# US 10,122,745 B2 · Heuristics-based identification of IoT (internet of things) attacks in Wi-fi > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,745 B2 - Document ID: US10122745B2 - Status: Granted - Kind: B2 - Application number: 15/396,632 - Filed: 2016-12-31 - Published: 2018-07-05 - Granted: 2018-11-06 - Earliest claimed: 2016-12-31 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc. - Inventors: Anil Kaushik - Web page: https://patentgrep.com/patent/US10122745B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Attacks from IoT (Internet of Things) devices (or other statins) on a Wi-Fi network are identified using heuristics. Frames are detected from an IoT device (or conventional station) over a window of time. The frame is processed to expose IoT application data from the frame over the time window. Deviations are identified in the IoT application data to detect malicious activity from the IoT device by comparing the IoT application data from at least a first time and a second time within the time. Responsive to the IoT data comparison detecting a malicious activity from the IoT device, a network security action is performed in reference to the IoT device, the network security action to prevent the malicious activity. ## Claims ### Claim 1 A computer-implemented method, in an access point of a data communication network, for heuristics-based identification of IoT (Internet of Things) attacks in wireless communication from data, the method comprising the steps of: transmitting beacons for setting-up a wireless communication connection with an IoT device utilizing a BSSID (Basic Service Set Identifier); wherein the IoT device comprises a non-computerized physical device that is retrofitted for a network presence; detecting wireless communication frames transmitted from the IoT device to the access point over a window of time; applying a heuristic analysis to identify whether the IoT device is malicious by: processing the wireless communication frames to expose IoT application data from the wireless communication frame over the time window in conjunction with a wireless communication controller having network-wide visibility of the IoT device interactions from at least one other access point; identifying deviations in the IoT application data to detect malicious activity from the IoT device by comparing the IoT application data from at least a first time and a second time within the time window at least partially based on the network-wide visibility of the IoT device interactions from the at least one other access point; and responsive to the IoT application data comparison detecting a malicious activity from the IoT device, performing a network security action in reference to the IoT device, the network security action to prevent the malicious activity. ### Claim 2 (depends on 1) The method of claim 1, further comprising: comparing the IoT application data to a range of expected IoT application data. ### Claim 3 (depends on 1) The method of claim 1, further comprises: receiving input from the wireless communication controller for the deviation identification. ### Claim 4 (depends on 1) The method of claim 1, wherein the IoT device is indirectly connected to a network with a passive RF tag. ### Claim 5 (depends on 1) The method of claim 1, wherein the IoT device comprises a conventional computer networking device. ### Claim 6 (depends on 1) The method of claim 1, wherein the malicious activity sent from the IoT device is being sent outside of a local access network. ### Claim 7 A non-transitory computer-readable medium storing source code that, when executed by a processor, performs a method in an access point of a data communication network, for heuristics-based identification of IoT attacks in wireless communication from data, the method comprising the steps of: transmitting beacons for setting-up a wireless communication connection with an IoT device utilizing a BSSID (Basic Service Set Identifier); wherein the IoT device comprises a non-computerized physical device that is retrofitted for a network presence; detecting wireless communication frames transmitted from the IoT device to the access point over a window of time; applying a heuristic analysis to identify whether the IoT device is malicious by: processing the wireless communication frames to expose IoT application data from the wireless communication frame over the time window in conjunction with a wireless communication controller having network-wide visibility of the IoT device interactions from at least one other access point; identifying deviations in the IoT application data to detect malicious activity from the IoT device by comparing the IoT application data from at least a first time and a second time within the time window at least partially based on the network-wide visibility of the IoT device interactions from the at least one other access point; and responsive to the IoT application data comparison detecting a malicious activity from the IoT device, performing a network security action in reference to the IoT device, the network security action to prevent the malicious activity.