process of each user device are extracted from network traffic data of a plurality of user devices in a computer network.

In200, network traffic metadata related to a client computing device of a local network is extracted. The network traffic metadata is required by a device fingerprinting process. The network traffic metadata is data that provides information about the network traffic, but not the actual content of the network traffic (in other words, the metadata may be predetermined data fields that identify certain types of network traffic used in the device fingerprinting process). In general, the device fingerprinting process collects information regarding software and hardware of the client computing device so that the client computing device may be identified. Protocols used to transmit data to and from the client computing device may be leveraged to extract stable data, including the hostname. Captured network traffic may be analyzed in the device fingerprinting process to map various captured protocol packets to a single client computing device. For example, the captured mDNS traffic and the captured DHCP traffic may be mapped to a specific client computing device.

In201, in response to detecting a multicast DNS (mDNS) packet query in the network traffic metadata, an mDNS hostname related to the client computing device is collected from the mDNS packet query.

In202, in response to determining, at a first point in time, that a dynamic host configuration protocol (DHCP) hostname related to the client computing device is unavailable in the network traffic metadata, the mDNS hostname is assigned to the client computing device.

Note that in some embodiments the underlying hostname may be the same, i.e., even if the hostname is transmitted in the mDNS traffic and later in the DHCP traffic, the hostname is both is the same. In this way, even if the hostname is not transmitted over the DHCP protocol, the hostname is still available from the mDNS protocol.

In an embodiment, the method further comprises: in response to collecting203, at a second point in time that is after the first point in time, the DHCP hostname related to the client computing device, overwriting the mDNS hostname by assigning the DHCP hostname to the client computing device.

In an embodiment, the method further comprises generating one or more predetermined device identification rules for determining which hostname between the mDNS hostname and the DHCP hostname is selected to be assigned to the client computing device.

In an embodiment, during the device fingerprinting process, the hostname extracted from mDNS packet is collected as a new fingerprint.

In an embodiment, hostnames residing in the mDNS packet queries ending with “local” (i.e., having “local” as the top-level domain (TLD)) are extracted as correct hostnames of the devices. In this way, the correct hostname may be extracted, even if the client computing device transmits more than one different hostname in the mDNS protocol. An example mDNS packet detail is visualized inFIG.4: “Multicast Domain Name System (query) includes “Name: Osvald-iPadlocal”.

In an embodiment, the device identification is enriched by using multiple protocols to assign a user-friendly name for a device.

In an embodiment, if the DHCP hostname is not available, the mDNS hostname is used.

In an embodiment, if both the DHCP hostname and the mDNS hostname are available, the DHCP hostname is selected. In another embodiment, the mDNS hostname is kept even though the DHCP hostname becomes available.

In an embodiment, the selection of the hostname from among multiple available hostnames depends on the logic implemented on the extraction of the mDNS hostname. In an embodiment, depending on the logic and results, the hostname that comes first is selected for setting the device hostname.

In an embodiment, the device identification may further comprise an analysis of historical device model data and an application of one or more of the following: a statistical analysis, encoded decision rules, or one or more artificial intelligence techniques.

In an embodiment, for generating the one or more predetermined device identification rules, one or more of the following are analyzed: a brand of the user device, a type of the user device, a name of the user device, an operating system of the user device, and other extracted data fragments.

Turning now toFIG.3that is showing an example of a network apparatus such as a router, a switch, a 5G modem, or another network level apparatus.

A processor device304is provided that is configured to identify devices in the monitored computer network. The processor device304is configured to extract network traffic metadata related to a client computing device of a local network, wherein the network traffic metadata is required by a device fingerprinting process. The processor device304is further configured to collect the mDNS hostname related to the client computing device from the mDNS packet query in response to detecting the multicast DNS (mDNS) packet query in the network traffic metadata. The processor device304is further configured to assign the mDNS hostname to the client computing device in response to determining, at a first point in time, that the dynamic host configuration protocol (DHCP) hostname related to the client computing device is unavailable.

In an embodiment, the processor304is configured to store data such as any network-based identification data, metadata, attributes, values, MAC addresses, hostnames as well as other data related to connection requests, state information and/or domain data to the database306. The database306is shown in this example as being located at the apparatus300, but it will be appreciated that the apparatus300may alternatively access a remote database. The database306may comprise necessary data collected from user devices.

The apparatus300is provided with a receiver301that receives the connection requests and responses. A transmitter302is also provided for communication with the computer device and/or the outside server.

In the above description, the apparatus300is described as having a different transmitter and a different receiver. It will be appreciated that these may be disposed in any suitable manner, for example as a separate transmitter and a separated receiver, or as a transceiver (i.e., an integrated single apparatus housing both the transmitter and the receiver). Similarly, a single processor304is described but the function of the processor may be performed by a single physical processor or by more than one processor.

The apparatus300is also provided with a non-transitory computer readable medium in the form of a memory305. The memory may be used to store a computer program307which, when executed by the processor300, causes the processor304to perform the functions described above. The computer program307may be provided from an external source. In an embodiment, at least some or even all the functions of the method can be implemented in any apparatus, for example any user device or a server.

FIG.5illustrates an example process flow according to an embodiment. In500, the device fingerprinting related data collection is started. In501, an mDNS hostname is collected. Next, in502, it is determined whether a DHCP hostname has been collected. If yes, and the DHCP hostname has already been assigned, the method ends in505. If the DHCP hostname has not been collected, then the mDNS hostname is assigned to the device in503. If the DHCP hostname is collected afterwards, then mDNS hostname may be overwritten by using the DHCP hostname in504.

It will be appreciated that various modifications may be made to the above-described embodiments without departing from the scope of the present invention. For example, the database or analysis engine may be in separate entities to the apparatus, in which case the apparatus will send queries remotely to the analysis engine.

The steps, signaling messages and related functions described above in relation to the figures are in no absolute chronological order, and sonic of the steps may be performed simultaneously or in a different order. Other functions may also be executed between the steps and other signaling may be sent between the illustrated ones. Some of the steps can also be left out or replaced by a corresponding step. The system functions illustrate a procedure that may be implemented in one or more physical or logical entities.

The techniques described herein can be implemented by various means. An apparatus or system that implements one or more of the described functions may comprise not only existing means but also means for implementing one or more functions of a corresponding apparatus that is described with an embodiment. An apparatus or a system may also comprise separate means for each separate function. For example, the embodiments may be implemented in one or more modules of hardware or combinations thereof. For software, implementation can be through modules, for example such procedures and functions that perform the functions described. The software code may be stored in any suitable data storage medium that is readable by processors, computers, memory units or articles of manufacture, and may be executed by one or more processors or computers. The data storage medium or memory unit or database may be implemented within the processor or computer apparatus, or as an external part of the processor or computer apparatus.

The programming, such as executable code or instructions, electronic data, databases or other digital information may be stored into memories and can include a processor-usable medium embodied in any computer program product which can contain, store, or maintain programming, data or digital information for use by or in connection with an instruction execution system, such as the processor.

An embodiment provides a non-transitory computer-readable medium comprising stored program code comprised of computer-executable instructions.