Detecting site locations of unknown network devices
Systems and methods for predicting the location of unknown network devices within a particular site of a multi-site network are provided. A method, according to one implementation, includes obtaining transmission characteristics related to any of packets and frames transmitted between an unknown network device and a plurality of beacon devices. Each beacon device is a network device associated with a fixed site location within a multi-site network. The method also includes utilizing the transmission characteristics to predict a site within the multi-site network where the unknown network device is located.
1 . A system comprising:
a processing device, and
a memory device configured to store a computer program having instructions that, when executed, enable the processing device to
obtain transmission characteristics related to any of packets and frames transmitted between an unknown network device and a plurality of beacon devices, wherein each beacon device is a network device located at a fixed site within a multi-site network,
use transmission characteristics collected between each pair of the plurality of beacon devices over multiple days to extract minimum-latency values and construct an n×n distance matrix having distance-based values representing beacon-to-beacon latency patterns,
use an unsupervised machine learning process operating on the n×n distance matrix to detect the fixed site of each of the beacon devices and use the detected fixed sites as labels for training a supervised machine learning process, wherein the unsupervised machine learning process comprises identifying patterns in the transmission characteristics to group beacon devices by site based on beacon-to-beacon latency patterns that characterize site-specific network signatures, without requiring initial geographic site labeling, thereby enabling automatic determination of beacon device locations for supervised training,
utilize the transmission characteristics between the unknown network device and the plurality of beacon devices to generate a latency-based feature vector mapped into a site-signature feature space learned from the detected beacon sites, and utilize the transmission characteristics with the supervised machine learning process to predict a site within the multi-site network where the unknown network device is located, wherein the fixed site and the site each correspond to a geographic location in the multi-site network where one or more network devices are located, and
utilize the site where the unknown network device is located to (1) update an inventory system and (2) perform automatic reconfiguration of the unknown network device based on the site, wherein the automatic reconfiguration comprises automatically applying configuration settings specific to the predicted geographic location, including at least one of security parameters, network access restrictions, or quality of service parameters, based on site-specific policies associated with the predicted geographic location.
2 . The system of claim 1 , wherein the instructions are further configured to enable the processing device to use the unsupervised machine learning process to detect latency patterns between each pair of beacon devices.
3 . The system of claim 2 , wherein the instructions are further configured to enable the processing device to detect the latency patterns using one or more of a ping process and a traceroute process to determine vectors of a distance matrix.
4 . The system of claim 1 , wherein the instructions are further configured to enable the processing device to detect the fixed site using a clustering technique.
5 . The system of claim 4 , wherein the clustering technique includes one or more of a k-means clustering process, an agglomerative clustering process, and a Density-Based Spatial Clustering of Applications with Noise (DBSCAN) clustering process.
6 . The system of claim 1 , wherein the unknown network device is one of a firewall device, a switch, a router, and a wireless connector.
7 . The system of claim 1 , wherein the system is part of the inventory system for determining the location of a plurality of unknown network devices at a plurality of sites within the multi-site network using an inference technique.
8 . The system of claim 7 , wherein the unknown network devices are provided by multiple vendors.
9 . The system of claim 1 , wherein the transmission characteristics include one or more of a packet drop characteristic, a latency characteristic, and a hop count of the packets transmitted between the unknown network device and the plurality of beacon devices.
10 . The system of claim 9 , wherein the latency characteristic includes one or more of a minimum latency characteristic, a maximum latency characteristic, and a standard deviation characteristic.
11 . The system of claim 1 , further comprising a network interface configured to receive the transmission characteristics over a plurality of days and at multiple times during each day, and wherein the transmission characteristics include location information, latency information, day information, and time-of-day information.
12 . The system of claim 1 , wherein the instructions are further configured to enable the processing device to predict the site where the unknown network device is located using distance-based information and without using Global Positioning System (GPS) information.
