Validating a device class claim using machine learning

Patent metadata

Field	Value
Publication number	US-11038893-B2
Application number	US-201715595016-A
Country	US
Kind code	B2
Filing date	May 15, 2017
Priority date	May 15, 2017
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

In one embodiment, a device in a network receives an access policy and a class behavioral model for a node in the network that are associated with a class asserted by the node. The device applies the access policy and class behavioral model to traffic associated with the node. The device identifies a deviation in a behavior of the node from the class behavioral model, based on the application of the class behavioral model to the traffic associated with the node. The device causes performance of a mitigation action in the network based on the identified deviation in the behavior of the node from the class behavioral model.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a device in a network, an access policy and a class behavioral model for a node in the network that are selected based on a class asserted by the node, wherein the class behavioral model is a machine learning-based traffic model that is trained using:
a) traffic data observed from one or more devices of the class asserted by the node that comprises legitimate traffic for the class asserted by the node, and
b) synthetic traffic data comprising training data that was not observed in the traffic data and formed based on the access policy associated with the class asserted by the node;

applying, by the device, the access policy and the class behavioral model to traffic associated with the node;
identifying, by the device, a deviation in a behavior of the node from the class behavioral model, based on the application of the class behavioral model to the traffic associated with the node; and
causing, by the device, performance of a mitigation action in the network based on the identified deviation in the behavior of the node from the class behavioral model.

2. The method as in claim 1 , wherein the mitigation action comprises one of: blocking at least a portion of the traffic associated with the node or generating an alert regarding the node.

3. The method as in claim 1 , wherein the access policy indicates a set of one or more endpoints with which the node is authorized to communicate.

4. The method as in claim 1 , wherein the device comprises at least one of: a router, a switch, a firewall, or a gateway in the network.

5. The method as in claim 1 , wherein the class asserted by the node is associated with a Manufacturer Usage Description (MUD) Universal Resource Identifier (URI) asserted by the node.

6. The method as in claim 5 , wherein the access policy is determined using data downloaded from the MUD URI.

7. A method comprising:
receiving, at a supervisory device in a network, data indicative of a class asserted by a node in the network;
identifying, by the supervisory device, an access policy associated with the class asserted by the node;
selecting, by the supervisory device, a class behavioral model associated with the class asserted by the node, wherein the class behavioral model is a machine learning-based traffic model that is trained using:
a) traffic data observed from one or more devices of the class asserted by the node that comprises legitimate traffic for the class asserted by the node, and
b) synthetic traffic data comprising training data that was not observed in the traffic data and formed based on the access policy associated with the class asserted by the node; and

causing, by the supervisory device, installation of the access policy and the class behavioral model to one or more networking devices in the network, wherein the one or more networking devices apply the access policy and the class behavioral model to traffic associated with the node, and wherein the one or more networking devices cause a mitigation action to be performed when a behavior of the node deviates from the class behavioral model.

8. The method as in claim 7 , wherein the supervisory device is an access control server, and wherein the device comprises at least one of: a router, a switch, a firewall, or a gateway in the network.

9. The method as in claim 7 , wherein the data indicative of the class asserted by the node comprises a Manufacturer Usage Description (MUD) Universal Resource Identifier (URI) asserted by the node.

10. The method as in claim 9 , further comprising:
downloading, by the supervisory device, data from the MUD URI to determine the access policy.

11. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive an access policy and a class behavioral model for a node in the network that are selected based on a class asserted by the node, wherein the class behavioral model is a machine learning-based traffic model that is trained using:
a) traffic data observed from one or more devices of the class asserted by the node that comprises legitimate traffic for the class asserted by the node, and
b) synthetic traffic data comprising training data that was not observed in the traffic data and formed based on the access policy associated with the class asserted by the node; and

apply the access policy and the class behavioral model to traffic associated with the node;
identify a deviation in a behavior of the node from the class behavioral model, based on the application of the class behavioral model to the traffic associated with the node; and
cause performance of a mitigation action in the network based on the identified deviation in the behavior of the node from the class behavioral model.

12. The apparatus as in claim 11 , wherein the mitigation action comprises one of: blocking at least a portion of the traffic associated with the node or generating an alert regarding the node.

13. The apparatus as in claim 11 , wherein the access policy indicates a set of one or more endpoints with which the node is authorized to communicate.

14. The apparatus as in claim 11 , wherein the device comprises at least one of: a router, a switch, a firewall, or a gateway in the network.

15. The apparatus as in claim 11 , wherein the class asserted by the node is associated with a Manufacturer Usage Description (MUD) Universal Resource Identifier (URI) asserted by the node.

16. The method as in claim 7 , wherein the mitigation action comprises one of: blocking at least a portion of the traffic associated with the node or generating an alert regarding the node.

17. The method as in claim 7 , wherein the access policy indicates a set of one or more endpoints with which the node is authorized to communicate.

18. The apparatus as in claim 15 , wherein the access policy is determined using data downloaded from the MUD URI.

Assignees

• Cisco Tech Inc

Inventors

• Weis Brian E
• Anderson Blake Harrell
• Shah Rashmikant B
• Mcgrew David

Classifications

• G06N20/00 Primary

  Machine learning · CPC title

• H04L63/104 Primary

  Grouping of entities · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title