# US 2021/0279565 A1 · Systems And Methods For Device Fingerprinting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0279565 A1 - Document ID: US20210279565A1 - Status: Published application - Kind: A1 - Application number: 16/809,309 - Filed: 2020-03-04 - Published: 2021-09-09 - Earliest claimed: 2020-03-04 - Assignees: Wootcloud Inc. - Applicants: WootCloud Inc. - Inventors: Srinivas Akella; Shahab Sheikh-Bahaei - Web page: https://patentgrep.com/patent/US20210279565A1 ## CPC - G06N 3/08: Learning methods - H04W 12/08: Access security - G06N 3/04: Architecture, e.g. interconnection topology - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/09: Supervised learning - H04K 1/00: Secret communication - H04L 63/102: {Entity profiles} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/71: Hardware identity - H04W 12/79: Radio fingerprint - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04K: SECRET COMMUNICATION; JAMMING OF COMMUNICATION - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods to continuously classify temporal communication data associated with a computing device are described. In one embodiment, temporal communication data associated with the computing device is accessed and processed to create a plurality of preprocessing models. The preprocessing models are used to train a neural network. The neural network derives one or more properties associated with the computing device from the temporal communication data. A device fingerprint is defined from the one or more properties. Subsequent to defining the device fingerprint, additional temporal communication data associated with the computing device is accessed. The neural network derives one or more additional properties associated with the computing device from the additional temporal communication data. The one or more additional properties are aggregated into the defined device fingerprint, refining the defined device fingerprint. ## Claims ### Claim 1 A method to continuously classify temporal communication data associated with a computing device, the method comprising: accessing temporal communication data associated with the computing device; processing the temporal communication data to create a plurality preprocessing models; training, using data generated by the preprocessing models, a neural network; deriving, by the neural network, one or more properties associated with the computing device from the temporal communication data; defining, a device fingerprint from the one or more properties; subsequent to defining the device fingerprint, accessing additional temporal communication data associated with the computing device; deriving, by the neural network, one or more additional properties associated with the computing device from the additional temporal communication data; and aggregating the one or more additional properties into the defined device fingerprint refining the defined device fingerprint. ### Claim 2 (depends on 1) The method of claim 1, wherein the neural network is a convolutional neural network. ### Claim 3 (depends on 1) The method of claim 1, wherein the temporal communication data includes data associated with a wireless communication protocol or a wired communication protocol. ### Claim 4 (depends on 3) The method of claim 3, wherein the wireless communication protocol is any of WiFi, Bluetooth, Bluetooth Low Energy, Zigbee, Long-Term Evolution, mobile network data, ultrasound, or an optical communication protocol. ### Claim 5 (depends on 3) The method of claim 3, wherein the wired communication protocol is any of Ethernet, SCADA, USB, IoT, or an arbitrary network protocol. ### Claim 6 (depends on 1) The method of claim 1, wherein the refining is performed on a continuous basis. ### Claim 7 (depends on 1) The method of claim 1, further comprising: detecting a radio interface information for each interface supported by the computing device; detecting an operating system, a type, and a classification associated with the computing device; detecting a micro location of the computing device; detecting a mobility of the computing device; detecting an ownership and control of the computing device; and detecting protocol and data characteristics of the computing device. ### Claim 8 (depends on 1) The method of claim 1, wherein the properties are any combination of RF signal strength, spectrum analysis, MAC address, one or more frames, transmission rate, medium access frame size, and inter packet arrival. ### Claim 9 (depends on 1) The method of claim 1, further comprising generating a label responsive to generating the defined device fingerprint. ### Claim 10 (depends on 9) The method of claim 9, further comprising generating a policy to control access to and from the computing device. ### Claim 11 An apparatus to continuously classify temporal communication data associated with a computing device, the apparatus comprising: a database configured to store temporal communication data associated with the computing device; a processing system configured to process the data to create a plurality of preprocessing models; and a neural network, wherein the neural network is trained using data generated by the preprocessing models, wherein the neural network derives one or more properties associated with the computing device from the temporal communication data, wherein the neural network defines a device fingerprint from the one or more properties, wherein the neural network accesses additional temporal communication data, wherein the neural network derives one or more additional properties associated with the computing device from the additional temporal communication data, and wherein the neural network aggregates the one or more additional properties into the defined fingerprint refining the defined device fingerprint. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the neural network is a convolutional neural network. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the temporal communication data includes data associated with a wireless communication protocol or a wired communication protocol. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the wireless communication protocol is any of WiFi, Bluetooth, Bluetooth Low Energy, Zigbee, Long-Term Evolution, mobile network data, ultrasound, or an optical communication protocol. ### Claim 15 (depends on 13) The apparatus of claim 13, wherein the wired communication protocol is any of Ethernet, SCADA, USB, IoT, or an arbitrary network protocol. ### Claim 16 (depends on 11) The apparatus of claim 11, wherein the temporal communication data is comprised of historical communication data and communication data for a present time interval. ### Claim 17 (depends on 11) The apparatus of claim 11, wherein the properties are any combination of RF signal strength, spectrum analysis, MAC address, one or more frames, transmission rate, medium access frame size, and inter packet arrival. ### Claim 18 (depends on 11) The apparatus of claim 11, further comprising a network gateway, wherein the network gateway receives the temporal communication data from the computing device, and wherein the network gateway stores the temporal communication data on the database. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the network gateway includes a wireless sensor array and a network traffic sensor array. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the wireless sensor array includes a WiFi packet sniffer and a Bluetooth packet sniffer.