System and method for dynamically identifying internal hosts in a heterogeneous computing environment with multiple subnetworks.
View Patent ↗A system and method for dynamically identifying internal hosts in a heterogeneous computing environment with multiple subnetworks is disclosed. A plurality of packets are analyzed. Each such packet includes a source address of an originating host and a destination address of a receiving host. An unknown originating host located at the source address of an outbound packet is classified as an inside host with high confidence. An unknown receiving host located at the destination address of an inbound packet is classified as an inside host. The unknown receiving host is reclassified as an inside host with high confidence upon receiving a further outbound packet having a source address corresponding to the address of the unknown receiving host.
1. A system for dynamically identifying internal hosts in a heterogeneous computing environment with multiple subnetworks, comprising:
computer-executable program code stored in a computer-readable storage medium and executable by a processor, the computer-executable program code comprising
a host classification module comprising computer-executable instructions operative, when executed, to cause the processor to
classify an unknown originating host located at the source address of an outbound packet as an inside host with high confidence,
classify an unknown receiving host located at the destination address of an inbound packet as an inside host, and
reclassify the inside host as an inside host with high confidence upon receiving a further outbound packet having a source address corresponding to the address of the inside host; and
an analysis module comprising computer-executable instructions operative, when executed, to cause the processor to
analyze a plurality of packets, each such packet comprising a source address of an originating host and a destination address of a receiving host;
determine whether the originating host or the receiving host in a packet has been definitively classified as inside host with high confidence; and
conditionally forward the packet to the host classification module if the originating or receiving host in the packet have not been definitively classified as an inside host with high confidence.
2. A system according to claim 1 , wherein
the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to classify an unknown originating host located at the source address of an inbound packet as an outside host.
3. A system according to claim 2 , wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to reclassify the unknown originating host as an inside host with high confidence upon receiving an outbound packet having a source address corresponding to the address of the unknown originating host.
4. A system according to claim 1 wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to classify an unknown receiving host located at the destination address of an outbound packet as an outside host.
5. A system according to claim 4 , wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to reclassify the unknown receiving host as an inside host with high confidence upon receiving an inbound packet having a destination address corresponding to the address of the unknown receiving host.
6. A system according to claim 1 , wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to maintain the inside host with high confidence classification of the unknown originating host upon receiving at least one of further inbound packets and further outbound packets.
7. A system according to claim 1 , wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to maintain the inside host with high confidence classification of the unknown receiving host upon receiving at least one of further inbound packets and further outbound packets.
8. A system according to claim 1 , wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to manage packet traffic flow by monitoring the packets and adjusting control flow thereof.
9. A system according to claim 8 , wherein the classification module further comprises computer-executable instructions operative, when executed, to cause the processor to ignore packet traffic flow for each packet with an originating host and a receiving host classified as an inside host with high confidence.
10. A system according to claim 1 , wherein the packets are communicated via a point-to-point protocol.
11. A system according to claim 1 , wherein the packets are communicated via an end-to-end protocol.
12. A system according to claim 1 , wherein the packets are communicated via the TCP/IP protocol and each source address and destination address is an internet protocol (IP) address.
13. A method for dynamically identifying internal hosts in a heterogeneous computing environment with multiple subnetworks, comprising:
storing a plurality of packets received at a network device in a queue structure;
analyzing the plurality of packets stored in the queue structure, each such packet comprising a source address of an originating host and a destination address of a receiving host;
determining whether the originating host or the receiving host in a packet has been definitively classified as inside host;
conditionally forwarding the packet for further classification processing, if the originating or receiving host in the packet have not been definitively classified as an inside host with high confidence; wherein the further classification processing comprises
classifying an unknown originating host located at the source address of an outbound packet as an inside host with high confidence; classifying an unknown receiving host located at the destination address of an inbound packet as an inside host;
and reclassifying the inside receiving host as an inside host with high confidence upon receiving a further outbound packet having a source address corresponding to the address of the inside receiving host.
14. A method according to claim 13 , wherein the further classification processing comprises classifying an unknown originating host located at the source address of an inbound packet as an outside host.
15. A method according to claim 14 , wherein the further classification processing comprises reclassifying the unknown originating host as an inside host with high confidence upon receiving an outbound packet having a source address corresponding to the address of the unknown originating host.
16. A method according to claim 13 , wherein the further classification processing comprises classifying an unknown receiving host located at the destination address of an outbound packet as an outside host.
17. A method according to claim 16 , wherein the further classification processing comprises reclassifying the unknown receiving host as an inside host with high confidence upon receiving an inbound packet having a destination address corresponding to the address of the unknown receiving host.
18. A method according to claim 13 , further comprising:
managing packet traffic flow by monitoring the packets and adjusting control flow thereof.
19. A method according to claim 18 , further comprising:
ignoring packet traffic flow for each packet with an originating host and a receiving host classified as an inside host with high confidence.
20. A method according to claim 13 , wherein the packets are communicated via the TCP/IP protocol and each source address and destination address is an internet protocol (IP) address.
21. A computer-readable storage medium comprising computer-readable instructions, which, when executed, are operative to cause a processor to perform the steps of:
analyzing a plurality of packets, each such packet comprising a source address of an originating host and a destination address of a receiving host;
determining whether the originating host or the receiving host in a packet has been definitively classified as inside host with high confidence;
conditionally forwarding the packet for further classification processing, if the originating or receiving host in the packet have not been definitively classified as an inside host with high confidence; wherein the further classification processing comprises
classifying an unknown originating host located at the source address of an outbound packet as an inside host with high confidence; classifying an unknown receiving host located at the destination address of an inbound packet as an inside host;
and reclassifying the inside receiving host as an inside host with high confidence upon receiving a further outbound packet having a source address corresponding to the address of the inside receiving host.
22. A system for classifying hosts in a heterogeneous computing environment, comprising:
a table storing records comprising a plurality of states which each specify a location of a host relative to a network domain boundary, the states comprising:
an Unknown state describing an undefined host;
an Outside state describing a host located outside the network domain boundary;
an Inside state describing a host provisionally located inside the network domain boundary; and
an Inside with High Confidence state describing a host located inside the network domain boundary; and
computer-executable program code stored in a computer-readable storage medium and executable by a processor, the computer-executable program code comprising
a classification module comprising computer-executable instructions operative, when executed, to cause the processor to: classify the hosts based on source address with each outbound packet originating from an Unknown state, Outside state or Inside state into an Inside with High Confidence state and classify the hosts based on destination address with each inbound packet originating from an Unknown state or Outside state into an Inside with High Confidence state; and
an analysis module comprising computer-executable instructions operative, when executed, to cause the processor to:
analyze a plurality of packets, each such packet comprising a source address of an originating host and a destination address of a receiving host;
determine whether the originating host or the receiving host in a packet has been definitively classified as Inside with High Confidence and
conditionally forward the packet to the host classification module if the originating or receiving host in the packet have not been definitively classified as an Inside with High Confidence state.