IoT device identification by machine learning with time series behavioral and statistical features

Patent metadata

Field	Value
Publication number	US-12301600-B2
Application number	US-202217578293-A
Country	US
Kind code	B2
Filing date	Jan 18, 2022
Priority date	Jan 18, 2022
Publication date	May 13, 2025
Grant date	May 13, 2025

Abstract

Identifying Internet of Things (IoT) devices with packet flow behavior including by using machine learning models is disclosed. Information associated with a network communication of an IoT device is received. A determination of whether the IoT device has previously been classified is made. In response to determining that the IoT device has not previously been classified, a determination is made that a probability match for the IoT device against a behavior signature exceeds a threshold. The behavior signature includes at least one time series feature for an application used by the IoT device. Based at least in part on the probability match, a classification of the IoT device is provided to a security appliance configured to apply a policy to the IoT device.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
receive information associated with a network communication of an Internet of Things (IOT) device;
determine whether the IoT device has previously been classified;
in response to determining that the IoT device has not previously been classified, determine that a probability match for the IoT device against a behavior signature exceeds a threshold, wherein the behavior signature includes at least a first time series feature for an application used by the IoT device, and wherein the first time series feature for the application used by the IoT device comprises at least one of: (1) a bucket count feature for the application used by the IoT device, or (2) a session activity statistic feature for the application used by the IoT device; and
based at least in part on the probability match, provide a classification of the IoT device to a security appliance configured to apply a policy to the IoT device; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the processor is further configured to use at least a portion of the received information to generate a vector that bucketizes usage of the application by the IoT device.

3. The system of claim 2 , wherein the processor is further configured to use the vector to generate a set of time series statistical features of the usage of the application by the IoT device.

4. The system of claim 3 , wherein the set of time series statistical features includes a maximum usage of the application across a plurality of time buckets.

5. The system of claim 3 , wherein the set of time series statistical features includes a minimum usage of the application across a plurality of time buckets.

6. The system of claim 3 , wherein the set of time series statistical features includes a count of a number of non-zero buckets corresponding to times during which the application was used.

7. The system of claim 3 , wherein the set of time series statistical features includes a sum of usage of the application across a plurality of time buckets.

8. The system of claim 3 , wherein the set of time series statistical features includes a mean of usage of the application across a plurality of time buckets.

9. The system of claim 3 , wherein the set of time series statistical features includes a variance of usage of the application across a plurality of time buckets.

10. The system of claim 3 , wherein the set of time series statistical features includes a median of usage of the application across a plurality of time buckets.

11. The system of claim 3 , wherein the set of time series statistical features includes a kurtosis of usage of the application across a plurality of time buckets.

12. The system of claim 3 , wherein the set of time series statistical features includes a skewness of usage of the application across a plurality of time buckets.

13. The system of claim 3 , wherein the set of time series statistical features includes a quantile of usage of the application across a plurality of time buckets.

14. The system of claim 1 , wherein an organizationally unique identifier (OUI) for the IoT device is not available.

15. The system of claim 1 , wherein an QUI for the IoT device corresponds to a network card and wherein the IoT device is not a network card.

16. The system of claim 1 , wherein an OUI for the IoT device corresponds to a network appliance and wherein the IoT device is not a network appliance.

17. The system of claim 1 , wherein at least a portion of the network communication is encrypted.

18. The system of claim 1 , wherein the behavior signature comprises a set of coefficients.

19. The system of claim 1 , wherein the behavior signature is generated at least in part by using a machine learning model trained on features extracted from exemplary IoT devices of a particular type.

20. The system of claim 1 , wherein determining that the probability match exceeds the threshold includes determining that a plurality of signatures are matched above respective thresholds, and selecting a highest ranking match as a result.

21. A method, comprising:
receiving information associated with a network communication of an Internet of Things (IoT) device;
determining whether the IoT device has previously been classified;
in response to determining that the IoT device has not previously been classified, determining that a probability match for the IoT device against a behavior signature exceeds a threshold, wherein the behavior signature includes at least a first time series feature for an application used by the IOT device, and wherein the first time series feature for the application used by the IoT device comprises at least one of: (1) a bucket count feature for the application used by the IoT device, or (2) a session activity statistic feature for the application used by the IoT device; and
based at least in part on the probability match, providing a classification of the IOT device to a security appliance configured to apply a policy to the IoT device.

22. The method of claim 21 , further comprising using at least a portion of the received information to generate a vector that bucketizes usage of the application by the IoT device.

23. The method of claim 22 , further comprising using the vector to generate a set of time series statistical features of the usage of the application by the IoT device.

24. The method of claim 23 , wherein the set of time series statistical features includes a maximum usage of the application across a plurality of time buckets.

25. The method of claim 23 , wherein the set of time series statistical features includes a minimum usage of the application across a plurality of time buckets.

26. The method of claim 23 , wherein the set of time series statistical features includes a count of a number of non-zero buckets corresponding to times during which the application was used.

27. The method of claim 23 , wherein the set of time series statistical features includes a sum of usage of the application across a plurality of time buckets.

28. The method of claim 23 , wherein the set of time series statistical features includes a mean of usage of the application across a plurality of time buckets.

29. The method of claim 23 , wherein the set of time series statistical features includes a variance of usage of the application across a plurality of time buckets.

30. The method of claim 23 , wherein the set of time series statistical features includes a median of usage of the application across a plurality of time buckets.

31. The method of claim 23 , wherein the set of time series statistical features includes a kurtosis of usage of the application across a plurality of time buckets.

32. The method of claim 23 , wherein the set of time series statistical features includes a skewness of usage of the application across a plurality of time buckets.

33. The method of claim 23 , wherein the set of time series statistical features includes a quantile of usage of the application across a plurality of time buckets.

34. The method of claim 21 , wherein an organizationally unique identifier (OUI) for the IoT device is not available.

35. The method

Assignees

• Palo Alto Networks Inc

Inventors

• Tian Ke
• Zhao Yilin
• Duan Xiaoyi
• Du Jun

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06N20/00

  Machine learning · CPC title