Granted Patent B1

US 12,470,561 · App. 18/372,193 · Granted Nov 11, 2025

Inventors: Steven J. Goeringer (Westminster, CO); Darshak Thakore (Broomfield, CO)

Assignee: Cable Television Laboratories, Inc.

H04L63/102H04L63/1425H04L63/1433H04L63/1441

Abstract

Claims (73)

1 . A system for detecting and profiling endpoints of a computer network comprising a first computing device comprising at least one processor in communication with at least one memory device, wherein the first computing device is in communication with the computer network including a plurality of end point devices, and wherein the at least one memory device stores a plurality of instructions, which the at least one processor is programmed to:

store a plurality of synthetic profiles for a plurality of end point devices on the computer network including a first synthetic profile for a first end point device of the plurality of end point devices, wherein each synthetic profile of the plurality of synthetic profiles includes a behavior pattern for the corresponding end point device, wherein each behavior pattern is based upon analysis of a plurality of packets transmitted to and from the plurality of end point devices, wherein the plurality of synthetic profiles includes a second synthetic profile for a second end point device of the plurality of end point devices;

receive a first packet transmitted from the first end point device of the plurality of end point devices on the computer network;

identify the first packet as being transmitted by the first end point device;

identify the first packet as being transmitted to the second end point device;

retrieve the first synthetic profile of the plurality of synthetic profiles and the second synthetic profile;

compare the first packet to the behavior pattern of the first synthetic profile;

compare the first packet to the second synthetic profile; determine whether or not to route the first packet based on the comparison of the first packet to the behavior pattern of the first synthetic profile and the comparison of the first packet to the second synthetic profile; and

route or drop the first packet based upon the comparison.

2 . The system in accordance with claim 1 , wherein the plurality of synthetic profiles includes a second synthetic profile for a second end point device of the plurality of end point devices, and wherein the at least one processor is further programmed to:

receive a second packet transmitted from the second end point device on the computer network;

identify the second packet as being transmitted by the second end point device;

retrieve the second synthetic profile;

compare the second packet to the second synthetic profile; and

determine whether or not to route the first packet based on the comparison of the second packet to the second synthetic profile.

3 . The system in accordance with claim 1 , wherein the at least one processor is further programmed to:

receive a third packet transmitted to the computer network;

identify the third packet as being transmitted to the first end point device;

retrieve the first synthetic profile of the plurality of synthetic profiles;

compare the first packet to the first synthetic profile; and

determine whether or not to route the first packet to the first end point device based on the comparison of the first packet to the first synthetic profile.

4 . The system in accordance with claim 1 , wherein the at least one processor is further programmed to:

receive a user profile for the first end point device; and

compare the user profile for the first end point device to the behavior pattern to detect any anomalies.

5 . The system in accordance with claim 1 , wherein the at least one processor is further programmed to:

receive a plurality of packets associated with the computer network;

detect a new end point device associated with the plurality of packets;

determine an identity and a behavior pattern for the new end point device based on the plurality of packets; and

generate a new synthetic profile for the new end point device based on the identity and the behavior pattern.

6 . The system in accordance with claim 5 , wherein the instructions further cause the at least one processor to:

receive a plurality of data associated with the new end point device from one or more external data sources; and

update the new synthetic profile based on the plurality of data.

7 . The system in accordance with claim 5 , wherein the instructions further cause the at least one processor to identify the new end point device based upon an IP address, a MAC address, and gateway information.

8 . The system in accordance with claim 5 , wherein the instructions further cause the at least one processor to:

determine a type for the new end point device based upon the behavior pattern; and

update the new synthetic profile based upon the type for the new end point device.

9 . The system in accordance with claim 1 , wherein the first computing device is a gateway associated with the computer network.

10 . The system in accordance with claim 9 , wherein the first computing device is between the computer network and an external computer network.

11 . The system in accordance with claim 10 , wherein the external computer network is the Internet.

12 . The system in accordance with claim 11 , wherein the first computing device determines whether or not the first end point device may access the external computer network.

13 . The system in accordance with claim 11 , wherein the first computing device determines whether or not the first end point device may be accessed by the external computer network.

14 . A method for detecting and profiling endpoints of a computer network comprising:

storing a plurality of synthetic profiles for a plurality of end point devices on the computer network including a first synthetic profile for a first end point device of the plurality of end point devices, wherein each synthetic profile of the plurality of synthetic profiles includes a behavior pattern for the corresponding end point device, wherein each behavior pattern is based upon analysis of a plurality of packets transmitted to and from the plurality of end point devices, wherein the plurality of synthetic profiles includes a second synthetic profile for a second end point device of the plurality of end point devices;

receiving a first packet transmitted from the first end point device of the plurality of end point devices on the computer network;

identifying the first packet as being transmitted by the first end point device;

identifying the first packet as being transmitted to the second end point device;

retrieving the first synthetic profile of the plurality of synthetic profiles and the second synthetic profile;

comparing the first packet to the behavior pattern of the first synthetic profile;

comparing the first packet to the second synthetic profile;

determining whether or not to route the first packet based on the comparison of the first packet to the behavior pattern of the first synthetic profile and the comparison of the first packet to the second synthetic profile; and

routing or dropping the first packet based upon the comparison.

15 . The method in accordance with claim 14 , wherein the plurality of synthetic profiles includes a second synthetic profile for a second end point device of the plurality of end point devices, and wherein the method further comprises:

receiving a second packet transmitted from the second end point device on the computer network;

identifying the second packet as being transmitted by the second end point device;

retrieving the second synthetic profile;

comparing the second packet to the second synthetic profile; and

determining whether or not to route the first packet based on the comparison of the second packet to the second synthetic profile.

16 . The method in accordance with claim 14 further comprising:

receiving a user profile for the first end point device; and

comparing the user profile for the first end point device to the behavior pattern to detect any anomalies.

17 . The method in accordance with claim 14 further comprising:

receiving a plurality of packets associated with the computer network;

detecting a new end point device associated with the plurality of packets;

determining an identity and a behavior pattern for the new end point device based on the plurality of packets; and

generating a new synthetic profile for the new end point device based on the identity and the behavior pattern.

18 . The method in accordance with claim 14 , wherein the method is implemented on a first computing device that is a gateway associated with the computer network, wherein the first computing device is between the computer network and an external computer network, wherein the external computer network is the Internet, and wherein the method further comprises determining whether or not the first end point device may access the external computer network.

19 . The method in accordance with claim 17 further comprising:

receiving a plurality of data associated with the new end point device from one or more external data sources; and

updating the new synthetic profile based on the plurality of data.

20 . The method in accordance with claim 17 further comprising:

identifying the new end point device based upon an IP address, a MAC address, and gateway information;

determining a type for the new end point device based upon the behavior pattern; and

updating the new synthetic profile based upon the type for the new end point device.

Assignments (1)

Continuity (3)

References Cited (18)