# US 10,771,487 B2 · Method for protecting IoT devices from intrusions by performing statistical analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,487 B2 - Document ID: US10771487B2 - Status: Granted - Kind: B2 - Application number: 15/839,766 - Filed: 2017-12-12 - Published: 2019-06-13 - Granted: 2020-09-08 - Earliest claimed: 2016-12-12 - Assignees: Gryphon Online Safety, Inc. - Applicants: Gryphon Online Safety, Inc. - Inventors: Arindam Das; Arup Bhattacharya; John J. Wu - Web page: https://patentgrep.com/patent/US10771487B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 5/046: Forward inferencing; Production systems - H04L 63/10: {for controlling access to devices or network resources} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - G06N 3/045: Combinations of networks - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 2463/144: Detection or countermeasures against botnets - H04W 12/088: using filters or firewalls - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Various embodiments provide an approach to detect intrusion of connected IoT devices. In operation, features associated with behavioral attributes as well as volumetric attributes of network data patterns of different IoT devices is analyzed by means of statistical analysis to determine deviation from normal operation data traffic patterns to detect anomalous operations and possible intrusions. Data from multiple networks and devices is combined in the cloud to provide for improved base models for statistical analysis. ## Claims ### Claim 1 A method for protecting from intrusion an IoT device connected via a router to a network comprising a server, the method performed in the router comprising the steps of: obtaining reference traffic pattern data for said IoT device operating in a normal operating mode; collecting operating traffic pattern data for said IoT device; determining a statistical deviation between said reference traffic pattern data and said operating traffic pattern data by performing a statistical analysis; selecting a predetermined threshold value of said statistical deviation; comparing said statistical deviation with said predetermined threshold value to determine whether said statistical deviation is greater than said predetermined threshold; flagging abnormal activity responsive to a determination that said statistical deviation is greater than said predetermined threshold value. ### Claim 2 (depends on 1) The method of claim 1 wherein said reference traffic pattern data comprises at least one behavioral attribute selected from the following: a subscriber identifier; a host port number; a server port number; an IP address of said IoT device; an IP address of said server; an IoT device ID for said IoT device; and an identification code for said router. ### Claim 3 (depends on 1) The method of claim 1 wherein said reference traffic pattern data comprises at least one volumetric attribute selected from the following: a total number of IP layer bytes received from said server; a total number of IP layer bytes sent by said IoT device; a total number of application layer bytes received from said server; a total number of application layer bytes sent by said IoT device; a transport layer protocol used for packet transfer; a duration for connection of said IoT device to said server; an application layer protocol used for packet transfer; and a status bit information from packet headers. ### Claim 4 (depends on 1) The method of claim 1 wherein said operating traffic pattern data comprises at least one behavioral attribute selected from the following: a subscriber identifier; a host port number; a server port number; an IP address of said IoT device; an IP address of said server; an IoT device ID for said IoT device; and an identification code for said router. ### Claim 5 (depends on 1) The method of claim 1 wherein said operating traffic pattern data comprises at least one volumetric attribute selected from the following: a total number of IP layer bytes received from said server; a total number of IP layer bytes sent by said IoT device; a total number of application layer bytes received from said server; a total number of application layer bytes sent by said IoT device; a transport layer protocol used for packet transfer; a connection duration; an application layer protocol used for packet transfer; and a status bit information from packet headers. ### Claim 6 (depends on 1) The method of claim 1 wherein said reference traffic pattern data comprises at least one of a behavioral attribute and at least one of a volumetric attribute. ### Claim 7 (depends on 1) The method of claim 1 wherein said operating traffic pattern data comprises at least one of a behavioral attribute and at least one of a volumetric attribute. ### Claim 8 (depends on 1) The method of claim 1 wherein said determining a statistical deviation further comprises the steps of: creating a reference histogram for said reference traffic pattern data for at least one behavioral attribute; creating an operating histogram for said operating traffic pattern data for at least one behavioral attribute; and obtaining said statistical deviation between said reference histogram and said operating histogram by performing said statistical analysis. ### Claim 9 (depends on 1) The method of claim 1, comprising: said reference traffic pattern data consisting of collected operating traffic pattern data collected over a predetermined period of operation of said IoT device. ### Claim 10 (depends on 1) The method of claim 1, comprising: said reference traffic pattern data consisting of a combination of operating traffic pattern data from a first IoT device and operating traffic pattern data from a second IoT device, for at least one behavioral attribute. ### Claim 11 (depends on 1) The method of claim 1, comprising: said reference traffic pattern data consisting of a combination of operating traffic pattern data from a first IoT device and operating traffic pattern data from a second IoT device, for at least one volumetric attribute. ### Claim 12 (depends on 1) The method of claim 1, comprising: said reference traffic pattern data consisting of a combination of operating traffic pattern data from a first IoT device and operating traffic pattern data from a second IoT device, for at least one behavioral attribute and, for at least one volumetric attribute. ### Claim 13 (depends on 1) The method of claim 1 further comprising: incrementing an abnormality counter after flagging abnormal activity responsive to a determination that said statistical deviation is greater than said predetermined threshold value. ### Claim 14 (depends on 1) The method of claim 1 wherein said reference traffic pattern data is stored in a cloud storage. ### Claim 15 (depends on 1) The method of claim 1 wherein reference traffic pattern data relevant to at least one behavioral attribute is cached in local memory of said router. ### Claim 16 (depends on 1) The method of claim 1 wherein reference traffic pattern data relevant to at least one volumetric attribute is cached in local memory of said router. ### Claim 17 (depends on 1) The method of claim 1 wherein the statistical analysis of operating traffic pattern data relevant to volumetric attributes is performed through a neural network computer model. ### Claim 18 (depends on 1) The method of claim 1 wherein the statistical analysis of operating traffic pattern data relevant to volumetric attributes is performed through a one-class support vector machine. ### Claim 19 A method performed by a router to identify intrusion of an IoT device comprising the steps of: choosing a time duration; choosing a preset reference ratio; initializing a step counter; initializing an abnormality counter; selecting a predetermined threshold value of statistical deviation; repeating the following steps for said time duration: obtaining reference traffic pattern data for an IoT device operating in a normal operating mode; collecting operating traffic pattern data for said IoT device; determining a statistical deviation between said reference traffic pattern data and said operating traffic pattern data by performing a statistical analysis; comparing said statistical deviation with said predetermined threshold value of statistical deviation to determine whether said statistical deviation is greater than said predetermined threshold; flagging abnormal activity responsive to a determination that said statistical deviation is greater than said predetermined threshold value; incrementing an abnormality counter responsive to a determination that said statistical deviation is greater than said predetermined threshold value; incrementing said step counter; determining a decision ratio between said abnormality counter and said step counter; comparing said decision ratio with said preset reference ratio; and providing an intrusion warning if said decision ratio exceeds said preset reference ratio. ### Claim 20 (depends on 19) The method of claim 19 further comprising: blocking said IoT device from the network if an intrusion warning is provided. ### Claim 21 (depends on 19) The method of claim 19 further comprising: reporting said intrusion warning to a remote IoT device if an intrusion warning is provided. ### Claim 22 (depends on 20) The method of claim 20 further comprising: reporting said blocking to a remote IoT device if IoT device is blocked from the network.