Intelligent querying of network-connected devices
Techniques for implementing intelligent querying of network-connected devices are disclosed. In some embodiments, a method comprises the following: identifying a set of unique identifiers corresponding to a set of devices connected to a network; obtaining information associated with a set of communications transmitted to or from a particular device in the set of devices based on the unique identifier corresponding to the particular device; identifying a device type for the unique identifier corresponding to the particular device based on the identified information associated with the set of communications; selecting a subset of a candidate set of queries based on the identified device type for the unique identifier; and executing the subset of the candidate set of queries on the particular device based on the selecting of the subset.
1 . One or more non-transitory computer readable media comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
identifying a set of unique identifiers corresponding to a set of devices connected to a network;
obtaining information associated with a set of communications transmitted to or from a particular device in the set of devices based on the unique identifier corresponding to the particular device;
identifying a device type for the unique identifier corresponding to the particular device based on the information associated with the set of communications;
selecting a subset of a candidate set of queries based on the identified device type for the unique identifier; and
executing the subset of the candidate set of queries on the particular device based on the selecting of the subset.
2 . The media of claim 1 , wherein the set of unique identifiers comprises one or more Internet Protocol (IP) addresses.
3 . The media of claim 2 , wherein the identifying the set of unique identifiers comprises obtaining the one or more IP addresses from an IP address management (IPAM) server of the network.
4 . The media of claim 2 , wherein the identifying the set of unique identifiers comprises obtaining the one or more IP addresses by performing a ping sweep on the network.
5 . The media of claim 1 , wherein the set of unique identifiers comprises one or more media access control (MAC) addresses, and the identifying the set of unique identifiers comprises obtaining the one or more MAC addresses from a network infrastructure device of the network.
6 . The media of claim 1 , wherein the obtaining the information associated with the set of communications comprises obtaining the information from a network infrastructure device of the network.
7 . The media of claim 1 , wherein the information associated with the set of communications comprises one or more port identification numbers associated with the identified set of communications.
8 . The media of claim 1 , wherein the information associated with the set of communications comprises one or more host names associated with the identified set of communications.
9 . The media of claim 1 , wherein the information associated with the set of communications comprises one or more communication protocols associated with the identified set of communications.
10 . The media of claim 1 , wherein the information associated with the set of communications comprises one or more external domains associated with the identified set of communications.
11 . The media of claim 1 , wherein the information associated with the set of communications comprises a pattern of directional flow of the set of communications.
12 . The media of claim 1 , wherein the identifying the device type for the unique identifier corresponding to the particular device comprises applying a machine learning model to the information associated with the set of communications to identify the device type.
13 . The media of claim 12 , wherein the operations further comprise:
training the machine learning model to identify corresponding device types of devices, the training comprising:
obtaining training data comprising:
for each reference device in a reference set of reference devices, a historical set of communications transmitted to or transmitted from the reference device; and
for each reference device in the reference set of reference devices, a corresponding device type of the reference device; and
training the machine learning model based on the training data.
14 . The media of claim 1 , wherein the operations further comprise:
determining a timing for executing the subset of the candidate set of queries on the particular device based on the identified device type,
wherein the subset of the candidate set of queries is executed on the particular device at the determined timing.
15 . The media of claim 1 , wherein the operations further comprise:
receiving a response to the executed subset of the candidate set of queries from the particular device;
selecting, based on the identified device type, a particular process from a set of processes for processing the response to the executed subset of the candidate set of queries; and
processing the response to the executed subset of the candidate set of queries using the selected particular process.
16 . The media of claim 1 , wherein the device type comprises a web server and the operations further comprise:
identifying a service type of the web server based on the information associated with the set of communications,
wherein the selecting the subset of the candidate set of queries is further based on the identified service type of the web server.
17 . The media of claim 1 , wherein the candidate set of queries comprises a first candidate query requesting a first type of data and a second candidate query requesting a second type of data that is different from the first type of data, the subset of the candidate set of queries includes the first candidate query and excludes the second candidate query.
