Automated Multivendor Network Topology Discovery and Shadow IT Detection Using Asynchronous Hybrid Polling and Graph-Based Anomaly Analysis

The rapid growth of corporate networks and the wide use of “Bring Your Own Device” (BYOD) policies have made these networks harder to secure and manage. One visible consequence is the spread of unauthorized, unmanaged switches and wireless routers. Network Management Systems (NMSs) differ in their polling, topology discovery, and multivendor capabilities. This paper presents an automated framework for multivendor network topology discovery and Shadow IT detection, together with a topological mapping architecture based on concurrent routines written in the Go programming language. The contribution lies in the integration and operational evaluation of established techniques on a heterogeneous campus network rather than in new individual algorithms. A hybrid asynchronous scanning algorithm combining the Internet Control Message Protocol (ICMP), Simple Network Management Protocol (SNMP), Link Layer Discovery Protocol (LLDP), and Address Resolution Protocol (ARP) is used to overlap discovery-stage response waits. We use graph-theoretic models and a heuristic “Health Score” function to classify network anomalies such as loopbacks, Spanning Tree Protocol (STP) conflicts, and unauthorized devices. Virtualization-prefix and cached ESXi-signature checks exclude candidate ports associated with virtualization; Time-To-Live (TTL) values separately estimate the operating system (OS) family. Experiments conducted on a live university campus network showed that the 100-worker asynchronous pool achieved a 94.9-fold discovery-stage speedup over sequential polling. In a replay of a recent forwarding database (FDB) snapshot, the virtualization checks reduced the number of candidate ports with multiple media access control (MAC) addresses from 96 to 72. Detection accuracy against independent labels remains to be evaluated. The framework was further evaluated through a fixed 24-h monitoring window and a functional comparison with established network management platforms. The results demonstrate faster discovery on the evaluated campus network; detection accuracy, resource overhead, and generalization require further validation.