US 12,015,622 B2Granted

Privacy-preserving online botnet classification system utilizing power footprint of IoT connected devices

OwnerGang Zhou, Woosub Jung +4inventors

InventorsGang Zhou, Woosub Jung, Chunsheng Xin, Danella Zhao, Yizhou Feng, Sabbir Ahmed Khan

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method for the detection and system impact mitigation of bots in Internet of Things (IoT) devices, the system including a smart auditor configured to interface with and control a power supply of an IoT device, the smart auditor being configured to measure and transmit power usage information of the IoT device. The system then utilizing a historical database and various IoT devices and associated power usage patterns to identify anomalies in power usage by the IoT device based on historical data, utilize machine learning to recognize normal and non-normal power usage patterns, and generate a command to shut off power to the IoT device upon detection of malicious botnet activity. The system including encryption protocols to maintain privacy during communication of the power usage information as well as maintain integrity and secrecy regarding model information from the historical database.

Claims20

Dependent claims

A system for the detection and system impact mitigation of bots in Internet of Things (IoT) devices, the system comprising:

a smart auditor configured to interface with and control a power supply of an IoT device, the smart auditor comprising:
a power data processing unit configured to measure current power usage information from the IoT device;
a networking module configured to receive and transmit the power usage information;
and
a power control unit configured to control the power supply of the IoT device;
a primary remote server;
and
an intermediate server provided between the smart auditor and the primary remote server configured to receive the power usage information from the smart auditor, encrypt the power usage information, and transmit the encrypted power usage information;
the primary remote server comprising:
a primary processor;
and
a primary non-transitory computer-readable medium containing an IoT power usage database containing historical power usage information of various IoT devices in normal operation modes and know infected operation modes, wherein the primary non-transitory computer-readable medium contains instructions for the primary processor to perform the following tasks:
receive information regarding a model of the IoT device;
receive encrypted power usage information from the intermediate server;
compare the current power usage information to historical power usage information correlating to the particular model of the IoT device in both normal operation and in an infected state indicative of malicious bot activity on the IoT device thus generating comparison data;
encrypt the comparison data;
obtaining the comparison data;
and
transmit the encrypted comparison data to the intermediate server;
the intermediate server comprising:
an intermediate processor;
and
an intermediate non-transitory computer-readable medium, the intermediate non-transitory computer-readable medium containing instructions for the intermediate processor to perform the following tasks:
receive the encrypted comparison data from the primary remote server;
decrypt the comparison data;
determine indications of bot activity within the IoT device based on comparison data;
generate one or more recommended instructions for the smart auditor;
and
transmit one or more recommended instructions to the smart auditor, wherein upon a determination of an infected state of the IoT device, at least one recommended instruction being for the power control unit of the smart auditor to interrupt power;
and
wherein the smart auditor is configured to execute the one or more recommended instructions.

28 more elements

A method for the detection and mitigation of system impact of bots in Internet of Things (IoT) devices, the method comprising:

providing a smart auditor configured to interface with, and control, a power supply of an IoT device, the smart auditor comprising:
a power data processing unit configured to measure current power usage information from the IoT device;
a networking module configured to receive and transmit the power usage information;
and
a power control unit configured to control the power supply of the IoT device;
and
providing a primary remote server;
providing an intermediate server provided between the smart auditor and the primary remote server,
the primary remote server comprising:
a primary processor;
and
a primary non-transitory computer-readable medium containing an IoT power usage database containing historical power usage information of IoT devices in normal operation modes and infected operation modes;
measuring, by way of the smart auditor, current power usage information from the IoT device;
receiving information regarding a model of the IoT device by the intermediate server;
transmitting information regarding the current power usage information of the IoT device from the smart auditor to the intermediate server;
encrypting information regarding a model of the IoT device at the intermediate server;
encrypting current power usage information from the IoT device at the intermediate server;
transmitting the encrypted current power usage information and the encrypted information regarding a model of the IoT device to the primary remote server;
receiving the encrypted current power usage information from the IoT device at the primary remote server;
comparing the current power usage information to historical power usage information correlating to the particular model of the IoT device in both normal operation and in an infected state indicative of malicious bot activity on the IoT device, thus generating comparison information;
encrypting the comparison information;
obtaining the encrypted comparison information at the primary remote server;
transmitting the encrypted comparison information from the primary remote server to the intermediate server;
decrypting the encrypted comparison information at the intermediate server;
determining indications of bot activity within the IoT device based on the comparison information at the intermediate server;
generating one or more recommended instructions upon determination of bot activity at the intermediate server;
transmitting the one or more recommended instructions from the intermediate server to the smart auditor;
and
causing the smart auditor to execute the one or more recommended instructions.

26 more elements

A system for the detection and system impact mitigation of bots in Internet of Things (IoT) devices, the system comprising:

a smart auditor configured to interface with and control a power supply of an IoT device, the smart auditor comprising:
a power data processing unit configured to measure current power usage information from the IoT device;
a networking module configured to receive and transmit the power usage information;
and
a power control unit configured to control the power supply of the IoT device;
and
an intermediate server configured to receive IoT device model information and current power usage information from the smart auditor, encrypt and transmit the IoT device model information and current power usage information;
a primary remote server configured to receive the encrypted power usage information from the intermediate server;
the primary remote server further comprising:
a primary processor;
and
a primary non-transitory computer-readable medium containing a IoT power usage database containing historical power usage information of IoT devices in normal operation modes and infected operation modes, wherein the primary non-transitory computer-readable medium contains instructions for the primary processor to perform the following tasks:
receive the information regarding a model of the IoT device;
receive the information regarding the current power usage information of the IoT device;
compare the current power usage information to historical power usage information correlating to the particular model of the IoT device in both normal operation and in an infected state indicative of malicious bot activity on the IoT device;
obtaining all data regarding a comparison in the encrypted form between known power usage of the particular model of IoT device within the historical and the current power usage information of the IoT device
transmit the encrypted data regarding a comparison between known power usage of the particular model of IoT device within the historical and the current power usage information of the IoT device to the intermediate server;
the intermediate server being provided between the smart auditor and the primary remote server, the intermediate server further comprising:
an intermediate processor;
and
an intermediate non-transitory computer-readable medium, the intermediate non-transitory computer-readable medium containing instructions for the intermediate processor to perform the following tasks:
encrypt all data transmitted to the primary remote server regarding the IoT device;
receive and decrypt the encrypted data regarding a comparison between known power usage of the particular model of IoT device within the historical and the current power usage information of the IoT device to the intermediate server;
and
determine indications of bot activity based on the comparison received from the remote primary server;
generate one or more recommended instructions for execution by the smart auditor;
and
transmit the one or more recommended instructions to the power control unit of the smart auditor;
wherein the power control unit of the smart auditor is then configured to execute the one or more recommended instructions from the intermediate server;
and
a convolutional neural network model for classification of the current power usage information from the IoT device being deployed across the primary remote server and the intermediate server, wherein the primary remote server and the intermediate server are non-colluding.

28 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/669,540Filed 11 Feb 2022 · us provisional application
Priority: 1 Mar 2021
Published: US 2022/0278995 A11 Sep 2022
Granted: 18 Jun 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06N 3/04
Neural networks: architecture, e.g. interconnection topology
G06N 3/045
Architecture, e.g. interconnection topology: combinations of networks
G06N 3/0464
Architecture, e.g. interconnection topology: convolutional networks [CNN, ConvNet]

Family

Application63/154,958Us provisional application · filed 1 Mar 2021
US 2022/0278995 A1Pre-grant publication · published 1 Sep 2022
US 12,015,622 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key