18 . The media of claim 1 , wherein the candidate set of queries comprises a first candidate query corresponding to a first communication protocol and a second candidate query corresponding to a second communication protocol that is different from the first communication protocol, the subset of the candidate set of queries includes the first candidate query and excludes the second candidate query.
19 . A method performed by at least one device including a hardware processor, the method comprising:
identifying a set of unique identifiers corresponding to a set of devices connected to a network;
obtaining information associated with a set of communications transmitted to or from a particular device in the set of devices based on the unique identifier corresponding to the particular device;
identifying a device type for the unique identifier corresponding to the particular device based on the information associated with the set of communications;
selecting a subset of a candidate set of queries based on the identified device type for the unique identifier; and
executing the subset of the candidate set of queries on the particular device based on the selecting of the subset.
20 . The method of claim 19 , wherein the set of unique identifiers comprises one or more Internet Protocol (IP) addresses.
21 . The method of claim 20 , wherein the identifying the set of unique identifiers comprises obtaining the one or more IP addresses from an IP address management (IPAM) server of the network.
22 . The method of claim 20 , wherein the identifying the set of unique identifiers comprises obtaining the one or more IP addresses by performing a ping sweep on the network.
23 . The method of claim 19 , wherein the set of unique identifiers comprises one or more media access control (MAC) addresses, and the identifying the set of unique identifiers comprises obtaining the one or more MAC addresses from a network infrastructure device of the network.
24 . The method of claim 19 , wherein the obtaining the information associated with the set of communications comprises obtaining the information from a network infrastructure device of the network.
25 . The method of claim 19 , wherein the information associated with the set of communications comprises one or more port identification numbers associated with the identified set of communications.
26 . The method of claim 19 , wherein the information associated with the set of communications comprises one or more host names associated with the identified set of communications.
27 . The method of claim 19 , wherein the information associated with the set of communications comprises one or more communication protocols associated with the identified set of communications.
28 . The method of claim 19 , wherein the information associated with the set of communications comprises one or more external domains associated with the identified set of communications.
29 . The method of claim 19 , wherein the information associated with the set of communications comprises a pattern of directional flow of the set of communications.
30 . The method of claim 19 , wherein the identifying the device type for the unique identifier corresponding to the particular device comprises applying a machine learning model to the information associated with the set of communications to identify the device type.
31 . The method of claim 30 , wherein the method further comprises:
training the machine learning model to identify corresponding device types of devices, the training comprising:
obtaining training data comprising:
for each reference device in a reference set of reference devices, a historical set of communications transmitted to or transmitted from the reference device; and
for each reference device in the reference set of reference devices, a corresponding device type of the reference device; and
training the machine learning model based on the training data.
32 . The method of claim 19 , wherein the method further comprises:
determining a timing for executing the subset of the candidate set of queries on the particular device based on the identified device type,
wherein the subset of the candidate set of queries is executed on the particular device at the determined timing.
33 . The method of claim 19 , wherein the method further comprises:
receiving a response to the executed subset of the candidate set of queries from the particular device;
selecting, based on the identified device type, a particular process from a set of processes for processing the response to the executed subset of the candidate set of queries; and
processing the response to the executed subset of the candidate set of queries using the selected particular process.
34 . The method of claim 19 , wherein the device type comprises a web server and the method further comprises:
identifying a service type of the web server based on the information associated with the set of communications,
wherein the selecting the subset of the candidate set of queries is further based on the identified service type of the web server.
35 . The method of claim 19 , wherein the candidate set of queries comprises a first candidate query requesting a first type of data and a second candidate query requesting a second type of data that is different from the first type of data, the subset of the candidate set of queries includes the first candidate query and excludes the second candidate query.
