# US 11,443,230 B2 · Intrusion detection model for an internet-of-things operations environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,230 B2
- Document ID: US11443230B2
- Status: Granted
- Kind: B2
- Application number: 16/135,756
- Filed: 2018-09-19
- Published: 2019-08-01
- Granted: 2022-09-13
- Earliest claimed: 2018-01-26
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Nancy Cam-Winget; Subharthi Paul; Blake Anderson; Saman Taghavi Zargar; Oleg Bessonov; Robert Frederick Albach; Sanjay Kumar Agarwal; Mark Steven Knellinger
- Web page: https://patentgrep.com/patent/US11443230B2

## CPC

- G06N 5/045: Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence
- G06F 18/2148: {characterised by the process organisation or structure, e.g. boosting cascade}
- G06F 18/24: Classification techniques
- G06N 20/00: Machine learning
- G06N 20/20: Ensemble learning
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A trained model may be deployed to an Internet-of-Things (IOT) operational environment in order to ingest features and detect events extracted from network traffic. The model may be received and converted into a meta-language representation which is interpretable by a data plane engine. The converted model can then be deployed to the data plane and may extract features from network communications over the data plane. The extracted features may be fed to the deployed model in order to generate event classifications or device state classifications.

## Claims

### Claim 1

A method for executing a model in an Internet-of-Things (IOT) operations environment, the method comprising:
obtaining, by a processor, a machine learning model, the trained model generating classifications from features of an IOT operations environment, the IOT operations environment comprising one or more IOT devices on a network and the features comprising performance characteristics of one of subsystems or device components of the IOT devices;
converting, by the processor, the model into a meta-language representation, the meta-language representation interpretable by a data plane engine, the meta-language representation including an extract primitive for identifying features from the IOT environment;
deploying, by the processor, the converted model to a data plane, the data plane comprising network communications in the IOT operations environment and including the data plane engine;
extracting, by the processor and the data plane engine and based on the identified features of the extract primitive of the meta-language representation of the model, the features of the IOT operations environment from the network communications;
feeding, by the processor, the extracted features to the deployed model; and
generating from the ingested features, by the processor and the deployed model, one of an event classification or device state classification for the one or more IOT devices of the IOT operations environment.

### Claim 2 (depends on 1)

The method of claim 1, wherein the data plane engine comprises functional primitives.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
generating, by a processor, a graphical system description of an IOT operations environment;
converting, by the processor, the graphical system description into a machine learning model; and
training, by the processor, the machine learning model.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
logging, by the processor, the ingested features and the one of the event classification or device state classification; and
providing, by the processor and to a model trainer, the logged ingested features and the one of the event classification or device station classification.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
updating, by the processor, the converted model using the ingested features and the one of the event classification or device state classification; and
redeploying, by the processor, the updated converted model to the data plane, the redeployed model replacing the deployed model.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
generating, by a second processor, a machine learning model by:
feeding to a machine learning model, one or more features of one or more IOT devices;
generating, by the second processor executing the machine learning model on the received one or more features, a classification;
determining, by the second processor, an error value based on the classification and a predetermined true value;
generating, by the second processor, a trained machine learning model by updating the machine learning model based on the determined error value; and
providing, from the second processor, the trained machine learning model to be deployed in an IOT operations environment.

### Claim 7

A system for executing a model in an Internet-of-Things (IOT) operations environment, the system comprising:
an IOT operations environment comprising one or more IOT devices on a network;
a data plane comprising communications over the network and a data plane engine, the communications between the one or more IOT devices;
a processor; and
a memory storing instructions comprising:
obtain a machine learning model, the model generating classifications from features of the IOT operations environment, the features comprising performance characteristics of one of subsystems or device components of the IOT devices;
convert the model into a meta-language representation, the meta-language representation interpretable by the data plane engine, the meta-language representation including an extract primitive for identifying features from the IOT environment;
deploy the converted model to the data plane;
extract the features of the IOT operations environment from the communications over the network and based on the identified features of the extract primitive of the meta- language representation of the model;
feed the extracted features to the deployed model; and
generate from the ingested features, by the deployed model, one of an event classification or device state classification for the one or more IOT devices of the IOT operations environment.

### Claim 8 (depends on 7)

The system of claim 7, wherein the data plane engine comprises functional primitives.

### Claim 9 (depends on 7)

The system of claim 7, wherein the memory stores instructions further comprising:
log the ingested features and the one of the event classification or device state classification; and
provide, to a model trainer, the logged ingested features and the one of the event classification or device station classification.

### Claim 10 (depends on 7)

The system of claim 7, wherein the memory stores instructions further comprising:
update the converted model using the ingested features and the one of the event classification or device state classification; and
redeploy the updated converted model to the data plane, the redeployed model replacing the deployed model.

### Claim 11 (depends on 7)

The system of claim 7, further comprising a graphical system description of the IOT operations environment, wherein the memory stores instructions further comprising:
convert the graphical system description into a machine learning model; and
train the machine learning model.

### Claim 12

A non-transitory computer readable medium storing instructions programmed to cause a system to perform operations comprising:
obtain a machine learning model, the model generating classifications from features of an IOT operations environment, the IOT operations environment comprising one or more IOT devices on a network and the features comprising performance characteristics of one of subsystems or device components of the IOT devices;
convert the model into a meta-language representation, the meta-language representation interpretable by a data plane engine, the meta-language representation including an extract primitive for identifying features from the IOT environment;
deploy the converted model to a data plane, the data plane comprising network communications in the IOT operations environment and including the data plane engine;
extract, by the data plane engine and based on the identified features of the extract primitive of the meta-language representation of the model, the features of the IOT operations environment from the network communications;
feed the extracted features to the deployed model; and
generate from the ingested features, by the deployed model, one of an event classification or device state classification for the one or more IOT devices of the IOT operations environment.

### Claim 13 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the data plane engine comprises functional primitives.

### Claim 14 (depends on 12)

The non-transitory computer readable medium of claim 12, storing instructions further comprising:
generate a graphical system description of an IOT operations environment;
convert the graphical system description into a machine learning model; and
train the machine learning model.

### Claim 15 (depends on 12)

The non-transitory computer readable medium of claim 12, storing instructions further comprising:
log the ingested features and the one of the event classification or device state classification; and
provide, to a model trainer, the logged ingested features and the one of the event classification or device station classification.

### Claim 16 (depends on 12)

The non-transitory computer readable medium of claim 12, storing instructions further comprising:
update the converted model using the ingested features and the one of the event classification or device state classification; and
redeploy the updated converted model to the data plane, the redeployed model replacing the deployed model.

### Claim 17 (depends on 12)

The non-transitory computer readable medium of claim 12, storing instructions further comprising:
generate a machine learning model by:
feeding to a machine learning model, one or more features of one or more IOT devices;
generating, by executing the machine learning model on the received one or more features, a classification;
determining an error value based on the classification and a predetermined true value;
generating a trained machine learning model by updating the machine learning model based on the determined error value; and
providing the trained machine learning model to be deployed in an IOT operations environment.

### Claim 18 (depends on 1)

The method of claim 1, wherein the features identified by the extract primitive include subsystem device state, communications target, or time-dimension data.

### Claim 19 (depends on 7)

The system of claim 7, wherein the features identified by the extract primitive include subsystem device state, communications target, or time-dimension data.

### Claim 20 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the features identified by the extract primitive include subsystem device state, communications target, or time-dimension data.