Network device spoofing detection for information security

1. A system comprising:

a threat management server in a network, comprising:

a memory configured to store:

a device log file identifying location information for endpoint devices that have passed authentication;

a threat management engine implemented by a processor configured to:

identify a first instance of an endpoint device in the device log file;

identify a second instance of the endpoint device in the device log file;

determine a device identifier for the endpoint device based on the device log file;

identify a first switch connected the first instance of the endpoint device based on the device log file;

send a first location information request comprising the device identifier to the first switch, wherein the first location information request requests location information for the first instance of the endpoint device;

receive location information for the first instance of the endpoint device in response to sending the first location information request;

identify a second switch connected to the second instance of the endpoint device based on the device log file;

send a second location information request comprising the device identifier to the second switch, wherein the second location information request requests location information for the second instance of the endpoint device;

receive location information for the second instance of the endpoint device in response to sending the second location information request;

compare the location information for the first instance of the endpoint device and the location information for the second instance of the endpoint device to the location information for the endpoint device in the device log file;

identify a spoofed instance of the endpoint device based on the comparison, wherein:

the spoofed instance of the endpoint device is one of the first instance of the endpoint device and the second instance of the endpoint device; and

identifying the spoofed instance of the endpoint device is based on a location mismatch between received location information and the location information for the endpoint device in the device log file; and

block the spoofed instance of the endpoint device from accessing the network in response to identifying the spoofed instance of the endpoint device;

the first switch operably coupled to the threat management server, configured to:

receive the first location information request for the first instance of the endpoint device;

identify the first instance of the endpoint device connected to the first switch; and

send location information for the first instance of the endpoint device to the threat management server; and

the second switch operably coupled to the threat management server, configured to:

receive the second location information request for the second instance of the endpoint device;

identify the second instance of the endpoint device connected to the first switch; and

send location information for the second instance of the endpoint device to the threat management server.

2. The system of claim 1 , wherein the threat management engine is configured to remove the spoofed instance of the endpoint device from a white list in response to blocking the spoofed instance of the endpoint device from accessing the network.

3. The system of claim 1 , wherein the location mismatch is a geographic region mismatch for the endpoint device.

4. The system of claim 1 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and

the blackhole command triggers a transformation of the destination of traffic associated with the spoofed instance of the endpoint device to a null destination.

5. The system of claim 1 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and

the blackhole command triggers traffic associated with the spoofed instance of the endpoint device to be discarded.

6. The system of claim 1 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and

the disable command disables a port the spoofed instance of the endpoint device is connected to.

7. The system of claim 1 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and

the disable command triggers disconnecting electrical power to a port the spoofed instance of the endpoint device is connected to.

8. A threat management server in a network, comprising:

a memory configured to store:

a device log file identifying location information for endpoint devices that have passed authentication;

a threat management engine implemented by a processor configured to:

identify a first instance of an endpoint device in the device log file;

identify a second instance of the endpoint device in the device log file;

determine a device identifier for the endpoint device based on the device log file;

identify a first switch connected the first instance of the endpoint device based on the device log file;

send a first location information request comprising the device identifier to the first switch, wherein the first location information request requests location information for the first instance of the endpoint device;

receive location information for the first instance of the endpoint device in response to sending the first location information request;

identify a second switch connected to the second instance of the endpoint device based on the device log file;

send a second location information request comprising the device identifier to the second switch, wherein the second location information request requests location information for the second instance of the endpoint device;

receive location information for the second instance of the endpoint device in response to sending the second location information request;

compare the location information for the first instance of the endpoint device and the location information for the second instance of the endpoint device to the location information for the endpoint device in the device log file;

identify a spoofed instance of the endpoint device based on the comparison, wherein:

the spoofed instance of the endpoint device is one of the first instance of the endpoint device and the second instance of the endpoint device; and

identifying the spoofed instance of the endpoint device is based on a location mismatch between received location information and the location information for the endpoint device in the device log file; and

block the spoofed instance of the endpoint device from accessing the network in response to identifying the spoofed instance of the endpoint device.

9. The device of claim 8 , wherein the threat management engine is configured to remove the spoofed instance of the endpoint device from a white list in response to blocking the spoofed instance of the endpoint device from accessing the network.

10. The device of claim 8 , wherein the location mismatch is a geographic region mismatch for the endpoint device.

11. The device of claim 8 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and

the blackhole command triggers a transformation of the destination of traffic associated with the spoofed instance of the endpoint device to a null destination.

12. The device of claim 8 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and

the blackhole command triggers traffic associated with the spoofed instance of the endpoint device to be discarded.

13. The device of claim 8 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and

the disable command disables a port the spoofed instance of the endpoint device is connected to.

14. The device of claim 8 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and

the disable command triggers disconnecting electrical power to a port the spoofed instance of the endpoint device is connected to.

15. A method comprising:

identifying, by a threat management server, a first instance of an endpoint device in a device log file identifying location information for endpoint devices that have passed authentication;

identifying, by the threat management server, a second instance of the endpoint device in the device log file;

determining, by the threat management server, a device identifier for the endpoint device based on the device log file;

identifying, by the threat management server, a first switch connected the first instance of the endpoint device based on the device log file;

sending, by the threat management server, a first location information request comprising the device identifier to the first switch, wherein the first location information request requests location information for the first instance of the endpoint device;

identifying, by the first switch, the first instance of the endpoint device connected to the first switch in response to receiving the first location information request;

sending, by the first switch, location information for the first instance of the endpoint device to the threat management server;

identifying, by the threat management server, a second switch connected to the second instance of the endpoint device based on the device log file;

sending, by the threat management server, a second location information request comprising the device identifier to the second switch, wherein the second location information request requests location information for the second instance of the endpoint device;

identifying, by the first switch, the second instance of the endpoint device connected to the first switch in response to receiving the second location information request;

sending, by the first switch, location information for the second instance of the endpoint device to the threat management server;

comparing, by the threat management server, the location information for the first instance of the endpoint device and the location information for the second instance of the endpoint device to the location information for the endpoint device in the device log file;

identifying, by the threat management server, a spoofed instance of the endpoint device based on the comparison, wherein:

the spoofed instance of the endpoint device is one of the first instance of the endpoint device and the second instance of the endpoint device; and

identifying the spoofed instance of the endpoint device is based on a location mismatch between received location information and the location information for the endpoint device in the device log file; and

blocking, by the threat management server, the spoofed instance of the endpoint device from accessing the network in response to identifying the spoofed instance of the endpoint device.

16. The method of claim 15 , further comprising removing, by the threat management server, the spoofed instance of the endpoint device from a white list in response to blocking the spoofed instance of the endpoint device from accessing the network.

17. The method of claim 15 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and

the blackhole command triggers a transformation of the destination of traffic associated with the spoofed instance of the endpoint device to a null destination.

18. The method of claim 15 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a blackhole command; and

the blackhole command triggers traffic associated with the spoofed instance of the endpoint device to be discarded.

19. The method of claim 15 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and

the disable command disables a port the spoofed instance of the endpoint device is connected to.

20. The method of claim 15 , wherein:

blocking the spoofed instance of the endpoint device from accessing the network comprises sending a disable command; and

the disable command triggers disconnecting electrical power to a port the spoofed instance of the endpoint device is connected to.