Self-training classification

Patent metadata

Field	Value
Publication number	US-12267335-B2
Application number	US-202418443098-A
Country	US
Kind code	B2
Filing date	Feb 15, 2024
Priority date	Jun 29, 2018
Publication date	Apr 1, 2025
Grant date	Apr 1, 2025

Abstract

Systems, methods, and related technologies for classification are described. In certain aspects, a plurality of device classification methods with associated models are accessed. Each of the classification methods have an associated reliability level. The models of classification methods with a higher reliability level than other classifications methods are used to at least one of train or tune the models associated with lower reliability level.

First claim

What is claimed is:

1. A method comprising:
accessing a plurality of device classification methods, wherein each of the plurality of methods has a respective associated model, and wherein each of the plurality of methods has a respective associated reliability level in classifying a device type or a device model of a plurality of devices communicatively coupled to a network;
generating, by a processing device, a respective data set associated with each of the device classification methods based on classifying the device type or the device model of the plurality of devices communicatively coupled to the network; and
selecting a first device classification method and a second device classification method of the plurality of device classification methods, wherein the first device classification method has a higher reliability level than the second device classification method.

2. The method of claim 1 , further comprising:
determining a tuning data set using a respective data set associated with the first device classification method; and
tuning the second device classification method model using the tuning data set.

3. The method of claim 2 , further comprising storing the tuned second device classification model.

4. The method of claim 1 , further comprising:
performing an initial classification of the plurality of devices communicatively coupled to the network; and
determining which of the plurality of device classification methods can be used based on the initial classification of the plurality of devices communicatively coupled to the network.

5. The method of claim 1 , further comprising:
performing classification using the second device classification method.

6. The method of claim 2 , wherein the tuning of the second device classification method model using the tuning data set is performed on a per device basis.

7. The method of claim 1 , wherein each respective model associated with the plurality of device classification methods is a machine learning model.

8. The method of claim 1 , wherein the respective associated reliability level associated with the plurality of device classification methods is configurable.

9. The method of claim 1 , wherein the respective associated reliability level associated with a device classification method is automatically adjusted based on one or more classification results based on the device classification method.

10. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access a plurality of device classification methods, wherein each of the plurality of methods has a respective associated model, and wherein each of the plurality of methods has a respective associated reliability level in classifying a device type or a device model of a plurality of devices communicatively coupled to a network;
generate a respective data set associated with each of the device classification methods based on classifying the device type or the device model of the plurality of devices communicatively coupled to the network; and
select a first device classification method and a second device classification method of the plurality of device classification methods, wherein the first device classification method has a higher reliability level than the second device classification method.

11. The system of claim 10 , wherein the processing device further to:
determine a turning data set using a respective data set associated with the first device classification method; and
tune the second device classification method model using the tuning data set.

12. The system of claim 11 , wherein the processing device further to store the tuned second device classification model.

13. The system of claim 10 , wherein the processing device further to:
perform an initial classification of the plurality of devices communicatively coupled to the network; and
determine which of the plurality of device classification methods can be used based on the initial classification of the plurality of devices communicatively coupled to the network.

14. The system of claim 10 , wherein the processing device further to:
perform classification using the second device classification method.

15. The system of claim 11 , wherein the tuning of the second device classification method model using the tuning data set is performed on a per device basis.

16. The system of claim 10 , wherein each respective model associated with the plurality of device classification methods is a machine learning model.

17. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
determine which of a plurality of device classification methods can be used based on an initial classification of a device type or a device model of a plurality of devices communicatively coupled to the network; and
generate, by the processing device, a respective data set associated with each of a plurality of device classification methods based on classifying the device type or the device model of the plurality of devices communicatively coupled to a network, wherein each of the plurality of methods has a respective associated model, and wherein each of the plurality of methods has a respective associated reliability level in classifying the device type or the device model of the plurality of devices.

18. The non-transitory computer readable medium of claim 17 , wherein the processing device further to:
determine a tuning data set using one of the respective data sets associated with a first device classification method of the plurality of the methods; and
tune a second device classification method model using the tuning data set, wherein the first device classification method has a higher reliability level than the second device classification method.

19. The non-transitory computer readable medium of claim 18 , wherein to tune the second device classification method model using the tuning data set is performed on a per device basis.

20. The non-transitory computer readable medium of claim 17 , wherein the first device classification method and the second device classification method of the plurality of device classification methods are selected based on a network environment.

Assignees

• Forescout Tech Inc

Inventors

• Yang Siying
• Zhang Yang

Classifications

• G06F18/24

  Classification techniques · CPC title

• H04L43/10

  Active monitoring, e.g. heartbeat, ping or trace-route · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L41/0853

  by actively collecting configuration information or by backing up configuration information · CPC title

• G06N20/00

  Machine learning · CPC title