Back to results
US 11,706,236 B2Granted
Autonomous application of security measures to IoT devices
AssigneeRapid7, Inc.
InventorsDeral Heiland, Dustin Myers, Wah-Kwan Lin
Life of this patent
Estimating the term…
Abstract
Methods and systems for classifying a device on a network. The systems and methods may receive network activity data associated with an unknown device. A classifier executing one or more machine learning models may then classify the device as an internet of things (IoT) device or a non-IoT device.
Claims20
A method comprising:
- performing, by one or more computing devices:
- receiving network activity data associated with a plurality of devices in a network, including a first device labeled as an Internet-of-Things (IoT) device and a second device labeled as a non-IoT device;
- extracting one or more features from the network activity data, wherein the one or more features are included in a training data set;
- providing the training data set including the one or more features as input to a machine learning model;
- training the machine learning model using the training data set to classify unlabeled devices as IoT or non-IoT devices;
- after the training, using the machine learning model to identify another device in the network as another IoT device;
- and
- in response to the identifying of the other IoT device;
- labeling the other IoT device with an IoT label, and
- autonomously applying one or more security measures to the other IoT device including banning the other IoT device from the network, isolating the other IoT device, or limiting data sent by the other IoT device.
7 more elements
A system comprising:
- one or more computing devices configured to:
- receive network activity data associated with a plurality of devices in a network, including a first device labeled as an Internet-of-Things (IoT) device and a second device labeled as a non-IoT device;
- extract one or more features from the network activity data, wherein the one or more features are included in a training data set;
- provide the training data set including the one or more features as input to a machine learning model;
- train the machine learning model using the training data set to classify unlabeled devices as IoT or non-IoT devices;
- after the training, use the machine learning model to identify another device in the network as another IoT device;
- and
- in response to the identifying of the other IoT device;
- label the other IoT device with an IoT label, and autonomously apply one or more security measures to the other IoT device including banning the other IoT device from the network, isolating the other IoT device, or limiting data sent by the other IoT device.
6 more elements
One or more non-transitory computer-readable media storing program instructions that when executed on one or more processors cause the one or more processors to:
- receive network activity data associated with a plurality of devices in a network, including a first device labeled as an Internet-of-Things (IoT) device and a second device labeled as a non-IoT device;
- extract one or more features from the network activity data, wherein the one or more features are included in a training data set;
- provide the training data set including the one or more features as input to a machine learning model;
- train the machine learning model using the training data set to classify unlabeled devices as IoT or non-IoT devices;
- after the training, use the machine learning model to identify another device in the network as another IoT device;
- and
- in response to the identifying of the other IoT device;
- label the other IoT device with an IoT label, and autonomously apply one or more security measures to the other IoT device including banning the other IoT device from the network, isolating the other IoT device, or limiting data sent by the other IoT device.
5 more elements
Dependencies are inferred from the claim text.