US 11,689,468 B2Granted

Device classification using machine learning models

AssigneeForescout Technologies, Inc.

InventorsItai Koren, Zvika Plotkin

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, methods, and related technologies for classification are described. Network traffic transmitted by a first device is obtained. A set of features is determined based on the network traffic. A first classification for the device is determine a first classification for the first device based on the set of features. The first classification is associated with a first classification level. A second machine learning model is identified based on the first classification. The second machine learning model is associated with the first classification. A second classification for the first device is determined based on the second machine learning model. The second classification is associated with a second classification level. At least one of the first classification and the second classification is stored.

Claims17

Dependent claims

A method, comprising:

obtaining network traffic from a network, wherein the network traffic is transmitted by a first device that is communicatively coupled to the network;
determining a set of features based on the network traffic;
determining a first classification for the first device based on the set of features and a first machine learning model, wherein the first classification is associated with a first classification level;
identifying a second machine learning model based on the first classification, wherein the second machine learning model is associated with the first classification;
determining a second classification for the first device based on the second machine learning model, wherein the second classification is associated with a second classification level;
storing at least one of the first classification and the second classification;
obtaining additional network traffic from the network, wherein the additional network traffic is transmitted by the first device;
determining a second set of features based on the additional network traffic;
determining an updated first classification for the first device based on the second set of features;
identifying a third machine learning model based on the updated first classification, wherein the third machine learning model is associated with the updated first classification;
determining an updated second classification for the first device based on the third machine learning model;
and
storing at least one of the updated first classification and the updated second classification.

10 more elements

A system, comprising:

a memory;
and
a processing device, operatively coupled to the memory, to:
obtain network traffic from a network, wherein the network traffic is transmitted by a first device that is communicatively coupled to the network;
determine a set of features based on the network traffic;
determine a first classification for the first device based on the set of features a first machine learning model, wherein the first classification is associated with a first classification level, wherein to determine the first classification for the first device the processing device is further to determine a first confidence level associated with the first classification;
identify a second machine learning model based on the first classification, wherein the second machine learning model is associated with the first classification;
determine a second classification for the first device based on the second machine learning model, wherein the second classification is associated with a second classification level, to determine the second classification for the first device the processing device is further to determine a second confidence level associated with the second classification;
store at least one of the first classification and the second classification;
determine whether the first confidence level is above a threshold confidence level;
identify the second machine learning model in response to the first confidence level being above the threshold confidence level;
and
determine whether the second confidence level is above the threshold confidence level, wherein the second classification is determined in response to the second confidence level being above the threshold confidence level.

10 more elements

Dependencies are inferred from the claim text.