Device identification apparatus and method based on network behavior
AssigneeElectronics and Telecommunications Research Institute
InventorsHyeok-Chan Kwon, Byung-Ho Chung
Life of this patent
Estimating the term…
Abstract
Disclosed herein are a device identification apparatus and method based on network behavior. The device identification apparatus includes one or more processors, and execution memory for storing at least one program that is executed by the one or more processors, wherein the at least one program is configured to collect packet data of a device connected to a network through port mirroring and extract behavior features from the packet data, analyze the behavior features and then generate unique information based on a previously created detection model, and extract an identification number corresponding to the unique information from a database and then identify the device.
Claims18
A device identification apparatus based on network behavior, comprising:
- one or more processors;
- and
- an execution memory for storing at least one program that is executed by the one or more processors,
- wherein the at least one program is configured to:
- collect packet data for a preset period of time of a device connected to a network through port mirroring and extract behavior features from the packet data, wherein the extraction of behavior features corresponds to an average amount of data that is transmitted during the preset period, a protocol used by the device, information about a network access port, an operation cycle including information about an idle/activation ratio and information indicating whether a distribution of operation of the device is periodic or aperiodic, and a communication pattern comprising information about a change in directionality, destination diversity, port diversity and data volume diversity,
- analyze the behavior features and then generate unique information based on a previously created detection model, and
- extract an identification number corresponding to the unique information from a database and then identify the device.
A device identification method based on network behavior, the device identification method being performed by a device identification apparatus based on network behavior, the device identification method comprising:
- collecting packet data for a preset period of time of a device connected to a network through port mirroring and extract behavior features from the packet data, wherein the extraction of behavior features corresponds to an average amount of data that is transmitted during the preset period, a protocol used by the device, information about a network access port, an operation cycle including information about an idle/activation ratio and information indicating whether a distribution of operation of the device is periodic or aperiodic, and a communication pattern comprising information about a change in directionality, destination diversity, port diversity and data volume diversity;
- analyzing the behavior features and then generating unique information based on a previously created detection model;
- and
- extracting an identification number corresponding to the unique information from a database and then identifying the device.
Dependencies are inferred from the claim text.