36 . Thee method of claim 19 , wherein the candidate set of queries comprises a first candidate query corresponding to a first communication protocol and a second candidate query corresponding to a second communication protocol that is different from the first communication protocol, the subset of the candidate set of queries includes the first candidate query and excludes the second candidate query.
37 . A system comprising:
at least one device including a hardware processor;
the system being configured to perform operations comprising:
identifying a set of unique identifiers corresponding to a set of devices connected to a network;
obtaining information associated with a set of communications transmitted to or from a particular device in the set of devices based on the unique identifier corresponding to the particular device;
identifying a device type for the unique identifier corresponding to the particular device based on the information associated with the set of communications;
selecting a subset of a candidate set of queries based on the identified device type for the unique identifier; and
executing the subset of the candidate set of queries on the particular device based on the selecting of the subset.
38 . The system of claim 37 , wherein the set of unique identifiers comprises one or more Internet Protocol (IP) addresses.
39 . The system of claim 38 , wherein the identifying the set of unique identifiers comprises obtaining the one or more IP addresses from an IP address management (IPAM) server of the network.
40 . The system of claim 38 , wherein the identifying the set of unique identifiers comprises obtaining the one or more IP addresses by performing a ping sweep on the network.
41 . The system of claim 37 , wherein the set of unique identifiers comprises one or more media access control (MAC) addresses, and the identifying the set of unique identifiers comprises obtaining the one or more MAC addresses from a network infrastructure device of the network.
42 . The system of claim 37 , wherein the obtaining the information associated with the set of communications comprises obtaining the information from a network infrastructure device of the network.
43 . The system of claim 37 , wherein the information associated with the set of communications comprises one or more port identification numbers associated with the identified set of communications.
44 . The system of claim 37 , wherein the information associated with the set of communications comprises one or more host names associated with the identified set of communications.
45 . The system of claim 37 , wherein the information associated with the set of communications comprises one or more communication protocols associated with the identified set of communications.
46 . The system of claim 37 , wherein the information associated with the set of communications comprises one or more external domains associated with the identified set of communications.
47 . The system of claim 37 , wherein the information associated with the set of communications comprises a pattern of directional flow of the set of communications.
48 . The system of claim 37 , wherein the identifying the device type for the unique identifier corresponding to the particular device comprises applying a machine learning model to the information associated with the set of communications to identify the device type.
49 . The system of claim 48 , wherein the operations further comprise:
training the machine learning model to identify corresponding device types of devices, the training comprising:
obtaining training data comprising:
for each reference device in a reference set of reference devices, a historical set of communications transmitted to or transmitted from the reference device; and
for each reference device in the reference set of reference devices, a corresponding device type of the reference device; and
training the machine learning model based on the training data.
50 . The system of claim 37 , wherein the operations further comprise:
determining a timing for executing the subset of the candidate set of queries on the particular device based on the identified device type,
wherein the subset of the candidate set of queries is executed on the particular device at the determined timing.
51 . The system of claim 37 , wherein the operations further comprise:
receiving a response to the executed subset of the candidate set of queries from the particular device;
selecting, based on the identified device type, a particular process from a set of processes for processing the response to the executed subset of the candidate set of queries; and
processing the response to the executed subset of the candidate set of queries using the selected particular process.
52 . The system of claim 37 , wherein the device type comprises a web server and the operations further comprise:
identifying a service type of the web server based on the information associated with the set of communications,
wherein the selecting the subset of the candidate set of queries is further based on the identified service type of the web server.
53 . The system of claim 37 , wherein the candidate set of queries comprises a first candidate query requesting a first type of data and a second candidate query requesting a second type of data that is different from the first type of data, the subset of the candidate set of queries includes the first candidate query and excludes the second candidate query.
54 . The system of claim 37 , wherein the candidate set of queries comprises a first candidate query corresponding to a first communication protocol and a second candidate query corresponding to a second communication protocol that is different from the first communication protocol, the subset of the candidate set of queries includes the first candidate query and excludes the second candidate query.