Fingerprint determination for network mapping
A system for determining fingerprints includes an interface to receive an indication to determine fingerprints using a set of client data, and a processor to determine a set of indicators based at least in part on the client data and for one or more indicators of the set of indicators, determine whether the indicator comprises a fingerprint based at least in part on a frequency analysis, and in the event it is determined that the indicator comprises a fingerprint, store the fingerprint in a fingerprint database associated with the client.
1. A system for determining a fingerprint associated with a client network, comprising:
an interface residing outside the client network and configured to communicate with the client network via Internet, the interface to:
receive an indication to determine the fingerprint using client data comprising a set of publicly available information associated with the client network; and
a processor circuit configured to:
determine a set of indicators based at least in part on the client data; and
for an indicator in the set of indicators determine whether the indicator comprises the fingerprint based at least in part on a frequency analysis, the frequency analysis including:
determining a first frequency indicating how frequently the indicator associated with a configuration of a network appears within the client network and a second frequency indicating how frequently the indicator appears within other networks that are different than the client network;
determining that the indicator comprises the fingerprint associated with the client network when all of the following conditions are satisfied:
the first frequency is greater than the second frequency,
the first frequency is above a first threshold, and
the second frequency is below a second threshold; and
in response to completing the frequency analysis to determine whether the indicator comprises the fingerprint, calculate a score associated with the indicator based on the first frequency and the second frequency;
rank the set of indicators based on the score;
create a fingerprint database based on the score by:
traversing the ranked set from a highest score to a lowest score;
adding the traversed indicator to the fingerprint database; and
terminating the traversal when a predetermined number of fingerprints is added to the fingerprint database.
2. The system of claim 1 , wherein the client data comprises a known client network.
3. The system of claim 1 , wherein the client data comprises client network configuration information.
4. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining a set of subsets of open ports indicated by the client data.
5. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining a set of subsets of services and associated ports indicated by the client data.
6. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining a set of webpage components indicated by the client data.
7. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining a web application and a set of web application components indicated by the client data.
8. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining one or more certificates indicated by the client data.
9. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining one or more public encryption keys indicated by the client data.
10. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining one or more text patterns indicated by the client data.
11. The system of claim 1 , wherein determining the set of indicators based at least in part on the client data comprises determining one or more combinations of indicators indicated by the client data.
12. The system of claim 1 , wherein determining whether the indicator comprises the fingerprint based at least in part on the frequency analysis comprises determining a frequency of occurrence of the fingerprint within the client network.
13. The system of claim 1 , wherein determining whether the indicator comprises the fingerprint based at least in part on the frequency analysis comprises determining a frequency of occurrence of the fingerprint on the Internet.
14. The system of claim 1 , wherein it is determined that the indicator comprises the fingerprint when a frequency of occurrence of the fingerprint within the client network is greater than a frequency of occurrence of the fingerprint on the Internet.
15. The system of claim 1 , wherein it is determined that the indicator comprises the fingerprint when a frequency of occurrence of the fingerprint within the client network is greater than a threshold.
16. The system of claim 1 , wherein it is determined that the indicator comprises the fingerprint when a frequency of occurrence of the indicator on the Internet is less than a threshold.
17. The system of claim 1 , wherein the fingerprint comprises one or more of the following: a set of open ports, a set of services and associated ports, a certificate, a public encryption key, a text pattern, a domain name, a host name, a combination of identifying elements.
18. The system of claim 1 , wherein determining whether the indicator comprises the fingerprint is based at least in part on the score used to rank the indicator.
19. The system of claim 16 , wherein the score related to the frequency is based at least in part on a percentile of a frequency of occurrence of the indicator within a known client network.
20. The system of claim 16 , wherein the score related to the frequency is based at least in part on a percentile of the frequency of occurrence of the indicator in the Internet.
21. A method for determining a fingerprint associated with a client network, comprising:
receiving, using a device residing outside the client network and configured to communicate with the client network via Internet, an indication to determine the fingerprint using client data comprising a set of publicly available information associated with the client network;
determining, using a processor, a set of indicators based at least in part on the client data;
for an indicator in the set of indicators determining whether the indicator comprises the fingerprint based at least in part on a frequency analysis, the frequency analysis including:
determining a first frequency indicating how frequently the indicator associated with a configuration of a network appears within the client network and a second frequency indicating how frequently the indicator appears within other networks that are different than the client network;
determining that the indicator comprises the fingerprint associated with the client network when all of the following conditions are satisfied:
the first frequency is greater than the second frequency,
the first frequency is above a first threshold, and
the second frequency is below a second threshold; and
in response to completing the frequency analysis to determine whether the indicator comprises the fingerprint, calculating a score associated with the indicator based on the first frequency and the second frequency;
ranking the set of indicators based on the score;
creating a fingerprint database based on the score by:
traversing the ranked set from a highest score to a lowest score;
adding the traversed indicator to the fingerprint database; and
terminating the traversal when a predetermined number of fingerprints is added to the fingerprint database.
22. A computer program product for determining a fingerprint associated with a client network, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, using a device residing outside the client network and configured to communicate with the client network via Internet, an indication to determine the fingerprint using client data comprising a set of publicly available information associated with the client network;
determining a set of indicators based at least in part on the client data;
for an indicator in the set of indicators determining whether the indicator comprises the fingerprint based at least in part on a frequency analysis, the frequency analysis including:
determining a first frequency indicating how frequently the indicator associated with a configuration of a network appears within the client network and a second frequency indicating how frequently the indicator appears within other networks that are different than the client network; determining that the indicator comprises the fingerprint associated with the client network when all of the following conditions are satisfied:
the first frequency is greater than the second frequency,
the first frequency is above a first threshold, and
the second frequency is below a second threshold; and
in response to completing the frequency analysis to determine whether the indicator comprises the fingerprint, calculating a score associated with the indicator based on the first frequency and the second frequency;
ranking the set of indicators based on the score;
creating a fingerprint database based on the score by:
traversing the ranked set from a highest score to a lowest score;
adding the traversed indicator to the fingerprint database; and
terminating the traversal when a predetermined number of fingerprints is added to the fingerprint database.