Method for protecting IoT devices from intrusions by performing statistical analysis
AssigneeGryphon Online Safety, Inc.
InventorsArindam Das, Arup Bhattacharya, John J. Wu
Life of this patent
Estimating the term…
Abstract
Various embodiments provide an approach to detect intrusion of connected IoT devices. In operation, features associated with behavioral attributes as well as volumetric attributes of network data patterns of different IoT devices is analyzed by means of statistical analysis to determine deviation from normal operation data traffic patterns to detect anomalous operations and possible intrusions. Data from multiple networks and devices is combined in the cloud to provide for improved base models for statistical analysis.
Claims22
A method for protecting from intrusion an IoT device connected via a router to a network comprising a server, the method performed in the router comprising the steps of:
- obtaining reference traffic pattern data for said IoT device operating in a normal operating mode;
- collecting operating traffic pattern data for said IoT device;
- determining a statistical deviation between said reference traffic pattern data and said operating traffic pattern data by performing a statistical analysis;
- selecting a predetermined threshold value of said statistical deviation;
- comparing said statistical deviation with said predetermined threshold value to determine whether said statistical deviation is greater than said predetermined threshold;
- flagging abnormal activity responsive to a determination that said statistical deviation is greater than said predetermined threshold value.
A method performed by a router to identify intrusion of an IoT device comprising the steps of:
- choosing a time duration;
- choosing a preset reference ratio;
- initializing a step counter;
- initializing an abnormality counter;
- selecting a predetermined threshold value of statistical deviation;
- repeating the following steps for said time duration:
- obtaining reference traffic pattern data for an IoT device operating in a normal operating mode;
- collecting operating traffic pattern data for said IoT device;
- determining a statistical deviation between said reference traffic pattern data and said operating traffic pattern data by performing a statistical analysis;
- comparing said statistical deviation with said predetermined threshold value of statistical deviation to determine whether said statistical deviation is greater than said predetermined threshold;
- flagging abnormal activity responsive to a determination that said statistical deviation is greater than said predetermined threshold value;
- incrementing an abnormality counter responsive to a determination that said statistical deviation is greater than said predetermined threshold value;
- incrementing said step counter;
- determining a decision ratio between said abnormality counter and said step counter;
- comparing said decision ratio with said preset reference ratio;
- and
- providing an intrusion warning if said decision ratio exceeds said preset reference ratio.
Dependencies are inferred from the claim text.