# US 2023/0053883 A1 · Network traffic monitoring for anomalous behavior detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0053883 A1 - Document ID: US20230053883A1 - Status: Published application - Kind: A1 - Application number: 17/492,568 - Filed: 2021-10-02 - Published: 2023-02-23 - Earliest claimed: 2021-08-18 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: John O'CONNELL; Ravi SAXENA; Bo WANG - Web page: https://patentgrep.com/patent/US20230053883A1 ## CPC - H04L 43/065: related to network devices - H04L 43/0817: by checking functioning - H04L 43/0823: Errors, e.g. transmission errors - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 67/143: Termination or inactivation of sessions, e.g. event-controlled end of session - H04L 69/14: Multichannel or multilink protocols - H04L 41/0894: Policy-based network configuration management - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/16: Threshold monitoring - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example implementations relate to changing a status of a device responsive to detecting an anomaly. A traffic pattern of a device may be monitored across a network. It may be determined that the monitored traffic pattern deviates from an expected traffic pattern of the group of devices by a threshold. Responsive to determining that the devices deviates from the expected traffic pattern, packet data transmitted by the device may be inspected. It may be determined that the inspected packet data transmitted by the device is anomalous. The status of the device may be changed responsive to determining that the packet data transmitted by the device is anomalous. ## Claims ### Claim 1 A method comprising: monitoring a traffic pattern of a device of a group of devices in a network; determining that the traffic pattern of the device deviates from an expected traffic pattern of the group of devices by a threshold; responsive to determining that the device deviates from the expected traffic pattern, inspecting packet data transmitted by the device; determining that the packet data transmitted by the device is anomalous; and responsive to determining that the packet data transmitted by the device is anomalous, changing a status of the device. ### Claim 2 (depends on 1) The method of claim 1, wherein a traffic pattern includes at least one of an amount of sessions established over a period of time, a total duration of time sessions are established over the period of time, or a volume of data transmitted over the period of time. ### Claim 3 (depends on 1) The method of claim 1, wherein the device may be determined to deviate from the expected traffic pattern where the device establishes a session over a second network slice at a greater than expected frequency than a first network slice. ### Claim 4 (depends on 1) The method of claim 1, wherein the packet data transmitted by the device is determined to be anomalous where the packet data includes a destination address not of a list of destination addresses associated with the group of devices. ### Claim 5 (depends on 1) The method of claim 1, wherein a Charging Network Function (CHF) monitors the traffic pattern of the device. ### Claim 6 (depends on 5) The method of claim 5, further comprising tracking, by a Session Management Function (SMF), each session established by the device; and transmitting, by the SMF, session summary information associated with the device to the CHF. ### Claim 7 (depends on 1) The method of claim 1, wherein a Policy Control Function (PCF) inspects the packet data transmitted by the device, and changes the status of the device responsive to determining that the packet data transmitted by the device is anomalous. ### Claim 8 A system comprising: a Charging Network Function (CHF) to: monitor a traffic pattern of a device of a group of devices in a network; and determine that the traffic pattern of the device deviates from an expected traffic pattern of the group of devices by a threshold; and a Policy Control Function (PCF) to: responsive to determining that the device deviates from the expected traffic pattern, inspect packet data transmitted by the device; determine that the packet data transmitted by the device is anomalous; and responsive to determining that the packet data transmitted by the device is anomalous, changing the status of the device. ### Claim 9 (depends on 8) The system of claim 8, wherein a traffic pattern includes at least one of an amount of sessions established over a period of time, a total duration of time sessions are established over the period of time, or a volume of data transmitted over the period of time. ### Claim 10 (depends on 9) The system of of claim 9, further comprising a Session Management Function (SMF) to: track each session established by the device; and transmit session summary information associated with the device to the CHF. ### Claim 11 (depends on 10) The system of claim 10, wherein the SMF spans multiple instances, each SMF instance deployed at each network slice in the network. ### Claim 12 (depends on 8) The system of claim 8, wherein changing the status of the device includes at least one of disabling the device, prohibiting the device from starting a new session, or throttling the device. ### Claim 13 (depends on 8) The system of claim 8, wherein changing the status of the device includes assigning the device to a different network slice. ### Claim 14 A non-transitory computer readable medium including instructions thereon, wherein the instructions, when executed by a processor, cause the processor to: monitor a traffic pattern of a device of a group of devices in a network; determine that the traffic pattern of the device deviates from an expected traffic pattern of the group of devices by a threshold; responsive to determining that the device deviates from the expected traffic pattern, inspect packet data transmitted by the device; determine that the packet data transmuted by the device is anomalous; and responsive to determining that the packet data transmitted by the device is anomalous, change the status of the device. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, further comprising instructions to determine an average traffic pattern of at least a subset of the group of devices, wherein the expected traffic pattern of the group of devices is the determined average traffic pattern. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein determining the average traffic pattern of at least a subset of the group of devices comprises instructions to sample a number of devices of the group of devices periodically. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, further comprising instructions to divide the group of devices into subgroups of devices, wherein the group of devices is divided according to determined traffic pattern ranges. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, further comprising instructions to, upon onboarding a new device, assign the new device to the group of devices where the new device exhibits a traffic pattern within a range of the expected traffic pattern of the group of devices. ### Claim 19 (depends on 14) The non-transitory computer readable medium of claim 14, wherein changing the status of the device includes at least one of disabling the device, prohibiting the device from starting a new session, or throttling the device. ### Claim 20 (depends on 14) The non-transitory computer readable medium of claim 14, wherein changing the status of the device includes moving a service flow of the device to a different network slice.