Packet analysis based IoT management

A system comprising:

• a mirror port provided in a local area network including an Internet of things (IoT) device and configured to mirror data packets transmitted to and from the IoT device;
• one or more first processors provided in an IoT device management engine;
• first memory storing first instructions, when executed by the one or more first processors, configured to cause the one or more first processors to:
• obtain the mirrored data packets from the mirror port;
• analyze at least one of the mirrored data packets using deep packet inspection to identify transaction data from payload of the at least one of the mirrored data packets;
• generate an event log for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device;
• update the event log in real-time to indicate current operation of the IoT device;
• one or more second processors provided in an IoT device profiling system in a cloud that is outside of the local area network;
• second memory storing second instructions, when executed by the one or more second processors, configured to cause the one or more second processors to:
• profile the IoT device into a device profile based on the historical record for the IoT device;
• determine baseline behavior of the IoT device from historical records of a plurality of IoT devices including the historical record for the IoT device;
• receive the event log updated in real-time from the IoT device management system through a virtual private network tunnel;
• determine abnormal device behavior of the IoT device using the event log received from the IoT device management system and the baseline behavior;
• update the device profile to indicate the abnormal device behavior of the IoT device.