Device classification
Systems, methods, and related technologies for device classification are described. In certain aspects, traffic data associated with a device and data from an external system can be accessed. The data can be processed to determine a device classification for the device. An action can be initiated based on the classification.
1. A method comprising:
detecting a device coupled to a network;
retrieving, by a classifier device, device information from an external system associated with the device;
determining, by the classifier device, a classification for the device based on the device information from the external system and traffic data associated with the device; and
storing the classification for the device.
2. The method of claim 1 further comprising:
initiating an action based on the classification of the device.
3. The method of claim 1 , wherein the traffic data comprises information associated with a port of the device operable to receive communications from the network.
4. The method of claim 1 , wherein the traffic data comprises information associated with a service of the device.
5. The method of claim 1 , wherein the detecting of the device coupled to the network comprises detecting the device in response to the device being coupled to the network.
6. The method of claim 1 , wherein the external system is selected from the group consisting of a vulnerability assessment system, a thread detection system, a mobile device management system, a firewall system, a switch system, and an access point system.
7. The method of claim 1 , wherein determining the classification of the device is further based on data received from an agent installed on the device.
8. The method of claim 1 , wherein determining the classification of the device is further based on data received from another device communicatively coupled to the device.
9. The method of claim 1 , wherein the traffic data associated with the device is determined based on passive traffic analysis.
10. The method of claim 1 , wherein the traffic data associated with the device is determined based on active traffic analysis.
11. The method of claim 1 , wherein the classification is further based on a proximity of the device to another device.
12. The method of claim 1 , wherein the classification is further based on an operating time of the device.
13. The method of claim 1 further comprising:
accessing data associated with the device, wherein the data associated with the device comprises additional traffic data associated with the device; and
determining another classification for the device based on the data associated with device.
14. A classifier system comprising:
a memory; and
a processing device of the classifier system, operatively coupled to the memory, to:
access data associated with a device, wherein the data associated with the device comprises traffic analysis data associated with the device and device information retrieved from an external system associated with the device;
determine a device type classification for the device based on the data associated with device; and
store the device type classification for the device.
15. The system of claim 14 , wherein the processing device is further to determine the device type classification of the device periodically.
16. The system of claim 14 , wherein the determination of the device type classification of the device based on the data associated with the device is further based on data from an aggregation device coupled to the device.
17. The system of claim 14 , wherein the traffic analysis data is further based on at least one of active traffic analysis or passive traffic analysis.
18. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device of a classifier device, cause the processing device of the classifier device to:
access data associated with a first device coupled to a network, wherein the data associated with the device comprises data from a second device coupled to the first device;
retrieve device information associated with the first device from an external system associated with the device;
process, by the processing device, the data associated with first device and the device information retrieved from the external system to determine a classification for the first device;
store the classification of the first device; and
initiate an action based on the classification of the first device.
19. The non-transitory computer readable medium of claim 18 , wherein the second device is operable to communicate with the processing device using a first protocol and the second device is operable to communicate with the first device using a second protocol.