Real-time identification of an asset model and categorization of an asset to assist in computer network security
View Patent ↗A unique identifier is assigned to a network node and is used to obtain an “asset model” corresponding to the node and to determine whether the node is a member of a particular category. An asset model is a set of information about a node (e.g., the node's role within the enterprise, software installed on the node, and known vulnerabilities/weaknesses of the node). An identifier lookup module determines a node's identifier based on characteristics of the node (such as IP address, host name, network zone, and/or MAC address), which are used as keys into lookup data structures. A category lookup module determines whether a particular node is a member of (i.e., within) a particular category using a transitive closure to model the categories (properties) that can be attached to an asset model. A transitive closure for a particular asset category is stored as a bitmap, similar to bitmap indexing.
1. A computer-implemented method for determining a unique identifier associated with a network node, comprising:
using a processor to query an Internet Protocol (IP) address lookup data structure using an IP address associated with the network node, wherein the IP address lookup data structure comprises an array comprising one or more elements, an element stored at an index, the element comprising a unique identifier associated with a particular network node, the index being determined based on an IP address associated with the particular network node;
returning the unique identifier associated with the network node; and
performing one of:
using the returned unique identifier to obtain an asset model associated with the network node; and
using the returned unique identifier to determine whether the network node is a member of a category.
2. The computer-implemented method of claim 1 , wherein using the processor to query the IP address lookup data structure using the IP address associated with the network node comprises using a processor to determine an index based on the IP address associated with the network node.
3. The computer-implemented method of claim 1 , wherein the IP address lookup data structure is configured to automatically change from an array-based implementation to a table-based implementation.
4. A computer-implemented method for determining a unique identifier associated with a network node, comprising:
using a processor to query a first lookup table using a domain name associated with the network node, the first lookup table comprising one or more pairs, a pair comprising a domain name associated with a particular network node and a reference to one second lookup table of a set of multiple second lookup tables, each second lookup table comprising one or more pairs, a pair comprising a hostname associated with a particular network node and a unique identifier associated with the particular network node;
querying the referenced second lookup table using a hostname associated with the network node;
returning the unique identifier associated with the network node; and
performing one of:
using the returned unique identifier to obtain an asset model associated with the network node; and
using the returned unique identifier to determine whether the network node is a member of a category.
5. The computer-implemented method of claim 4 , wherein the unique identifier associated with the network node is a value of the primitive data type “int” (integer).
6. The computer-implemented method of claim 4 , wherein using the returned unique identifier to determine whether the network node is the member of the category comprises:
identifying a transitive closure, the transitive closure including one or more links between ancestor nodes and descendent nodes, an ancestor node representing a category, a descendent node representing a network node, a link indicating that a descendant node is a member of an ancestor node;
querying the transitive closure using the returned unique identifier and the category; and
returning a Boolean value that indicates whether the network node is the member of the category.
7. The computer-implemented method of claim 6 , wherein querying the transitive closure using the returned unique identifier and the category comprises determining whether a link exists between a descendant node associated with the returned unique identifier and an ancestor node associated with the category.
8. The computer-implemented method of claim 4 , wherein using the returned unique identifier to determine whether the network node is the member of the category comprises:
identifying a bitmap associated with the category, the bitmap comprising a plurality of bits, a bit value indicating whether a network node is a member of the category;
querying the bitmap using the returned unique identifier; and
returning a Boolean value that indicates whether the network node is the member of the category.
9. The computer-implemented method of claim 8 , wherein querying the bitmap using the returned unique identifier comprises:
identifying a bit within the bitmap by using the returned unique identifier as an index into the bitmap; and
returning the value of the identified bit.
10. A computer program product for determining a unique identifier associated with a network node, the computer program product comprising a computer-readable medium containing computer program code for performing a method, the method comprising:
querying an Internet Protocol (IP) address lookup table using an IP address associated with the network node, the IP address lookup table comprising one or more pairs, a pair comprising an IP address associated with a particular network node and a unique identifier associated with the particular network node;
returning the unique identifier associated with the network node; and
performing one of:
using the returned unique identifier to obtain an asset model associated with the network node; and
using the returned unique identifier to determine whether the network node is a member of a category;
wherein the IP address lookup table is automatically converted to an array comprising one or more elements, an element stored at an index, the element comprising a unique identifier associated with a particular network node, the index being determined based on an IP address associated with the particular network node.
11. The computer program product of claim 10 , wherein the IP address associated with the particular network node is a value of the primitive data type “int” (integer).
12. The computer program product of claim 10 , wherein querying the IP address lookup table using the IP address associated with the network node comprises determining a pair that comprises the IP address associated with the network node.
13. The computer program product of claim 10 , wherein the table is an open-addressing hash map.
14. The computer program product of claim 10 , wherein the table is an open-addressing hash map implemented using only one array.
15. A computer program product for determining a unique identifier associated with a network node, the computer program product comprising a computer-readable medium containing computer program code for performing a method, the method comprising:
querying a first lookup table using a domain name associated with the network node, the first lookup table comprising one or more pairs, a pair comprising a domain name associated with a particular network node and a reference to one second lookup table of a set of multiple second lookup tables, each second lookup table comprising one or more pairs, a pair comprising a hostname associated with a particular network node and a unique identifier associated with the particular network node;
querying the referenced second lookup table using a hostname associated with the network node;
returning the unique identifier associated with the network node; and
performing one of:
using the returned unique identifier to obtain an asset model associated with the network node; and
using the returned unique identifier to determine whether the network node is a member of a category.