# US 12,216,459 B2 · System and method for inferring device type based on port usage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,459 B2 - Document ID: US12216459B2 - Status: Granted - Kind: B2 - Application number: 17/523,362 - Filed: 2021-11-10 - Published: 2023-05-11 - Granted: 2025-02-04 - Earliest claimed: 2021-11-10 - Assignees: Armis Security Ltd. - Applicants: Armis Security Ltd. - Inventors: Yuval Friedlander; Gil Ben Zvi; Tom Hanetz; Ron Shoham - Web page: https://patentgrep.com/patent/US12216459B2 ## CPC - G05B 19/41885: {characterised by modeling, simulation of the manufacturing system} - G06N 20/20: Ensemble learning - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06N 5/04: Inference or reasoning models - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for inferring device types. A method includes selecting a device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; and determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected device type inference model to a plurality of features, wherein the plurality of features is extracted from device activity data indicating ports used by the device and at least one volume of traffic communicated via each port used by the device. ## Claims ### Claim 1 A method for inferring device types, comprising: selecting a manufacturer-specific device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; determining, from device activity data of the device, a port usage distribution indicating traffic volumes for each port used by the device, wherein the device activity data indicates ports used by the device and at least one volume of traffic communicated via each port used by the device; extracting a plurality of features from device activity data of the device and the port usage distribution; and determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected manufacturer-specific device type inference model to the extracted plurality of features. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the distribution of port usage further comprises: applying a distribution dissimilarity model to the port usage distributions, wherein the distribution dissimilarity model outputs a plurality of distances, wherein each distance is based on a difference between a distribution of values for each port indicated in the port usage distribution and a distribution of values for each corresponding port of each of a plurality of device types capable of being output by the selected manufacturer-specific device type inference model, wherein the extracted plurality of features includes the plurality of distances. ### Claim 3 (depends on 1) The method of claim 1, further comprising: adding the inferred device type for the device to a device profile of the device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: normalizing a plurality of manufacturer values among the device activity data, wherein the manufacturer of the device is determined based on the normalized plurality of manufacturer values. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining a manufacturer of the device based on the device activity data, wherein the respective manufacturer for each of the plurality of device type inference models is the determined manufacturer. ### Claim 6 (depends on 1) The method of claim 1, further comprising: monitoring behavior of the device with respect to the inferred device type in order to detect at least one abnormal behavior of the device. ### Claim 7 (depends on 6) The method of claim 6, wherein the abnormal behavior is a deviation from a predetermined normal behavior associated with the inferred device type. ### Claim 8 (depends on 6) The method of claim 6, further comprising: performing at least one mitigation action based on the detected at least one anomaly in behavior of the device. ### Claim 9 A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: selecting a manufacturer-specific device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; determining, from device activity data of the device, a port usage distribution indicating traffic volumes for each port used by the device, wherein the device activity data indicates ports used by the device and at least one volume of traffic communicated via each port used by the device; extracting a plurality of features from device activity data of the device and the port usage distribution; and determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected manufacturer-specific device type inference model to the extracted plurality of features. ### Claim 10 A system for inferring device types, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: select a manufacturer-specific device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; determine, from device activity data of the device, a port usage distribution indicating traffic volumes for each port used by the device, wherein the device activity data indicates ports used by the device and at least one volume of traffic communicated via each port used by the device; extract a plurality of features from device activity data of the device and the port usage distribution; and determine an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected manufacturer-specific device type inference model to the extracted plurality of features. ### Claim 11 (depends on 10) The system of claim 10, wherein the system is further configured to: apply a distribution dissimilarity model to the port usage distributions, wherein the distribution dissimilarity model outputs a plurality of distances, wherein each distance is based on a difference between a distribution of values for each port indicated in the port usage distribution and a distribution of values for each corresponding port of each of a plurality of device types capable of being output by the selected manufacturer-specific device type inference model, wherein the extracted plurality of features includes the plurality of distances. ### Claim 12 (depends on 10) The system of claim 10, wherein the system is further configured to: add the inferred device type for the device to a device profile of the device. ### Claim 13 (depends on 10) The system of claim 10, wherein the system is further configured to: normalize a plurality of manufacturer values among the device activity data, wherein the manufacturer of the device is determined based on the normalized plurality of manufacturer values. ### Claim 14 (depends on 10) The system of claim 10, wherein the system is further configured to: determine a manufacturer of the device based on the device activity data, wherein the respective manufacturer for each of the plurality of device type inference models is the determined manufacturer. ### Claim 15 (depends on 10) The system of claim 10, wherein the system is further configured to: monitor behavior of the device with respect to the inferred device type in order to detect at least one abnormal behavior of the device. ### Claim 16 (depends on 15) The system of claim 15, wherein the abnormal behavior is a deviation from a predetermined normal behavior associated with the inferred device type. ### Claim 17 (depends on 15) The system of claim 15, wherein the system is further configured to: perform at least one mitigation action based on the detected at least one anomaly in behavior of the device.