# US 10,771,491 B2 · Packet analysis based IoT management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,491 B2 - Document ID: US10771491B2 - Status: Granted - Kind: B2 - Application number: 16/279,984 - Filed: 2019-02-19 - Published: 2019-06-20 - Granted: 2020-09-08 - Earliest claimed: 2015-04-07 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Gong Cheng; Pui-Chuen Yip; Zhiwei Xiao; Ran Xia; Mei Wang - Web page: https://patentgrep.com/patent/US10771491B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L 43/00: Arrangements for monitoring or testing data switching networks - H04L 43/12: Network monitoring probes - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/303: Terminal profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Data packets transmitted to and from an IoT device are obtained and at least one of the data packets are analyzed using deep packet inspection to identify transaction data from payload of the at least one of the data packets. An event log is generated for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device. The IoT device is profiled into a device profile based on the historical record for the IoT device. The event log is updated in real-time to indicate current operation of the IoT device. Abnormal device behavior of the IoT device is determined using the event log and the device profile. The device profile is updated to indicate the abnormal device behavior of the IoT device. ## Claims ### Claim 1 A system comprising: a mirror port provided in a local area network including an Internet of things (IoT) device, the mirror port configured to obtain and mirror data packets transmitted to and from the IoT device; an IoT device management engine configured to: obtain the mirrored data packets from the mirror port; analyze at least one of the mirrored data packets using deep packet inspection to identify transaction data from payload of the at least one of the mirrored data packets; generate an event log for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device; update the event log in real-time to indicate current operation of the IoT device; an IoT device profiling engine configured to: profile the IoT device into a device profile based on the historical record for the IoT device; determine baseline behavior of the IoT device from historical records of a plurality of IoT devices including the historical record for the IoT device; receive the event log updated in real-time from the IoT device management engine; determine abnormal device behavior of the IoT device using the event log received from the IoT device management engine and the baseline behavior; update the device profile to indicate the abnormal device behavior of the IoT device; an IoT device vulnerability determination engine configured to: determine whether the IoT device is vulnerable to attack; and terminate flow of data to and from the IoT device if it is determined that the IoT device is vulnerable to attack. ### Claim 2 (depends on 1) The system of claim 1, wherein the vulnerability determination engine determines whether the IoT device is vulnerable to attack by sending a packet for gaining access to the IoT device using a default user ID and/or password. ### Claim 3 (depends on 1) The system of claim 1, wherein the vulnerability determination engine determines whether the IoT device is vulnerable to attack by sending a packet to the IoT device over an incorrect or less secure port. ### Claim 4 (depends on 1) The system of claim 1, wherein the vulnerability determination engine determines whether the IoT device is vulnerable to attack by sending a flood of packets to the IoT device. ### Claim 5 (depends on 1) The system of claim 1, wherein the vulnerability determination engine determines whether the IoT device is vulnerable to attack by: sending a packet to the IoT device; and analyzing traffic sent by the IoT device in response to receiving the packet. ### Claim 6 (depends on 1) The system of claim 1, wherein the vulnerability determination engine determines whether the IoT device is vulnerable to attack by analyzing packets transmitted by the IoT device to determine whether the packets include access credentials for accessing the IoT device. ### Claim 7 (depends on 1) The system of claim 1, wherein the vulnerability determination engine determines whether the IoT device is vulnerable to attack by analyzing the historical record for the IoT device to determine whether a random scan has been performed on the IoT device. ### Claim 8 (depends on 1) The system of claim 1, wherein the vulnerability determination engine is further configured to assign a vulnerability score to the IoT device. ### Claim 9 (depends on 1) The system of claim 1, wherein the vulnerability determination engine is provided in the local area network. ### Claim 10 (depends on 1) The system of claim 1, wherein the vulnerability determination engine is provided in a cloud that is outside of the local area network. ### Claim 11 A method comprising: obtaining, by a mirror port provided in a local area network including an Internet of things (IoT) device, data packets transmitted to and from the IoT device; mirroring, by the mirror port, the data packets transmitted to and from the IoT device; obtaining, by an IoT device management engine, the mirrored data packets from the mirror port; analyzing, by the IoT device management engine, at least one of the mirrored data packets using deep packet inspection to identify transaction data from payload of the at least one of the mirrored data packets; generating, by the IoT device management engine, an event log for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device; updating, by the IoT device management engine, the event log in real-time to indicate current operation of the IoT device; profiling, by an IoT device profiling engine, the IoT device into a device profile based on the historical record for the IoT device; determining, by the IoT device profiling engine, baseline behavior of the IoT device from historical records of a plurality of IoT devices including the historical record for the IoT device; receiving, by the IoT device profiling engine, the event log updated in real-time from the IoT device management engine; determining, by the IoT device profiling engine, abnormal device behavior of the IoT device using the event log received from the IoT device management engine and the baseline behavior; updating, by the IoT device profiling engine, the device profile to indicate the abnormal device behavior of the IoT device; determining, by an IoT device vulnerability determination engine, whether the IoT device is vulnerable to attack; and terminating, by the IoT device vulnerability determination engine, flow of data to and from the IoT device if it is determined that the IoT device is vulnerable to attack. ### Claim 12 (depends on 11) The method of claim 11, wherein determining whether the IoT device is vulnerable to attack comprises sending a packet for gaining access to the IoT device using a default user ID and/or password. ### Claim 13 (depends on 11) The method of claim 11, wherein determining whether the IoT device is vulnerable to attack comprises sending a packet to the IoT device over an incorrect or less secure port. ### Claim 14 (depends on 11) The method of claim 11, wherein determining whether the IoT device is vulnerable to attack comprises sending a flood of packets to the IoT device. ### Claim 15 (depends on 11) The method of claim 11, wherein determining whether the IoT device is vulnerable to attack comprises: sending a packet to the IoT device; and analyzing traffic sent by the IoT device in response to receiving the packet. ### Claim 16 (depends on 11) The method of claim 11, wherein determining whether the IoT device is vulnerable to attack comprises analyzing packets transmitted by the IoT device to determine whether the packets include access credentials for accessing the IoT device. ### Claim 17 (depends on 11) The method of claim 11, wherein determining whether the IoT device is vulnerable to attack comprises analyzing the historical record for the IoT device to determine whether a random scan has been performed on the IoT device. ### Claim 18 (depends on 11) The method of claim 11, further comprising assigning, by the vulnerability determination engine, a vulnerability score to the IoT device. ### Claim 19 (depends on 11) The method of claim 11, wherein the vulnerability determination engine is provided in the local area network. ### Claim 20 (depends on 11) The method of claim 11, wherein the vulnerability determination engine is provided in a cloud that is outside of the local area network.