IoT device discovery and identification

Patent metadata

Field	Value
Publication number	US-11722875-B2
Application number	US-202117381103-A
Country	US
Kind code	B2
Filing date	Jul 20, 2021
Priority date	Jun 1, 2020
Publication date	Aug 8, 2023
Grant date	Aug 8, 2023

Abstract

Techniques for performing Internet of Things (IoT) device identification are disclosed. Information associated with a network communication of an IoT device is received. A determination of one or more confidence scores that represent how well the received information matches respective one or more network behavior pattern identifiers is made. A determination is made that each one of the one or more determined confidence scores is below a threshold. In response to determining that each of the one or more determined confidence scores is below the threshold, a two-part classification process is performed, where a first portion includes an inline classification, and a second portion includes a subsequent verification of the inline classification. A result of the classification process is provided to a security appliance configured to apply a policy to the IoT device.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
receive information associated with a network communication of an IoT device;
determine one or more confidence scores that represent how well the received information matches respective one or more network behavior pattern identifiers;
determine that each of the one or more determined confidence scores is below a threshold;
in response to determining that each of the one or more determined confidence scores is below the threshold, perform a two-part classification process, wherein a first portion of the classification process comprises an inline classification, and wherein a second portion of the classification process comprises a subsequent verification of the inline classification; and
provide a result of the classification process to a security appliance configured to apply a policy to the IoT device; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the information is received from a data appliance configured to monitor the IoT device.

3. The system of claim 1 , wherein the received information includes network traffic metadata.

4. The system of claim 1 , wherein the first portion of the classification process comprises a rule-based classification.

5. The system of claim 1 , wherein the second portion of the classification process comprises a machine learning-based classification.

6. The system of claim 1 , wherein performing the classification process includes determining whether any features for the IoT device are dominant.

7. The system of claim 1 , wherein the processor is further configured to generate at least one of the network behavior pattern identifiers.

8. The system of claim 1 , wherein the result of the classification process comprises a group classification.

9. The system of claim 1 , wherein the result of the classification process comprises a profile classification.

10. A method, comprising:
receiving information associated with a network communication of an IoT device;
determining one or more confidence scores that represent how well the received information matches respective one or more network behavior pattern identifiers;
determining that each of the one or more determined confidence scores is below a threshold;
in response to determining that each of the one or more determined confidence scores is below the threshold, performing a two-part classification process, wherein a first portion of the classification process comprises an inline classification, and wherein a second portion of the classification process comprises a subsequent verification of the inline classification; and
providing a result of the classification process to a security appliance configured to apply a policy to the IoT device.

11. The method of claim 10 , wherein the information is received from a data appliance configured to monitor the IoT device.

12. The method of claim 10 , wherein the received information includes network traffic metadata.

13. The method of claim 10 , wherein the first portion of the classification process comprises a rule-based classification.

14. The method of claim 10 , wherein the second portion of the classification process comprises a machine learning-based classification.

15. The method of claim 10 , wherein performing the classification process includes determining whether any features for the IoT device are dominant.

16. The method of claim 10 , further comprising generating at least one of the network behavior pattern identifiers.

17. The method of claim 10 , wherein the result of the classification process comprises a group classification.

18. The method of claim 10 , wherein the result of the classification process comprises a profile classification.

19. A computer program product embodied in a tangible computer readable storage medium and comprising computer instructions for:
receiving information associated with a network communication of an IoT device;
determining one or more confidence scores that represent how well the received information matches respective one or more network behavior pattern identifiers;
determining that each of the one or more determined confidence scores is below a threshold;
in response to determining that each of the one or more determined confidence scores is below the threshold, performing a two-part classification process, wherein a first portion of the classification process comprises an inline classification, and wherein a second portion of the classification process comprises a subsequent verification of the inline classification; and
providing a result of the classification process to a security appliance configured to apply a policy to the IoT device.

20. The computer program product of claim 19 , wherein the information is received from a data appliance configured to monitor the IoT device.

21. The computer program product of claim 19 , wherein the received information includes network traffic metadata.

22. The computer program product of claim 19 , wherein the first portion of the classification process comprises a rule-based classification.

23. The computer program product of claim 19 , wherein the second portion of the classification process comprises a machine learning-based classification.

24. The computer program product of claim 19 , wherein performing the classification process includes determining whether any features for the IoT device are dominant.

25. The computer program product of claim 19 , wherein the computer readable storage medium further comprises computer instructions for generating at least one of the network behavior pattern identifiers.

26. The computer program product of claim 19 , wherein the result of the classification process comprises a group classification.

27. The computer program product of claim 19 , wherein the result of the classification process comprises a profile classification.

Assignees

• Palo Alto Networks Inc

Inventors

• Du Jun
• Zhao Yilin

Classifications

• H04W8/005 Primary

  Discovery of network devices, e.g. terminals · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04W8/183

  Processing at user equipment or user record carrier · CPC title