# US 11,115,289 B1 · Systems and methods for network security model > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,289 B1 - Document ID: US11115289B1 - Status: Granted - Kind: B1 - Application number: 16/918,998 - Filed: 2020-07-01 - Granted: 2021-09-07 - Earliest claimed: 2019-05-30 - Assignees: Cable Television Laboratories, Inc. - Applicants: Cable Television Laboratories, Inc - Inventors: Kyle Haefner - Web page: https://patentgrep.com/patent/US11115289B1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/00: Machine learning - H04L 41/142: using statistical or mathematical methods - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/026: using flow identification - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/1458: {Denial of Service} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A security apparatus for a local network is in communication with an external electronic communication system and a first electronic device. The apparatus includes a memory device configured to store computer-executable instructions, and a processor in operable communication with the memory device. The processor is configured to implement the stored computer-executable instructions to cause the apparatus to determine a complexity score for the first electronic device, establish a behavioral pattern for the first electronic device operating within the local network, calculate a confidence metric for the first electronic device based on the determined complexity score and the established behavioral pattern, and control access of the first electronic device to the external electronic network according to the calculated confidence metric. ## Claims ### Claim 1 A security apparatus for a local network, the apparatus being in communication with an external electronic communication system and a first electronic device, comprising: a memory device configured to store computer-executable instructions; and a processor in operable communication with the memory device, wherein the processor is configured to implement the stored computer-executable instructions to cause the apparatus to: determine a complexity score for the first electronic device; establish a behavioral pattern for the first electronic device operating within the local network; calculate a confidence metric for the first electronic device based on the determined complexity score and the established behavioral pattern; and control access of the first electronic device to the external electronic network according to the calculated confidence metric. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the external electronic communication system is the Internet. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the first electronic device capable of connecting with the Internet of Things (IoT). ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the apparatus comprises a router. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to control access of the first electronic device to the external electronic network by one of routing, limiting, or dropping individual network flows to and/or from the first electronic device. ### Claim 6 (depends on 4) The apparatus of claim 4, wherein the router is in operable communication with a network traffic monitor configured to monitor the individual network flows. ### Claim 7 (depends on 6) The apparatus of claim 6, wherein the processor is further configured to determine the complexity score for the first electronic device according to a derived device complexity calculation based on a one of a variance of the individual network flows and an endpoint analysis of the first electronic device. ### Claim 8 (depends on 6) The apparatus of claim 6, wherein the processor is further configured to determine the complexity score for the first electronic device an aggregated complexity score derived from an analysis of network traffic of the device over time. ### Claim 9 (depends on 6) The apparatus of claim 6, wherein the processor is further configured to establish the behavioral pattern for the first electronic device by generating a probabilistic behavioral model. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the behavioral model considers only network traffic that is sent and received by the first electronic device on the processor. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the behavioral model considers a historical record of the individual network flows of the first electronic device on the local network to learn the behavioral pattern of the first device. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the processor is further configured to learn the behavioral pattern of past actions of the first device on the local network from the historical record of the individual network flows of the first electronic device. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the processor is further configured to determine that a current network state for the device fits within a discovered boundary of the behavioral pattern of past actions. ### Claim 14 (depends on 9) The apparatus of claim 9, wherein the behavioral model is configured to implement an isolation forest anomaly algorithm to derive a behavioral metric for the first electronic device. ### Claim 15 (depends on 6) The apparatus of claim 6, wherein the processor is further configured to establish the behavioral pattern based on a ratio of anomalous flows of the individual network flows to a total number of the individual network flows. ### Claim 16 (depends on 6) The apparatus of claim 6, wherein the processor is further configured to (i) calculate the confidence metric for the first electronic device, and (ii) rank every individual network flow to and from the device based on the confidence metric. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the processor is further configured to collate the network traffic into the ranked individual network flows, and wherein each individual network flow comprises a sequence of packets. ### Claim 18 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to tune the established behavioral pattern according to the determined complexity score. ### Claim 19 (depends on 1) The apparatus of claim 1, wherein the apparatus is in operable communication with a second electronic device, different from the first electronic device, and wherein the processor is further configured to control access of the first electronic device to the second electronic device according to the calculated confidence metric. ### Claim 20 (depends on 1) The apparatus of claim 1, wherein the apparatus comprises a network interface in communication with a network control element.