IoT device grouping and labeling
AssigneePalo Alto Networks, Inc.
InventorsJun Du, Gong Cheng, Yilin Zhao, Pui-Chuen Yip
Life of this patent
Estimating the term…
Abstract
Techniques for grouping and labeling Internet of Things (IoT) devices are disclosed. In accordance with an aspect of the invention, there is provided a computer program product configured to be operable to perform the techniques described in this paper to enable grouping and labeling of IoT devices. As devices are grouped and labeled, and behavior is matched to or deviates from known or expected behavior, the network can be more readily understood and alerts can be more timely and appropriate.
Claims30
A method comprising:
- identifying a set of raw events associated with an Internet of Things (IoT) device in operation;
- obtaining additional contextual information associated with the IoT device and enriching at least some raw events included in the set of raw events based at least in part on the obtained additional contextual information;
- using the set of raw events to generate a set of features associated with the IoT device, including by aggregating at least some raw events included in the set of raw events to form aggregated events;
- determining, based at least in part on providing at least some features included in the set of features to at least one prediction model, and applying a threshold, whether the IoT device belongs to a particular group;
- and
- detecting, as undesired behavior, a deviation by the IoT device from group behavior, and generating an alert in response.
A computer program product embodied on a non-transitory medium, the computer program product including instructions which, when executed by a computer, cause the computer to carry out a method comprising:
- identifying a set of raw events associated with an Internet of Things (IoT) device in operation;
- obtaining additional contextual information associated with the IoT device and enriching at least some raw events included in the set of raw events based at least in part on the obtained additional contextual information;
- using the set of raw events to generate a set of features associated with the IoT device, including by aggregating at least some raw events included in the set of raw events to form aggregated events;
- determining, based at least in part on providing at least some features included in the set of features to at least one prediction model, and applying a threshold, whether the IoT device belongs to a particular group;
- and
- detecting, as undesired behavior, a deviation by the IoT device from group behavior, and generating an alert in response.
A system comprising:
- a processor configured to:
- identify a set of raw events associated with an Internet of Things (IoT) device in operation;
- obtain additional contextual information associated with the IoT device and enrich at least some raw events included in the set of raw events based at least in part on the obtained additional contextual information;
- use the set of raw events to generate a set of features associated with the IoT device, including by aggregating at least some raw events included in the set of raw events to form aggregated events;
- determine, based at least in part on providing at least some features included in the set of features to at least one prediction model, and apply a threshold, whether the IoT device belongs to a particular group;
- and
- detect, as undesired behavior, a deviation by the IoT device from group behavior, and generate an alert in response;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
Dependencies are inferred from the claim text.