Back to results
US 11,455,569 B2Granted
Device discovery and classification from encrypted network traffic
AssigneeInternational Business Machines Corporation
InventorsEnriquillo Valdez, Pau-Chen Cheng, Ian Michael Molloy, Dimitrios Pendarakis
Life of this patent
Estimating the term…
Abstract
Handshake protocol layer features are extracted from training data associated with encrypted network traffic of a plurality of classified devices. Record protocol layer features are extracted from the training data. One or more models are trained based on the extracted handshake protocol layer features and the extracted record protocol layer features. The one or more models are applied to an observed encrypted network traffic stream associated with a device to determine a predicted device classification of the device.
Claims17
A computer-implemented method, the method comprising:
- extracting handshake protocol layer features from training data associated with encrypted network traffic of a plurality of classified devices;
- extracting record protocol layer features from the training data;
- training a first model based on the extracted handshake protocol layer features, wherein the training comprises:
- generating a document that contains text describing handshake protocol features of a device type;
- and
- generating a similarity matrix having a row associated with the device type and a column associated with a handshake protocol feature, wherein the column of the row contains a normalized weight of words from the text of the document associated with the handshake protocol feature of the device type;
- training a second model based on the extracted record protocol layer features, wherein the second model is different from the first model;
- applying the first model with the extracted handshake protocol layer features to an observed encrypted network traffic stream resulting in similarity scores output by the first model for the plurality of classified devices;
- extracting record protocol layer features used for classification by the second model, wherein the record protocol layer features are extracted from the observed encrypted network traffic for a subset of the plurality of classified devices having similarity scores output by the first model above a threshold level associated with the first model;
- and
- applying the second model to the observed encrypted network traffic stream using the extracted record protocol layer features from the subset of the plurality of classified devices to determine a predicted device classification of the device from among the subset of the plurality of classified devices.
8 more elements
A computer usable program product comprising one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices, the stored program instructions comprising:
- program instructions to extract handshake protocol layer features from training data associated with encrypted network traffic of a plurality of classified devices;
- program instructions to extract record protocol layer features from the training data;
- program instructions to train a first model based on the extracted handshake protocol layer features, wherein the program instructions to train the first model comprise:
- program instructions to generate a document that contains text describing handshake protocol features of a device type;
- and
- program instructions to generate a similarity matrix having a row associated with the device type and a column associated with a handshake protocol feature, wherein the column of the row contains a normalized weight of words from the text of the document associated with the handshake protocol feature of the device type;
- program instructions to train a second model based on the extracted record protocol layer features, wherein the second model is different from the first model;
- program instructions to apply the first model with the extracted handshake protocol layer features to an observed encrypted network traffic stream resulting in similarity scores output by the first model for the plurality of classified devices;
- program instructions to extract record protocol layer features used for classification by the second model, wherein the record protocol layer features are extracted from the observed encrypted network traffic for a subset of the plurality of classified devices having similarity scores output by the first model above a threshold level associated with the first model;
- and
- program instructions to apply the second model to the observed encrypted network traffic stream using the extracted record protocol layer features from the subset of the plurality of classified devices to determine a predicted device classification of the device from among the subset of the plurality of classified devices.
8 more elements
A computer system comprising one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the stored program instructions comprising:
- program instructions to extract handshake protocol layer features from training data associated with encrypted network traffic of a plurality of classified devices;
- program instructions to extract record protocol layer features from the training data;
- program instructions to train a first model based on the extracted handshake protocol layer features, wherein the program instructions to train the first model comprise:
- program instructions to generate a document that contains text describing handshake protocol features of a device type;
- and
- program instructions to generate a similarity matrix having a row associated with the device type and a column associated with a handshake protocol feature, wherein the column of the row contains a normalized weight of words from the text of the document associated with the handshake protocol feature of the device type;
- program instructions to train a second model based on the extracted record protocol layer features, wherein the second model is different from the first model;
- program instructions to apply the first model with the extracted handshake protocol layer features to an observed encrypted network traffic stream resulting in similarity scores output by the first model for the plurality of classified devices;
- program instructions to extract record protocol layer features used for classification by the second model, wherein the record protocol layer features are extracted from the observed encrypted network traffic for a subset of the plurality of classified devices having similarity scores output by the first model above a threshold level associated with the first model;
- and
- program instructions to apply the second model to the observed encrypted network traffic stream using the extracted record protocol layer features from the subset of the plurality of classified devices to determine a predicted device classification of the device from among the subset of the plurality of classified devices.
8 more elements
Dependencies are inferred from the claim text.