IOT device risk assessment and scoring
AssigneePalo Alto Networks, Inc.
InventorJun Du
Life of this patent
Estimating the term…
Abstract
Techniques for establishing a risk score for Internet of Things (IoT) device parameters and acting in response thereto are disclosed. One or more data packets transmitted to or from an Internet of Things (IoT) device are analyzed to obtain event parameters. The event parameters are analyzed to determine a context of the IoT device. A behavior of the IoT device is determined based at least in part on the event parameters and the context. A progressive risk score is obtained for the IoT device. Subsequent to obtaining the progressive risk assessment score, the progressive risk assessment score is updated based at least in part on an analysis of one or more additional data packets.
Claims20
A method, comprising:
- analyzing one or more data packets transmitted to or from an Internet of Things (IoT) device over a network to which the IoT device is connected to obtain event parameters;
- analyzing the event parameters to determine a context of the IoT device;
- determining behavior of the IoT device based at least in part on the event parameters and the context of the IoT device;
- obtaining a progressive risk assessment score for the IoT device;
- subsequent to obtaining the progressive risk assessment score for the IoT device, updating the progressive risk assessment score based at least in part on analysis of one or more additional data packets;
- and
- sending an alert via the network when it is determined that the progressive risk assessment score exceeds a threshold.
A system, comprising:
- a processor configured to:
- analyze one or more data packets transmitted to or from an Internet of Things (IoT) device over a network to which the IoT device is connected to obtain event parameters;
- analyze the event parameters to determine a context of the IoT device;
- determine behavior of the IoT device based at least in part on the event parameters and the context of the IoT device;
- obtain a progressive risk assessment score for the IoT device;
- subsequent to obtaining the progressive risk assessment score for the IoT device, update the progressive risk assessment score based at least in part on analysis of one or more additional data packets;
- and
- send an alert via the network when it is determined that the progressive risk assessment score exceeds a threshold;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A computer program product embodied on a non-transitory medium, the computer program product including instructions which, when the computer program product is executed by a computer, cause the computer to carry out a method comprising:
- analyzing one or more data packets transmitted to or from an Internet of Things (IoT) device over a network to which the IoT device is connected to obtain event parameters;
- analyzing the event parameters to determine a context of the IoT device;
- determining behavior of the IoT device based at least in part on the event parameters and the context of the IoT device;
- obtaining a progressive risk assessment score for the IoT device;
- subsequent to obtaining the progressive risk assessment score for the IoT device, updating the progressive risk assessment score based at least in part on analysis of one or more additional data packets;
- and
- sending an alert via the network when it is determined that the progressive risk assessment score exceeds a threshold.
Dependencies are inferred from the claim text.