Back to results
US 2019/0387011 A1Published application
Pattern match-based detection in iot security
AssigneeZingBox, Ltd.
InventorsJun Du, Mei Wang, Hector Daniel Egalado, Jianhong Xia
Life of this patent
Estimating the term…
Abstract
Techniques for providing Internet of Things (IoT) security are disclosed. An applicable system includes profiling IoT devices to limit the number of network signatures applicable to the IoT devices and performing pattern matching using a pattern that is appropriate for the profile of a given IoT device.
Claims20
A method of detecting undesirable behavior of an Internet-of-Things (IoT) device, the method comprising:
- associating a first subset of patterns of a superset of patterns with a first IoT device profile of a plurality of IoT device profiles;
- attributing the first IoT device profile to a first IoT device;
- detecting first IoT device events, the first IoT device events including one or more network sessions of the first IoT device;
- generating an activity data structure from the first IoT device events and from other events;
- determining an activity of the first IoT device based on the activity data structure;
- applying the first subset of patterns to the activity of the first IoT device;
- generating an alert when the application of the first subset of patterns to the activity of the first IoT device is indicative of undesirable behavior for a device to which the first IoT device profile is attributed.
4 more elements
A system comprising:
- an IoT device activity pattern matching engine configured to associate a first subset of patterns of a superset of patterns with a first IoT device profile of a plurality of IoT device profiles;
- an IoT device profiling engine configured to attribute the first IoT device profile to a first IoT device;
- an IoT device event detection engine configured to detect first IoT device events, the first IoT device events including one or more network sessions of the first IoT device;
- an IoT device activity generation engine configured to generate an activity data structure from the first IoT device events and from other events;
- wherein the IoT device activity pattern matching engine is further configured to:
- determine an activity of the first IoT device based on the activity data structure;
- apply the first subset of patterns to the activity of the first IoT device;
- generate an alert when the application of the first subset of patterns to the activity of the first IoT device is indicative of undesirable behavior for a device to which the first IoT device profile is attributed.
5 more elements
Dependencies are inferred from the claim text.