# US 11,115,799 B1 · IoT device discovery and identification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,799 B1 - Document ID: US11115799B1 - Status: Granted - Kind: B1 - Application number: 17/133,189 - Filed: 2020-12-23 - Granted: 2021-09-07 - Earliest claimed: 2020-06-01 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Jun Du; Yilin Zhao - Web page: https://patentgrep.com/patent/US11115799B1 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04W 8/005: {Discovery of network devices, e.g. terminals} - H04L 63/104: {Grouping of entities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/162: {at the data link layer} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 8/183: {Processing at user equipment or user record carrier} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for performing Internet of Things (IoT) device identification are disclosed. Information associated with a network communication of an IoT device is received. A determination of whether the IoT device has been classified has been made. In response to determining that the IoT device has not been classified, a two-part classification process is performed, where a first portion includes an inline classification, and a second portion includes a subsequent verification of the inline classification. A result of the classification process is provided to a security appliance configured to apply a policy to the IoT device. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive information associated with a network communication of an IoT device; determine whether the IoT device has previously been classified; in response to determining that the IoT device has not previously been classified, perform a two-part classification process to determine an identification of the IoT device, wherein a first portion of the classification process comprises an inline classification of the IoT device, and wherein a second portion of the classification process comprises a subsequent verification of the inline classification of the IoT device; and provide a result of the classification process to a security appliance configured to apply a policy to the IoT device based at least in part on the result; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the information is received from a data appliance configured to monitor the IoT device. ### Claim 3 (depends on 1) The system of claim 1, wherein the received information includes network traffic metadata. ### Claim 4 (depends on 1) The system of claim 1, wherein the first portion of the classification process comprises a rule-based classification. ### Claim 5 (depends on 1) The system of claim 1, wherein the second portion of the classification process comprises a machine learning-based classification. ### Claim 6 (depends on 1) The system of claim 1, wherein performing the classification process includes determining whether any features for the IoT device are dominant. ### Claim 7 (depends on 1) The system of claim 1, wherein performing the classification process includes determining a confidence that one or more features of the IoT device match a network behavior pattern identifier. ### Claim 8 (depends on 7) The system of claim 7, wherein the processor is further configured to generate the network behavior pattern identifier. ### Claim 9 (depends on 1) The system of claim 1, wherein the result of the classification process comprises a group classification. ### Claim 10 (depends on 1) The system of claim 1, wherein the result of the classification process comprises a profile classification. ### Claim 11 A method, comprising: receiving information associated with a network communication of an IoT device; determining whether the IoT device has previously been classified; in response to determining that the IoT device has not previously been classified, performing a two-part classification process to determine an identification of the IoT device, wherein a first portion of the classification process comprises an inline classification of the IoT device, and wherein a second portion of the classification process comprises a subsequent verification of the inline classification of the IoT device; and providing a result of the classification process to a security appliance configured to apply a policy to the IoT device based at least in part on the result. ### Claim 12 (depends on 11) The method of claim 11, wherein the information is received from a data appliance configured to monitor the IoT device. ### Claim 13 (depends on 11) The method of claim 11, wherein the received information includes network traffic metadata. ### Claim 14 (depends on 11) The method of claim 11, wherein the first portion of the classification process comprises a rule-based classification. ### Claim 15 (depends on 11) The method of claim 11, wherein the second portion of the classification process comprises a machine learning-based classification. ### Claim 16 (depends on 11) The method of claim 11, wherein performing the classification process includes determining whether any features for the IoT device are dominant. ### Claim 17 (depends on 11) The method of claim 11, wherein performing the classification process includes determining a confidence that one or more features of the IoT device match a network behavior pattern identifier. ### Claim 18 (depends on 17) The method of claim 17, further comprising generating the network behavior pattern identifier. ### Claim 19 (depends on 11) The method of claim 11, wherein the result of the classification process comprises a group classification. ### Claim 20 (depends on 11) The method of claim 11, wherein the result of the classification process comprises a profile classification. ### Claim 21 A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for: receiving information associated with a network communication of an IoT device; determining whether the IoT device has previously been classified; in response to determining that the IoT device has not previously been classified, performing a two-part classification process to determine an identification of the IoT device, wherein a first portion of the classification process comprises an inline classification of the IoT device, and wherein a second portion of the classification process comprises a subsequent verification of the inline classification of the IoT device; and providing a result of the classification process to a security appliance configured to apply a policy to the IoT device based at least in part on the result.