NETWORK DEVICE TYPE CLASSIFICATION
A method of identifying network devices includes transforming a first data set of feature-rich device characteristics of devices with known device identities to a second data set comprising feature-poor device characteristics with the known device identities. A third data set of feature-poor device characteristics of devices with known identities is collected. A statistical model is derived comprising one or more adjustments to the transformed data set, the statistical model reflecting a difference in statistical distribution between one or more characteristics of the second data set of transformed device characteristics and one or more corresponding and/or related characteristics of the third data set of feature-poor device characteristics. A device identification module is trained based on the second data set of feature-poor characteristics and the statistical model adjustments, the trained device identification module operable to use feature-poor device characteristics to identify network devices.
1 . A method of identifying network devices, comprising:
transforming a first data set of feature-rich device characteristics of devices with known device identities to a second data set of transformed device characteristics comprising feature-poor device characteristics with the known device identities;
collecting a third data set of feature-poor device characteristics of devices with known identities;
deriving a statistical model comprising one or more adjustments to the transformed data set, the statistical model reflecting a difference in statistical distribution between one or more characteristics of the second data set of transformed device characteristics and one or more corresponding and/or related characteristics of the third data set of feature-poor device characteristics; and
training a device identification model based on the second data set of transformed device characteristics and the statistical model adjustments, the trained device identification module operable to use feature-poor device characteristics to identify network devices.
2 . The method of identifying network devices of claim 1 , further comprising deploying the trained device identification model to a feature-poor environment
3 . The method of identifying network devices of claim 2 , wherein the feature-rich environment comprises an end user computing device.
4 . The method of identifying network devices of claim 1 , further comprising training a second device identification model based on the second data set of feature-poor characteristics without the statistical model adjustments, the trained second device identification module operable to use feature-poor device characteristics to identify network devices.
5 . The method of identifying network devices of claim 4 , further comprising deploying the trained second device identification model to a feature-rich environment
6 . The method of identifying network devices of claim 5 , wherein the feature-rich environment comprises a router, a gateway, or a network security device.
7 . The method of identifying network devices of claim 1 , further comprising collecting the first data set of feature-rich device characteristics from at least one router, gateway, or network security device.
8 . The method of identifying network devices of claim 1 , wherein the devices with known identities comprise devices that have been classified by an expert or have been classified by expert-derived rules or classifications.
9 . The method of identifying network devices of claim 1 , wherein transforming the first data set of feature-rich device characteristics to the second data set of transformed device characteristics comprises reducing the feature-rich data set to produce a feature-poor data set approximately equivalent to the feature-rich data set.
10 . The method of identifying network devices of claim 1 , wherein the first data set of feature-rich device characteristics comprises a data set associated with at least one network security appliance, and the third data set comprising feature-poor device characteristics comprises a data set associated with a device antimalware application.
11 . The method of identifying network devices of claim 1 , wherein at least one of the feature-rich or feature-poor characteristics comprise network protocols, network services, open ports, traffic types, network traffic, and network packet content.
12 . The method of identifying network devices of claim 1 , wherein the feature-poor characteristics comprise at least partially a subset of the feature-rich characteristics.
13 . A computerized network device, comprising:
a processor and a memory,
a nonvolatile storage operable to store program instructions executable on the processor when loaded into memory; and
machine-readable instructions stored on the nonvolatile memory, operable when executed to cause the computerized system to:
transform a first data set of feature-rich device characteristics of devices with known device identities to a second data set of transformed device characteristics comprising feature-poor device characteristics with the known device identities;
collect a third data set of feature-poor device characteristics of devices with known identities;
derive a statistical model comprising one or more adjustments to the transformed data set, the statistical model reflecting a difference in statistical distribution between one or more characteristics of the second data set of transformed device characteristics and one or more corresponding and/or related characteristics of the third data set of feature-poor device characteristics; and
train a device identification model based on the second data set of transformed device characteristics and the statistical model adjustments, the trained device identification module operable to use feature-poor device characteristics to identify network devices.
14 . The computerized network device of claim 13 , the machine-readable instructions when executed further operable to identify one or more network devices using the trained device identification model.
15 . The computerized network device of claim 13 , the machine-readable instructions further operable when executed to train a second device identification model based on the second data set of feature-poor characteristics without the statistical model adjustments, the trained second device identification module operable to use feature-poor device characteristics to identify network devices.
16 . The computerized network device of claim 15 , the machine-readable instructions when executed further operable to identify one or more network devices using the trained second device identification model in a feature-rich environment.
17 . The computerized network device of claim 13 , the machine-readable instructions when executed further operable to collect the first data set of feature-rich device characteristics.
18 . The computerized network device of claim 13 , wherein transforming the first data set of feature-rich device characteristics to the second data set comprising feature-poor device characteristics comprises reducing the feature-rich data set to produce a feature-poor data set approximately equivalent to the feature-rich data set.
19 . The computerized network device of claim 13 , wherein the first data set of feature-rich device characteristics comprises a data set associated with at least one router, gateway, or network security appliance, and the second data set comprising feature-poor device characteristics comprises a data set associated with a device antimalware application.
20 . The computerized network device of claim 13 , wherein at least one of the feature-rich or feature-poor characteristics comprise network protocols, network services, open ports, traffic types, network traffic, and network packet content.