13 . A non-transitory computer-readable medium configured to store computer logic having instructions that, when executed, cause one or more processing devices to:
obtain transmission characteristics related to any of packets and frames transmitted between an unknown network device and a plurality of beacon devices, wherein each beacon device is a network device located at a fixed site within a multi-site network,
use transmission characteristics collected between each pair of the plurality of beacon devices over multiple days to extract minimum-latency values and construct an n×n distance matrix having distance-based values representing beacon-to-beacon latency patterns,
use an unsupervised machine learning process operating on the n×n distance matrix to detect the fixed site of each of the beacon devices and use the detected fixed sites as labels for training a supervised machine learning process, wherein the unsupervised machine learning process comprises identifying patterns in the transmission characteristics to group beacon devices by site based on beacon-to-beacon latency patterns that characterize site-specific network signatures, without requiring initial geographic site labeling, thereby enabling automatic determination of beacon device locations for supervised training,
utilize the transmission characteristics between the unknown network device and the plurality of beacon devices to generate a latency-based feature vector mapped into a site-signature feature space learned from the detected beacon sites, and utilize the transmission characteristics with the supervised machine learning process to predict a site within the multi-site network where the unknown network device is located, wherein the fixed site and the site each correspond to a geographic location in the multi-site network where one or more network devices are located, and
utilize the site where the unknown network device is located to (1) update an inventory system and (2) perform automatic reconfiguration of the unknown network device based on the site, wherein the automatic reconfiguration comprises automatically applying configuration settings specific to the predicted geographic location, including at least one of security parameters, network access restrictions, or quality of service parameters, based on site-specific policies associated with the predicted geographic location.
14 . The non-transitory computer-readable medium of claim 13 , wherein the instructions are further configured to cause the one or more processing devices to:
use the unsupervised machine learning process to detect latency patterns between each pair of beacon devices, and
detect the latency patterns using one or more of a ping process and a traceroute process to determine vectors of a distance matrix.
15 . The non-transitory computer-readable medium of claim 13 , wherein the instructions are further configured to cause the one or more processing devices to:
detect the fixed site using a clustering technique, wherein the clustering technique includes one or more of a k-means clustering process, an agglomerative clustering process, and a Density-Based Spatial Clustering of Applications with Noise (DBSCAN) clustering process.
16 . A method comprising the steps of:
obtaining transmission characteristics related to any of packets and frames transmitted between an unknown network device and a plurality of beacon devices, wherein each beacon device is a network device located at a fixed site within a multi-site network,
using transmission characteristics collected between each pair of the plurality of beacon devices over multiple days to extract minimum-latency values and construct an n×n distance matrix having distance-based values representing beacon-to-beacon latency patterns,
using an unsupervised machine learning process operating on the n×n distance matrix to detect the fixed site of each of the beacon devices and using the detected fixed sites as labels for training a supervised machine learning process, wherein the unsupervised machine learning process comprises identifying patterns in the transmission characteristics to group beacon devices by site based on beacon-to-beacon latency patterns that characterize site-specific network signatures without requiring initial geographic site labeling, thereby enabling automatic determination of beacon device locations for supervised training,
utilizing the transmission characteristics between the unknown network device and the plurality of beacon devices to generate a latency-based feature vector mapped into a site-signature feature space learned from the detected beacon sites, and utilizing the transmission characteristics with the supervised machine learning process to predict a site within the multi-site network where the unknown network device is located, wherein the fixed site and the site each correspond to a geographic location in the multi-site network where one or more network devices are located, and
utilizing the site where the unknown network device is located to (1) update an inventory system and (2) perform automatic reconfiguration of the unknown network device based on the site, wherein the automatic reconfiguration comprises automatically applying configuration settings specific to the predicted geographic location, including at least one of security parameters, network access restrictions, or quality of service parameters, based on site-specific policies associated with the predicted geographic location.
17 . The system of claim 1 , wherein the instructions are further configured to enable the processing device to detect that a network device has been moved.
18 . The system of claim 17 , wherein the instructions are further configured to enable the processing device to automatically reconfigure the network device based on a new site.
19 . The system of claim 17 , wherein the instructions are further configured to enable the processing device to provide a notification of the network device including a new site.