# US 10,122,743 B2 · Methods and systems for detecting anomalous behavior of network-connected embedded devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,743 B2 - Document ID: US10122743B2 - Status: Granted - Kind: B2 - Application number: 15/333,084 - Filed: 2016-10-24 - Published: 2018-04-26 - Granted: 2018-11-06 - Earliest claimed: 2016-10-24 - Assignees: Senrio Inc. - Applicants: Senrio Inc. - Inventors: Stephen A. Ridley - Web page: https://patentgrep.com/patent/US10122743B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 41/16: using machine learning or artificial intelligence - H04L 43/062: related to network traffic - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 43/50: Testing arrangements - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04W 12/12: Detection or prevention of fraud - G06N 20/00: Machine learning - H04L 61/35: {involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function} - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A network sensor, inserted into a mirror port of a network switch or router, may be configured to monitor the network traffic originating from an embedded device. Metadata in the network traffic may be passively extracted by the network sensor and transmitted to a server in order to monitor and analyze the behavior of the embedded device. The server may employ machine learning to distinguish typical behavior of the embedded device from atypical behavior. Further, code may be injected into the firmware of the embedded device, and the code may be programmed to broadcast a performance beacon whenever certain firmware functions are executed. A collection of the performance beacons may be analyzed at the server to reconstruct an execution path of the embedded device, and machine learning may be applied to determine whether the execution path is typical or atypical. ## Claims ### Claim 1 A method for monitoring one or more embedded devices communicatively coupled to a first network, the method comprising: monitoring, by a first network sensor, network traffic on the first network; inspecting, by the first network sensor, the network traffic so as to distinguish network traffic that is associated with the embedded devices from network traffic that is associated with devices other than the embedded devices; transmitting, by the first network sensor, metadata from the network traffic associated with the embedded devices to a server; storing, at the server, the metadata in a first queue associated with the first network sensor; and for each of the embedded devices communicatively coupled to the first network, (i) building, by a machine learning module hosted on the server, a behavioral profile of the embedded device; (ii) monitoring, by a behavioral analysis module hosted on the server, a behavior of the embedded device; (iii) comparing, by the behavioral analysis module, the monitored behavior of the embedded device with a typical behavior of the embedded device as captured in the behavioral profile of the embedded device so as to determine whether the monitored behavior deviated from the typical behavior; and (iv) if the monitored behavior deviates from the typical behavior, notifying, by a notification module hosted on the server, a user that the monitored behavior of the embedded device deviated from the typical behavior of the embedded device. ### Claim 2 (depends on 1) The method of claim 1, wherein the monitoring of the network traffic by the first network sensor comprises the first network sensor monitoring the network traffic on the first network without the first network sensor transmitting any data onto the first network. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more embedded devices comprise one or more of a web-cam, point-of-sale devices, networked medical equipment, industrial control and supervisory control devices, networked embedded devices, or other Internet-of-Things (TOT) devices. ### Claim 4 (depends on 1) The method of claim 1, wherein the devices other than the embedded devices comprise personal computers (PCs), laptops, and servers. ### Claim 5 (depends on 1) The method of claim 1, wherein the network sensor is attached to a mirror port of a network switch or a router of the first network, wherein the mirror port comprises a switched port analyzer (SPAN) port, a remote switch port analyzer (RSPAN) or a roving analysis port (RAP). ### Claim 6 (depends on 1) The method of claim 1, wherein the network sensor comprises software installed on a network switch or router of the first network. ### Claim 7 (depends on 1) The method of claim 1, further comprising receiving feedback from the user that the monitored behavior that deviated from the typical behavior is actually normal, and retraining the behavioral profile based on the feedback from the user. ### Claim 8 (depends on 1) The method of claim 1, wherein the network sensor distinguishes the network traffic associated with the one or more embedded devices from the network traffic associated with the devices other than the embedded devices based on one or more of Internet protocol (IP) addresses of the network traffic or media access control (MAC) addresses of the network traffic. ### Claim 9 (depends on 1) The method of claim 1, wherein the network traffic comprises one or more transmission control protocol (TCP)/Internet protocol (IP) packets or user datagram protocol (UDP) packets, and wherein inspecting the network traffic comprises inspecting metadata of the TCP/IP data packets without inspecting a payload of the TCP/IP packets. ### Claim 10 (depends on 9) The method of claim 9, wherein the metadata of the TCP/IP packets comprises one or more of IP addresses, TCP/IP packet length, time stamps, sequence numbers, flags, destination IP addresses, source IP addresses, or media access control (MAC) addresses. ### Claim 11 (depends on 1) The method of claim 1, further comprising: if the monitored behavior deviates from the typical behavior, reporting, by the notification module to the user, the monitored behavior that deviated from the typical behavior. ### Claim 12 (depends on 1) The method of claim 1, wherein only metadata from the network traffic is transmitted from the network sensor to the server. ### Claim 13 (depends on 1) The method of claim 1, further comprising: transmitting performance beacons from a first one of the embedded devices to the server, wherein the transmission of the performance beacons is caused by an execution, by a processor of the first embedded device, of computer code that has been inserted into a plurality of functions that are present in firmware of the first embedded device. ### Claim 14 (depends on 13) The method of claim 13, wherein the performance beacons are relayed from the first embedded device to the server via the first network sensor. ### Claim 15 (depends on 13) The method of claim 13, wherein the performance beacons are transmitted from the first embedded device to the server without passing through the first network sensor. ### Claim 16 (depends on 13) The method of claim 13, wherein the performance beacons are transmitted through a network interface of the first embedded device onto the first network via a first broadcast address of the first network. ### Claim 17 (depends on 13) The method of claim 13, further comprising: reconstructing, by the server, an execution path of the first embedded device based on the performance beacons transmitted by the first embedded device; and comparing the reconstructed execution path of the first embedded device with a typical execution path of the first embedded device, wherein the typical execution path of the first embedded device is learned over time by the machine learning module. ### Claim 18 (depends on 13) The method of claim 13, wherein the performance beacons comprises one or more of a media access control (MAC) address of the first embedded device, a program counter value of the processor of the first embedded device, a tick count of the processor of the first embedded device, or a stack value of the processor of the first embedded device. ### Claim 19 A system for monitoring one or more embedded devices communicatively coupled to a first network, the system comprising: a network switch; a network sensor communicatively coupled to the network switch, the network sensor configured to: monitor network traffic on the first network; inspect the network traffic so as to distinguish network traffic that is associated with the embedded devices from network traffic that is associated with devices other than the embedded devices; and transmit metadata from the network traffic associated with the embedded devices to a server; and a server communicatively coupled to the network sensor, the server configured to: store the metadata in a first queue associated with the first network sensor; and for each of the embedded devices communicatively coupled to the first network, (i) build a behavioral profile of the embedded device; (ii) monitor a behavior of the embedded device; (iii) compare the monitored behavior of the embedded device with a typical behavior of the embedded device as captured in the behavioral profile of the embedded device so as to determine whether the monitored behavior deviated from the typical behavior; and (iv) if the monitored behavior deviates from the typical behavior, notify a user that the monitored behavior of the embedded device deviated from the typical behavior of the embedded device. ### Claim 20 (depends on 19) The system of claim 19, wherein the network sensor is inserted into a mirror port of the network switch, and wherein the mirror port comprises a switched port analyzer (SPAN) port, a remote switch port analyzer (RSPAN) or a roving analysis port (RAP).