CPC H04L 41/12 (2013.01) [H04L 41/069 (2013.01); H04L 43/04 (2013.01); H04L 43/10 (2013.01); H04L 63/1408 (2013.01); H04L 67/10 (2013.01); G06F 2009/45591 (2013.01)] | 20 Claims |
1. A method comprising:
receiving network traffic data associated with a network;
receiving, from a source other than the network traffic data including a hypervisor, a network access control (NAC) system, or a cloud management system, an indication of one or more active devices coupled to the network at an end of a time interval;
comparing the indication of the one or more active devices coupled to the network at the end of the time interval to the network traffic data associated with the network; and
determining, by a processing device, based on the comparison between the indication of the one or more active devices and the network traffic data, one or more additional devices coupled to the network during the time interval wherein the one or more additional devices have a shorter period of network traffic activity than the one or more active devices coupled to the network and were not included in the indication of the one or more active devices coupled to the network at the end of the time interval.
|