Patent Document ID: 9838278
Application ID: 15054557
Patent Status: 1

Claim One:
1. A system for identifying unknown devices communicating over a computer network, the system comprising: a computer network comprising a plurality of intercommunicating forwarding devices for receiving packets from originating devices via one or more ingress ports and forwarding packets via one or more egress ports to destination devices; at least one listening node connected to the network and comprising: a) a network interface for receiving packet information from one or more of the forwarding devices; b) a first database mapping device identifiers to traffic-borne packet characteristics associated therewith; c) a second database mapping traffic-borne packet characteristics to a plurality of device classifications, each record of the second database specifying, for at least one traffic-borned packet characteristic, a population fraction of devices within the device classifications that exhibit the at least one traffic-borned packet characteristic; d) a feature-extraction module for extracting the traffic-borne packet characteristics from the received packet information; e) a classification module for identifying, from the first database, originating devices from the traffic-borne packet characteristics extracted by the feature-extraction module from packet flows associated with the originating devices, and further identifying unknown originating devices for which no identification can be made from entries in the first database; and f) an analysis module for classifying the unknown devices identified by the classification module to a user-supplied degree of accuracy within at least one selected device classification, the analysis module being configured to: i. identify, for the unknown devices, a plurality of traffic-borne packet characteristics each having an associated population fraction in the second database above a predictiveness threshold for the selected device classification; ii. identify a subset of the identified traffic-borne packet characteristics that produces a selected classification accuracy level; and iii. determine, based on the identified subset of traffic-borne packet characteristics, whether the unknown device is within at least one said selected device classification at the selected classification accuracy level, and, if so, classifying the device.