Detecting device change due to DHCP in sparsely populated log data

Abstract

Systems and methods for detecting device change due to Dynamic Host Configuration Protocol (DHCP) in sparsely populated log data include monitoring and logging network traffic data; identifying one or more outlier time gaps associated with an Internet Protocol (IP) address used to communicate over the network within the logged network traffic data; and determining the occurrence of a DHCP change based on one or more network traffic characteristics of the IP address before and after the outlier time gap.

CPC Classifications