[Q3 2026] Anomaly Intelligence

Fingerbank’s existing fingerprinting engine establishes a device identity profile by inferring characteristics such as vendor, model, operating system, firmware, and other passively observable signals. Traditionally, this capability has focused on answering the question, “What type of device is present on the network?” through device fingerprinting and identification. While accurate device identification is fundamental to effective network visibility, it does not, by itself, provide sufficient insight into the device’s security posture or runtime behavior.

Fingerbank’s Anomaly Intelligence extends this identity layer by addressing a complementary security question: “Does the observed behavior of the device indicate anomalous or potentially malicious activity?” Building upon the device fingerprints generated by the existing detection engine, Anomaly Intelligence augments device identity with threat, vulnerability, and contextual security signals. It incorporates complementary capabilities, including Vulnerability Intelligence, Threat Detection, and Domain Generation Algorithm (DGA) Detection, enabling the identification of security and behavioral anomalies associated with fingerprinted devices without requiring a separate device identification process.

These capabilities are designed to be complementary rather than interchangeable, with each addressing a distinct analytical dimension. Vulnerability Intelligence and Threat Detection leverage external security knowledge, known-vulnerability databases, and threat intelligence to identify potentially exploitable conditions and malicious activity. In contrast, DGA Detection focuses on learning and modeling the structural characteristics of domain names to identify algorithmically generated domains that may be associated with command-and-control (CNC) infrastructure or other malicious activities. Anomaly Intelligence can further incorporate historically learned behavioral patterns and contextual information to assess whether a device’s observed activity is consistent with established intelligence and expected behavior.

For example, a device may be correctly identified as a legitimate IP camera while simultaneously running compromised firmware, exhibiting behavior associated with a known vulnerability, communicating with command-and-control infrastructure, or generating and querying algorithmically generated domains. Device identification alone would not necessarily reveal these security conditions. By augmenting device fingerprints with behavioral, threat, vulnerability, and contextual signals, Anomaly Intelligence enables security analysts to move beyond static device identification toward continuous assessment of device behavior and the detection of potentially compromised or anomalous network activity.

1. Vulnerability Intelligence

Following device fingerprinting, each identified device is enriched with vulnerability intelligence by correlating its inferred manufacturer, model, operating system, firmware, and related software components with the NIST National Vulnerability Database (NVD) and associated CVE records. This process transforms a network-level device fingerprint into an identity-linked security profile by determining whether known vulnerabilities are potentially applicable to the observed device.

The correlation process can leverage multiple identification attributes, including device model, product family, firmware version, software version, and, where available, Common Platform Enumeration (CPE) identifiers. When a reliable match is established, the system retrieves the corresponding CVE identifier, affected product/version information, CVSS severity, and vulnerability metadata. This enables vulnerabilities to be associated directly with an observed network device rather than being reported only as generic product-level advisories.

"CVSS Version": {
            "V2.0": {
              "Base Score": 7.7,
              "Severity level": "HIGH"
            },
            "V3.1": {
              "Base Score": 8,
              "Severity level": "HIGH"
            },
            "V4.0": {
              "Base Score": 7.3,
              "Severity level": "HIGH"
            }

Because network fingerprinting may not always reveal the exact firmware version, vulnerability matching should be confidence-aware. A distinction can therefore be made between an exact version match, a strong model-level match, and a potential match where insufficient information is available to conclusively determine vulnerability applicability. This reduces false associations and prevents generic product matches from being interpreted as confirmed vulnerabilities.

The resulting vulnerability information can then be combined with the behavioral security signals described in subsequent sections. For instance, a fingerprinted device with an applicable vulnerability that simultaneously exhibits anomalous DNS activity, suspicious external communication, scanning behavior, or other abnormal network patterns represents a substantially richer security signal than either observation alone.

Accordingly, the proposed framework establishes the following relationship:

Network Fingerprint → Device Identity → Vulnerability Correlation → CVE/CVSS Intelligence

This identity-linked approach enables the system to move beyond generic vulnerability enumeration toward device-level vulnerability intelligence, providing contextual security information that can support subsequent risk assessment, anomaly detection, threat correlation, and automated security analysis.

2. Threat Detection

Based on network connection information transmitted by fingerprinted devices, Fingerbank analyzes their communications with external hosts to identify destinations associated with malware, command-and-control (CNC), and cryptocurrency-mining activities. Each connection generated by an identified device is systematically evaluated against these threat-intelligence categories.

When a destination matches a known threat indicator, the associated device and connection can be linked to the corresponding threat category, providing an identity-aware view of potentially malicious network activity. This approach enables Fingerbank to complement device identification with actionable threat intelligence, facilitating the detection and investigation of suspicious communications at the device level.

3. DGA Detection

Botnets and malware families frequently use Domain Generation Algorithms (DGAs) to automatically and dynamically generate large numbers of domain names for communication with command-and-control (CNC) infrastructure. These domains often exhibit characteristics such as random-looking character sequences, unusual lexical patterns, and low semantic similarity to legitimate domain names. Because DGA-generated domains can change rapidly, conventional blocklist-based approaches may be ineffective against previously unseen domains.

To address this limitation, Fingerbank employs a neural-network-based DGA detection model trained on millions of labeled domain names. The model analyzes the structural and linguistic characteristics of observed domains and produces a prediction indicating whether a domain is likely to be DGA-generated. This approach enables Fingerbank to identify previously unseen or rapidly changing suspicious domains, complementing conventional threat-intelligence methods that rely on known malicious domain lists.

Available now: Anomaly Intelligence Integration

The Anomaly Intelligence layer is being integrated into the Fingerbank device detection engine as an additional intelligence layer for identified network devices. Existing Fingerbank deployments can adopt these capabilities without modifying the current device fingerprint collection process, as the new security signals are derived from the same network-level observations already used for device identification. These enhanced intelligence capabilities are exposed through the Fingerbank API, alongside the existing device identification attributes, as additive API fields. This approach preserves compatibility with existing integrations while eliminating the need for schema migration or changes to the underlying fingerprint collection infrastructure.

Access to the new capabilities can be managed through dedicated customer roles and permissions, allowing organizations to control which users or applications can consume the additional intelligence signals. This architecture enables the gradual adoption of anomaly and security intelligence while maintaining compatibility with existing Fingerbank deployments and workflows.