# US 12,224,984 B2 · IoT device application workload capture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,984 B2 - Document ID: US12224984B2 - Status: Granted - Kind: B2 - Application number: 18/520,385 - Filed: 2023-11-27 - Published: 2024-03-21 - Granted: 2025-02-11 - Earliest claimed: 2021-03-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Jun Du - Web page: https://patentgrep.com/patent/US12224984B2 ## CPC - H04L 43/062: related to network traffic - H04L 63/0254: {Stateful filtering} - G16Y 10/75: Information technology; Communication - G16Y 30/10: Security thereof - H04L 41/06: Management of faults, events, alarms or notifications - H04L 41/0681: Configuration of triggering conditions - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 43/12: Network monitoring probes - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L 41/0894: Policy-based network configuration management - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT] - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Internet of Things (IoT) device application workload capture is disclosed. A target IoT device is selected. A flow associated with the target IoT device is determined and tagged. Packets from the tagged flow are admitted into a ring buffer. An indication is received that an extraction should be performed on a portion of the packets included in the ring buffer. ## Claims ### Claim 1 A system, comprising: a processor configured to: select a target IoT device; determine and tag a flow associated with the target IoT device; admit packets from the tagged flow into a ring buffer; receive an indication that an extraction should be performed on a portion of the packets included in the ring buffer; and extract the portion of the packets; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the target IoT device is selected at least in part based on a detection of an elevation of a risk score. ### Claim 3 (depends on 2) The system of claim 2, wherein the risk score is elevated based at least in part on a determination of an applicability of a known exploit to the target IoT device. ### Claim 4 (depends on 2) The system of claim 2, wherein the risk score is elevated based at least in part on an observation of an attempted exploit of the target IoT device. ### Claim 5 (depends on 1) The system of claim 1, wherein the target IoT device is selected at least in part based on a URL with which the target IoT device communicates. ### Claim 6 (depends on 1) The system of claim 1, wherein the indication is received as part of a time-based trigger. ### Claim 7 (depends on 1) The system of claim 1, wherein the indication is received in response to a generation of an alert. ### Claim 8 (depends on 1) The system of claim 1, wherein the extracted portion of the packets is provided to a network traffic analysis system. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor is further configured to receive an indication to stop admitting packets associated with the target IoT device into the ring buffer. ### Claim 10 (depends on 9) The system of claim 9, wherein the indication to stop admitting the packets is received in response to a predefined number of sessions associated with the target IoT device. ### Claim 11 A method, comprising: selecting a target IoT device; determining and tagging a flow associated with the target IoT device; admitting packets from the tagged flow into a ring buffer; receiving an indication that an extraction should be performed on a portion of the packets included in the ring buffer; and extracting the portion of the packets. ### Claim 12 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: selecting a target IoT device; determining and tagging a flow associated with the target IoT device; admitting packets from the tagged flow into a ring buffer; receiving an indication that an extraction should be performed on a portion of the packets included in the ring buffer; and extracting the portion of the packets. ### Claim 13 (depends on 11) The method of claim 11, wherein the target IoT device is selected at least in part based on a detection of an elevation of a risk score. ### Claim 14 (depends on 13) The method of claim 13, wherein the risk score is elevated based at least in part on a determination of an applicability of a known exploit to the target IoT device. ### Claim 15 (depends on 13) The method of claim 13, wherein the risk score is elevated based at least in part on an observation of an attempted exploit of the target IoT device. ### Claim 16 (depends on 11) The method of claim 11, wherein the target IoT device is selected at least in part based on a URL with which the target IoT device communicates. ### Claim 17 (depends on 11) The method of claim 11, wherein the indication is received as part of a time-based trigger. ### Claim 18 (depends on 11) The method of claim 11, wherein the indication is received in response to a generation of an alert. ### Claim 19 (depends on 11) The method of claim 11, wherein the extracted portion of the packets is provided to a network traffic analysis system. ### Claim 20 (depends on 11) The method of claim 11, further comprising receiving an indication to stop admitting packets associated with the target IoT device into the ring buffer. ### Claim 21 (depends on 20) The method of claim 20, wherein the indication to stop admitting the packets is received in response to a predefined number of sessions associated with the target IoT device.