System and Method for Device Context and Device Security

Abstract

A system includes local area network (LAN) devices in communication with network devices external to the LAN. An agent in the LAN examines traffic between LAN devices and external devices. The agent executes scans of the LAN devices, generates fingerprint and telemetry data for the LAN devices, and sends the telemetry data and the fingerprint data to a cloud server external to the LAN. The cloud server receives telemetry data and fingerprint data and updates a device attribute database with fingerprints and/or device profiles for the LAN devices to identify anomalous behavior of the LAN devices.

What is claimed is: 
     
         1 . A system for a local area network (LAN) in communication with a first network, the LAN comprising a LAN router in communication with a plurality of LAN network devices, the plurality of LAN network devices in communication with a plurality of external network devices in the first network via the LAN router, the system comprising:
 a cloud server in communication with the first network, the cloud server further comprising a device attribute database and configured to receive telemetry data and fingerprint data and update the device attribute database; and   an agent in communication with the cloud server and the plurality of network devices via the LAN router, wherein the agent comprises a processor and a memory configured to store non-transitory instructions which, when executed, perform the steps of:
 examining LAN router network traffic between one of the plurality of LAN network devices and one of the plurality of external network devices; 
 executing a scan of the plurality of LAN network devices; 
 generating the fingerprint data based upon one of the group consisting of the network traffic, the LAN network device scans, and the network traffic and the LAN network device scans; 
 generating the telemetry data based upon one of the group consisting of the network traffic, the LAN network device scans, and the network traffic and the LAN network device scans; and 
 sending the telemetry data and the fingerprint data to the cloud server. 
   
     
     
         2 . The system of  claim 1 , wherein the cloud server is further configured to generate a fingerprint from one of the group consisting of the telemetry data, the fingerprint data, and the telemetry data and the fingerprint data. 
     
     
         3 . The system of  claim 1 , wherein the cloud server is further configured to:
 associate the fingerprint with a device profile identifier;   compare the fingerprint to a stored fingerprint of a device type indicated by the device profile identifier; and   determine if the fingerprint indicates anomalous behavior for the device type.   
     
     
         4 . The system of  claim 1 , wherein the agent is resident within the LAN router. 
     
     
         5 . The system of  claim 1 , wherein the cloud server is further configured to update a user interface to indicate the update the device attribute database. 
     
     
         6 . The system of  claim 1 , wherein the telemetry and/or fingerprint data comprises data measuring timing of traffic sent to and/or received by any of the plurality of LAN network devices. 
     
     
         7 . A server in communication with an agent in a local area network (LAN) via a first network comprising a LAN router, the LAN comprising a plurality of LAN network devices, in communication with a plurality of external network devices in the first network via the LAN router, the server comprising:
 a device attribute database; and   a processor and a memory configured to store non-transitory instructions which, when executed, perform the steps of:
 requesting the agent perform a scan of one or more of the plurality of LAN network devices; 
 receiving telemetry data and fingerprint data from the agent regarding traffic addressed to or transmitted by one of the plurality of LAN network devices; 
 generating a fingerprint for one of the plurality of LAN network devices from one of the group consisting of the telemetry data, the fingerprint data, and the telemetry data and the fingerprint data; and 
 storing the fingerprint in the device attribute database, 
   wherein the telemetry data comprises data measuring timing of traffic sent to and/or received by any of the plurality of LAN network devices.   
     
     
         8 . The server of  claim 7 , wherein the server is further configured to perform the steps of:
 associating the fingerprint with a device profile identifier;   comparing the fingerprint to a stored fingerprint of a device type indicated by the device profile identifier; and   determining if the fingerprint indicates anomalous behavior for the device type.   
     
     
         9 . A method for monitoring a plurality of LAN network devices in a local area network (LAN) comprising a LAN router in communication with a first network, the plurality of LAN network devices in communication via the first network with a plurality of external network devices in the first network, the method comprising the steps of:
 examining LAN router network traffic between one of the plurality of LAN network devices and one of the plurality of external network devices;   executing a scan of the plurality of LAN network devices;   receiving telemetry data and fingerprint data regarding traffic between one of the plurality of LAN network devices and one of the plurality of external network devices;   generating a fingerprint for one of the plurality of LAN network devices from one of the group consisting of the telemetry data, the fingerprint data, and the telemetry data and the fingerprint data;   storing the fingerprint in the device attribute database; and   associating the fingerprint with a device profile identifier.   
     
     
         10 . The method of  claim 9 , further comprising the steps of:
 comparing the fingerprint to a stored fingerprint of a device type indicated by the device profile identifier; and   determining if the fingerprint indicates anomalous behavior for the device type.   
     
     
         11 . The method of  claim 9 , wherein the telemetry comprises data measuring timing of traffic sent to and/or received by any of the plurality of LAN network devices. 
     
     
         12 . An agent in a local area network (LAN) comprising a LAN router in communication with a server via a first network, the LAN comprising a plurality of LAN network devices in communication via the first network, the agent comprising:
 a processor and a memory configured to store non-transitory instructions which, when executed, perform the steps of:   examining, via the LAN router, network traffic of the plurality of LAN network devices;   executing a scan of the plurality of LAN network devices;   generating fingerprint data based upon one of the group consisting of the network traffic, the LAN network device scans, and the network traffic and the LAN network device scans;   generating telemetry data based upon one of the group consisting of the network traffic, the LAN network device scans, and the network traffic and the LAN network device scans; and   sending the telemetry data and the fingerprint data to the cloud server.   
     
     
         13 . The agent of  claim 12 , wherein the agent is resident within the LAN router. 
     
     
         14 . The agent of  claim 12 , wherein the telemetry comprises data measuring timing of traffic sent to and/or received by any of the plurality of LAN network devices. 
     
     
         15 . A system for a local area network (LAN) in communication with a first network, the LAN comprising a LAN router in communication with a plurality of LAN network devices, the plurality of LAN network devices in communication via the first network, the system comprising:
 a cloud server in communication with the first network, the cloud server further comprising a device attribute database and configured to receive telemetry data and fingerprint data and update the device attribute database; and   an agent in communication with the cloud server and the plurality of network devices via the LAN router, wherein the agent comprises a processor and a memory configured to store non-transitory instructions which, when executed, perform the steps of:
 examining LAN router network traffic between a first device of the plurality of LAN network devices and a second device of the plurality of LAN network devices; 
 executing a scan of the plurality of LAN network devices; 
 generating the fingerprint data based upon one of the group consisting of the network traffic, the LAN network device scans, and the network traffic and the LAN network device scans; 
 generating the telemetry data based upon one of the group consisting of the network traffic, the LAN network device scans, and the network traffic and the LAN network device scans; and 
 sending the telemetry data and the fingerprint data to the cloud server. 
   
     
     
         16 . The system of  claim 15 , wherein the cloud server is further configured to generate a fingerprint from one of the group consisting of the telemetry data, the fingerprint data, and the telemetry data and the fingerprint data. 
     
     
         17 . The system of  claim 15 , wherein the cloud server is further configured to:
 associate the fingerprint with a device profile identifier;   compare the fingerprint to a stored fingerprint of a device type indicated by the device profile identifier; and   determine if the fingerprint indicates anomalous behavior for the device type.