Intrusion detection model for an internet-of-things operations environment

A system for executing a model in an Internet-of-Things (IOT) operations environment, the system comprising:

• an IOT operations environment comprising one or more IOT devices on a network;
• a data plane comprising communications over the network and a data plane engine, the communications between the one or more IOT devices;
• a processor;
• and
• a memory storing instructions comprising:
• obtain a machine learning model, the model generating classifications from features of the IOT operations environment, the features comprising performance characteristics of one of subsystems or device components of the IOT devices;
• convert the model into a meta-language representation, the meta-language representation interpretable by the data plane engine, the meta-language representation including an extract primitive for identifying features from the IOT environment;
• deploy the converted model to the data plane;
• extract the features of the IOT operations environment from the communications over the network and based on the identified features of the extract primitive of the meta- language representation of the model;
• feed the extracted features to the deployed model;
• and
• generate from the ingested features, by the deployed model, one of an event classification or device state classification for the one or more IOT devices of the IOT operations environment.

A non-transitory computer readable medium storing instructions programmed to cause a system to perform operations comprising:

• obtain a machine learning model, the model generating classifications from features of an IOT operations environment, the IOT operations environment comprising one or more IOT devices on a network and the features comprising performance characteristics of one of subsystems or device components of the IOT devices;
• convert the model into a meta-language representation, the meta-language representation interpretable by a data plane engine, the meta-language representation including an extract primitive for identifying features from the IOT environment;
• deploy the converted model to a data plane, the data plane comprising network communications in the IOT operations environment and including the data plane engine;
• extract, by the data plane engine and based on the identified features of the extract primitive of the meta-language representation of the model, the features of the IOT operations environment from the network communications;
• feed the extracted features to the deployed model;
• and
• generate from the ingested features, by the deployed model, one of an event classification or device state classification for the one or more IOT devices of the IOT operations environment.