Name based internet of things (IoT) data discovery

Patent metadata

Field	Value
Publication number	US-10735370-B1
Application number	US-201916288869-A
Country	US
Kind code	B1
Filing date	Feb 28, 2019
Priority date	Feb 28, 2019
Publication date	Aug 4, 2020
Grant date	Aug 4, 2020

Abstract

Name based Internet of Things (IoT) discovery includes receiving domain name system (DNS) events. An Internet Protocol (IP) address to name mapping is built based on the DNS events. A data communication event occurring in a computer network is received. A destination IP address in the data communication event is mapped to a domain name by querying the IP address to name mapping. Whether the data communication event is associated with an IoT device is determined based on the domain name satisfying a rule.

First claim

What is claimed is:

1. A method executed by at least one hardware processor, the method comprising:
receiving domain name system (DNS) events;
building an Internet Protocol (IP) address to name mapping based on the DNS events;
receiving a data communication event occurring in a computer network;
mapping a destination IP address in the data communication event to a domain name by querying the IP address to name mapping; and
determining whether the data communication event is associated with an IoT device based on the domain name satisfying a rule.

2. The method of claim 1 , wherein the determining whether the data communication event is associated with an IoT device, comprises determining whether a source of the data communication event is an IoT device based on the domain name satisfying a rule.

3. The method of claim 1 , wherein the determining whether the data communication event is associated with an IoT device, comprises determining whether the data communication event is an IoT data traffic based on the domain name satisfying a rule.

4. The method of claim 1 , further comprising building a database of domain names, which IoT devices visit, and the rule comprises finding the domain name match in the database of domain names.

5. The method of claim 1 , further comprising building a model comprising values associated with sites, which IoT devices visit, and the rule comprises matching profile data associated with the data communication event to the model.

6. The method of claim 5 , wherein the matching of the profile data associated with the data communication event to the model further classifies the IoT device as device type, device manufacturer, device model, operating system, and application.

7. The method of claim 1 , wherein the data communication event comprises a hypertext transfer protocol (HTTP) event.

8. The method of claim 1 , wherein the data communication event comprises a Secure Sockets Layer (SSL) event.

9. A computer readable storage medium storing a program of instructions executable by a machine to perform a method comprising:
receiving domain name system (DNS) events;
building an Internet Protocol (IP) address to name mapping based on the DNS events;
receiving a data communication event occurring in a computer network;
mapping a destination IP address in the data communication event to a domain name by querying the IP address to name mapping; and
determining whether the data communication event is associated with an IoT device based on the domain name satisfying a rule.

10. The computer readable storage medium of claim 9 , wherein the determining whether the data communication event is associated with an IoT device, comprises determining whether a source of the data communication event is an IoT device based on the domain name satisfying a rule.

11. The computer readable storage medium of claim 9 , wherein the determining whether the data communication event is associated with an IoT device, comprises determining whether the data communication event is an IoT data traffic based on the domain name satisfying a rule.

12. The computer readable storage medium of claim 9 , further comprising building a database of domain names, which IoT devices visit, and the rule comprises finding the domain name match in the database of domain names.

13. The computer readable storage medium of claim 9 , further comprising building a model comprising values associated with sites, which IoT devices visit, and the rule comprises matching profile data associated with the data communication event to the model.

14. The computer readable storage medium of claim 13 , wherein the matching of the profile data associated with the data communication event to the model further classifies the IoT device as device type, device manufacturer, device model, operating system, and application.

15. The computer readable storage medium of claim 9 , wherein the data communication event comprises a hypertext transfer protocol (HTTP) event.

16. The computer readable storage medium of claim 9 , wherein the data communication event comprises a Secure Sockets Layer (SSL) event.

17. A system comprising:
a hardware processor coupled with a memory device, the hardware processor configured to at least:
receive domain name system (DNS) events;
build an Internet Protocol (IP) address to name mapping based on the DNS events;
receive a data communication event occurring in a computer network;
map a destination IP address in the data communication event to a domain name by querying the IP address to name mapping; and
determine whether the data communication event is associated with an IoT device based on the domain name satisfying a rule.

18. The system of claim 17 , wherein the hardware processor determines whether a source of the data communication event is an IoT device based on the domain name satisfying a rule.

19. The system of claim 17 , further comprising a database storing domain names, which IoT devices visit, and the rule comprises finding the domain name match in the database storing domain names.

20. The system of claim 17 , further comprising an in-memory model comprising values associated with sites, which IoT devices visit, and the rule comprises matching profile data associated with the data communication event to the model.

Assignees

• IBM

Inventors

• Kandlur Dilip Dinkar
• Freimuth Douglas M
• Le Thai Franck
• Nahum Erich
• Ortiz Jorge Jose

Classifications

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• H04L61/4541

  Directories for service discovery · CPC title

• H04L67/12 Primary

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• H04L67/303

  Terminal profiles · CPC title