Back to results
US 11,777,965 B2Granted
Pattern match-based detection in IoT security
AssigneePalo Alto Networks, Inc.
InventorsJun Du, Mei Wang, Hector Daniel Regalado, Jianhong Xia
Life of this patent
Estimating the term…
Abstract
Techniques for providing Internet of Things (IoT) security are disclosed. An applicable system includes profiling IoT devices to limit the number of network signatures applicable to the IoT devices and performing pattern matching using a pattern that is appropriate for the profile of a given IoT device.
Claims40
A method of detecting undesirable behavior of an Internet-of-Things (IoT) device, the method comprising:
- associating a first subset of patterns of a superset of patterns with a first IoT device profile of a plurality of IoT device profiles;
- attributing the first IoT device profile to a first IoT device;
- detecting first IoT device events, the first IoT device events including one or more network sessions of the first IoT device;
- generating an activity data structure from the first IoT device events and from other events, including by abstracting at least one of the first IoT device events or the other events, wherein the abstracting of the at least one of the first IoT device events or the other events entails a loss of data associated with events in favor of a more useful characterization of activities associated with IoT devices, wherein the generated activity data structure comprises a labeled collection of events, and wherein at least one of the other events comprises a non-network event;
- determining an activity of the first IoT device based on the activity data structure;
- applying the first subset of patterns to the activity of the first IoT device;
- and
- generating an alert when an application of the first subset of patterns to the activity of the first IoT device is indicative of undesirable behavior for a device to which the first IoT device profile is attributed.
5 more elements
A system comprising:
- a processor configured to:
- associate a first subset of patterns of a superset of patterns with a first IoT device profile of a plurality of IoT device profiles;
- attribute the first IoT device profile to a first IoT device;
- detect first IoT device events, the first IoT device events including one or more network sessions of the first IoT device;
- generate an activity data structure from the first IoT device events and from other events, including by abstracting at least one of the first IoT device events or the other events, wherein the abstracting of the at least one of the first IoT device events or the other events entails a loss of data associated with events in favor of a more useful characterization of activities associated with IoT devices, wherein the generated activity data structure comprises a labeled collection of events, and wherein at least one of the other events comprises a non-network event;
- determine an activity of the first IoT device based on the activity data structure;
- apply the first subset of patterns to the activity of the first IoT device;
- and
- generate an alert when an application of the first subset of patterns to the activity of the first IoT device is indicative of undesirable behavior for a device to which the first IoT device profile is attributed;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
8 more elements
Dependencies are inferred from the claim text.