# US 11,451,571 B2 · IoT device risk assessment and scoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,571 B2 - Document ID: US11451571B2 - Status: Granted - Kind: B2 - Application number: 16/712,981 - Filed: 2019-12-12 - Published: 2020-06-18 - Granted: 2022-09-20 - Earliest claimed: 2018-12-12 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Jun Du - Web page: https://patentgrep.com/patent/US11451571B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04W 12/68: Gesture-dependent or behaviour-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques for establishing a risk score for Internet of Things (IoT) device parameters and acting in response thereto are disclosed. An applicable system includes IoT devices coupled to a progressive risk assessment system and a progressive risk alert engine. In a specific implementation, the system uses baseline risk, threat vectors, and behavioral risk to generate and update progressive risk scores associated with IoT devices in an IoT network. ## Claims ### Claim 1 A method, comprising: analyzing one or more data packets transmitted to or from an Internet of Things (IoT) device over a network to which the IoT device is connected to obtain event parameters; analyzing the event parameters to determine a context of the IoT device; determining behavior of the IoT device based on the event parameters and the context of the IoT device; obtaining a progressive risk score for the IoT device by correlating: (1) a behavioral risk score determined using risk parameters associated with an undesired behavior, (2) a baseline risk corresponding to an intrinsic risk associated with the IoT device, and (3) a threat vector risk corresponding to threat intelligence associated with the IoT device; and sending an alert via the network when it is determined that the progressive risk score exceeds a threshold. ### Claim 2 (depends on 1) The method of claim 1, wherein the event parameters comprise one or more of data and metadata. ### Claim 3 (depends on 1) The method of claim 1, wherein sending the alert includes using a graphical user interface to facilitate one or more of providing data to and receiving instructions from an administrator of the network to which the IoT device is connected. ### Claim 4 (depends on 1) The method of claim 1, wherein a severity of the alert is based on one or more of priorities and rules of an administrator of the network to which the IoT device is connected. ### Claim 5 (depends on 1) The method of claim 1, wherein the alert is a policy violation alert, a threat alert, or an incident alert. ### Claim 6 (depends on 1) The method of claim 1, wherein the one or more data packets are correlated to an event of a particular application being executed on the IoT device. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more data packets are analyzed using packet header analysis. ### Claim 8 (depends on 1) The method of claim 1, wherein the one or more data packets are analyzed using deep packet inspection (DPI). ### Claim 9 (depends on 1) The method of claim 1, further comprising using activity graphs to update the progressive risk score. ### Claim 10 (depends on 1) The method of claim 1, wherein at least a portion of the method is performed remote to the IoT device. ### Claim 11 A system, comprising: a processor configured to: analyze one or more data packets transmitted to or from an Internet of Things (IoT) device over a network to which the IoT device is connected to obtain event parameters; analyze the event parameters to determine a context of the IoT device; determine behavior of the IoT device based on the event parameters and the context of the IoT device; obtain a progressive risk score for the IoT device by correlating: (1) a behavioral risk score determined using risk parameters associated with an undesirable behavior, (2) a baseline risk corresponding to an intrinsic risk associated with the IoT device, and (3) a threat vector risk corresponding to threat intelligence associated with the IoT device; and send an alert via the network when it is determined that the progressive risk score exceeds a threshold; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 12 (depends on 11) The system of claim 11, wherein the event parameters comprise one or more of data and metadata. ### Claim 13 (depends on 11) The system of claim 11, wherein the processor is further configured to use a graphical user interface to facilitate one or more of providing data to and receiving instructions from an administrator of the network to which the IoT device is connected. ### Claim 14 (depends on 11) The system of claim 11, wherein a severity of the alert is based on one or more of priorities and rules of an administrator of the network to which the IoT device is connected. ### Claim 15 (depends on 11) The system of claim 11, wherein the alert is a policy violation alert, a threat alert, or an incident alert. ### Claim 16 (depends on 11) The system of claim 11, wherein the one or more data packets are correlated to an event of a particular application being executed on the IoT device. ### Claim 17 (depends on 11) The system of claim 11, wherein the one or more data packets are analyzed using packet header analysis. ### Claim 18 (depends on 11) The system of claim 11, wherein the one or more data packets are analyzed using deep packet inspection (DPI). ### Claim 19 (depends on 11) The system of claim 11, wherein the processor is further configured to use activity graphs to update the progressive risk score. ### Claim 20 (depends on 11) The system of claim 11, wherein at least a portion of the system is implemented remotely from the IoT device.