Proactive inspection technique for improved classification
Systems, methods, and related technologies for a proactive inspection system for improved classification of devices are described. A device is discovered on a network that has a first open port number. A filename is obtained based on a likelihood that the filename is being used as a name for file content, in association with the first open port number. The file content is obtained from the device with the first open port number and the filename. The device is classified with the file content.
1. A method, performed by a processing device, comprising:
discovering a device on a network that has a first open port number;
obtaining, by the processing device, a filename based on likelihood of the filename being used as a name for file content, in association with the first open port number;
requesting the file content from the device with the first open port number and the filename; and
in response to obtaining the file content from the device, classifying the device with the file content.
2. The method of claim 1 , wherein the filename has a highest likelihood of being used as the name for the file content, and the method further comprises: in response to failing to obtain the file content from the device with the filename and the first open port number, requesting the file content from the device with the first open port number and a second filename that has a second highest likelihood of being used as the name for the file content in association with the first open port number.
3. The method of claim 1 , wherein the filename has a highest likelihood of being used as the name for the file content, and the method further comprises: in response to a failure of obtaining the file content with the first open port number, requesting the file content from the device with a second open port number and a second filename that has a highest likelihood of being used as the name for the file content, in association with the second open port number.
4. The method of claim 1 , wherein obtaining the filename includes referencing the first open port number in a data storage that comprises a plurality of port numbers, wherein each of the plurality of port numbers has associated to it, one or more filenames that are ranked in order of likelihood of being used as the name for the file content at a respective one of the plurality of port numbers.
5. The method of claim 4 , further comprising ignoring a candidate filename of the one or more filenames from the data storage if a probability or a success rate of the candidate filename does not satisfy a probability threshold or a success rate threshold.
6. The method of claim 5 , further comprising updating the success rate of the filename with respect to the first open port number in the data storage, in view of whether the file content was obtained from the device with the filename and the first open port number.
7. The method of claim 1 , wherein the device is universal plug and play (UPnP) enabled.
8. The method of claim 1 , wherein requesting the file content from the device includes sending an (hypertext transfer protocol) HTTP GET request to the device, the HTTP GET request comprising an IP address of the device, the first open port number of the device, and the filename associated with the file content.
9. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
discover a device on a network that has a first open port number;
obtain, by the processing device, a filename based on likelihood of the filename being used as a name for file content, in association with the first open port number;
request the file content from the device with the first open port number and the filename; and
in response to obtaining the file content from the device, classify the device with the file content.
10. The non-transitory computer readable medium of claim 9 , wherein the filename has a highest likelihood of being used as the name for the file content, and wherein the processing device is further to: in response to failing to obtain the file content from the device with the filename and the first open port number, request the file content from the device with the first open port number and a second filename that has a second highest likelihood of being used as the name for the file content in association with the first open port number.
11. The non-transitory computer readable medium of claim 9 , wherein the filename has a highest likelihood of being used as the name for the file content, and wherein the processing device is further to: in response to failing to obtain the file content with the first open port number, request the file content from the device with a second open port number and a second filename that has a highest likelihood of being used as the name for the file content, in association with the second open port number.
12. The non-transitory computer readable medium of claim 9 , wherein to obtain the filename includes to reference the first open port number in a data storage that comprises a plurality of port numbers, wherein each of the plurality of port numbers has associated to it, one or more filenames that are ranked in order of likelihood of being used as the name for the file content at a respective one of the plurality of port numbers.
13. The non-transitory computer readable medium of claim 12 , wherein the processing device is further to: ignore a candidate filename of the one or more filenames from the data storage if a probability or a success rate of the candidate filename does not satisfy a probability threshold or a success rate threshold.
14. The non-transitory computer readable medium of claim 13 , wherein the processing device is further to: update the success rate of the filename with respect to the first open port number in the data storage, in view of whether the file content was obtained from the device with the filename and the first open port number.
15. A system, comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
discover a device on a network that has a first open port number;
obtain, by the processing device, a filename based on likelihood of the filename being used as a name for file content, in association with the first open port number;
request the file content from the device with the first open port number and the filename; and
in response to obtaining the file content from the device, classify the device with the file content.
16. The system of claim 15 , wherein the filename has a highest likelihood of being used as the name for the file content, and wherein the processing device is further to: in response to failing to obtain the file content from the device with the filename and the first open port number, request the file content from the device with the first open port number and a second filename that has a second highest likelihood of being used as the name for the file content in association with the first open port number.
17. The system of claim 15 , wherein the filename has a highest likelihood of being used as the name for the file content, and wherein the processing device is further to: in response to failing to obtain the file content with the first open port number, request the file content from the device with a second open port number and a second filename that has a highest likelihood of being used as the name for the file content, in association with the second open port number.
18. The system of claim 15 , wherein to obtain the filename includes to reference the first open port number in a data storage that comprises a plurality of port numbers, wherein each of the plurality of port numbers has associated to it, one or more filenames that are ranked in order of likelihood of being used as the name for the file content at a respective one of the plurality of port numbers.
19. The system of claim 18 , wherein the processing device is further to: ignore a candidate filename of the one or more filenames from the data storage if a probability or a success rate of the candidate filename does not satisfy a probability threshold or a success rate threshold.
20. The system of claim 19 , wherein the processing device is further to: update the success rate of the filename with respect to the first open port number in the data storage, in view of whether the file content was obtained from the device with the filename and the first open port number.