Abstract: A central platform remote from a local network can detect anomalies on the local network. The central platform can assign a unique pair of DNS server IP addresses to the local network. The central platform can receive configuration data from the local network and use the configuration data and the assigned pair of DNS server IP addresses to uniquely identify devices on the local network. In the case that current network flow statistics do not match expected network flow statistics for the local network, a device causing the anomalous behavior can be identified using the assigned pair of DNS server IP addresses and configuration data.

Abstract: A device identification module identifies devices on a remote network, where the remote network may use Network Address Translation techniques. The device identification module can receive a list of devices on the remote network. The devices in the remote network can be identified by the device classification module based, at least in part, on the device classification and one or more of Dynamic Host Configuration Protocol (DHCP) information for the remote network, port sequences used in Network Address Translation on the remote network, and a live Uniform Resource Locator (URL) check performed on the remote network.

Abstract: A central platform remote from a local network can detect anomalies on the local network. The central platform can assign a unique pair of DNS server IP addresses to the local network. The central platform can receive configuration data from the local network and use the configuration data and the assigned pair of DNS server IP addresses to uniquely identify devices on the local network. In the case that current network flow statistics do not match expected network flow statistics for the local network, a device causing the anomalous behavior can be identified using the assigned pair of DNS server IP addresses and configuration data.

Abstract: A device identification module identifies devices on a remote network, where the remote network may use Network Address Translation techniques. The device identification module can receive a list of devices on the remote network. The devices in the remote network can be identified by the device classification module based, at least in part, on the device classification and one or more of Dynamic Host Configuration Protocol (DHCP) information for the remote network, port sequences used in Network Address Translation on the remote network, and a live Uniform Resource Locator (URL) check performed on the remote network.