Back to results
US 2020/0120122 A1Published application
Multi-dimensional periodicity detection of iot device behavior
AssigneeZingBox, Ltd.
InventorsJun Du, Mei Wang
Life of this patent
Estimating the term…
Abstract
Techniques for detecting anomalous behavior of an Internet-of-Things (IoT) device in an IoT network. IoT events of an IoT device are captured and analyzed to identify periodic activities of the IoT device. The periodic activities of the IoT device are tracked over time, and variations in the periodic activities are analyzed to assess potential threats to the IoT network.
Claims21
A method comprising:
- capturing IoT events associated with a first IoT device and a first IoT application;
- generating IoT signal features from the IoT events, at least some the IoT signal features being associated with activities of the first IoT device and the first IoT application;
- extracting background event context from the IoT events;
- generating periodic activity instance descriptors based on the IoT signal features and the background event context;
- extracting external context from non-active IoT events;
- identifying periodic activities of the first IoT device based on the periodic activity instance descriptors and the external context;
- determining expected periodicities of the periodic activities of the first IoT device;
- detecting activities of the first IoT device;
- matching the detected activities of the first IoT device to the expected periodicities.
6 more elements
A system comprising:
- an event capture engine configured to capture IoT events associated with a first IoT device and a first IoT application;
- an IoT signal feature generation engine configured to:
- generate IoT signal features from the IoT events, at least some the IoT signal features being associated with activities of the first IoT device and the first IoT application;
- extract background event context from the IoT events;
- a periodicity discovery engine configured to generate periodic activity instance descriptors based on the IoT signal features and the background event context;
- a content extraction engine configured to extract external context from non-active IoT events;
- a periodic activity generation engine configured to:
- identify periodic activities of the first IoT device based on the periodic activity instance descriptors and the external context;
- determine expected periodicities of the periodic activities of the first IoT device;
- an anomalous periodic activity IoT network threat assessment engine configured to:
- detect activities of the first IoT device;
- match the detected activities of the first IoT device to the expected periodicities.
9 more elements
A system comprising:
- means for capturing IoT events associated with a first IoT device and a first IoT application;
- means for generating IoT signal features from the IoT events, at least some the IoT signal features being associated with activities of the first IoT device and the first IoT application;
- means for extracting background event context from the IoT events;
- means for generating periodic activity instance descriptors based on the IoT signal features and the background event context;
- means for extracting external context from non-active IoT events;
- means for identifying periodic activities of the first IoT device based on the periodic activity instance descriptors and the external context;
- means for determining expected periodicities of the periodic activities of the first IoT device;
- means for detecting activities of the first IoT device;
- means for matching the detected activities of the first IoT device to the expected periodicities.
6 more elements
Dependencies are inferred from the claim text.