US 12,192,066 B2
Decision optimization mechanism for device classification
Itai Koren, Tel Aviv (IL); Nadav Gothait, Ramat Gan (IL); Michael Oks, Holon (IL); and Shay Shemer, Hod Hasharon (IL)
Assigned to Forescout Technologies, Inc., San Jose, CA (US)
Filed by FORESCOUT TECHNOLOGIES, INC., San Jose, CA (US)
Filed on Dec. 7, 2022, as Appl. No. 18/062,860.
Claims priority of provisional application 63/327,277, filed on Apr. 4, 2022.
Prior Publication US 2023/0318931 A1, Oct. 5, 2023
Int. Cl. H04L 41/16 (2022.01); G06F 18/241 (2023.01); H04L 43/062 (2022.01)
CPC H04L 41/16 (2013.01) [G06F 18/241 (2023.01); H04L 43/062 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method, comprising:
obtaining a first classification of a device on a network from a first source;
obtaining a second classification of the device on the network from a second source wherein the first classification and the second classification are different, wherein the first source determines the first classification based on a fingerprint in network traffic and the second source determines the second classification based on applying a machine learning algorithm to the network traffic;
selecting a source selection algorithm including selecting a depth based algorithm, based at least on a property of the first classification or the second classification;
determining a classification result of the device based on applying the source selection algorithm to select at least one of the first classification or the second classification, including applying the depth based algorithm to select one of the first classification or the second classification based on a depth of the first classification and a depth of the second classification, wherein the classification result indicates at least a role or a vendor of the device; and
storing the classification result to computer-readable memory, wherein a new classification is obtainable from a new source in response to the new source being added to a source configuration file, wherein the source configuration file identifies a plurality of sources that a respective classification is obtainable from, and identifies a respective property name that is associated with each of the plurality of sources.