Managing network traffic in the Internet of Things with federated machine learning

Description

BACKGROUND

[0001] Internet of Things (IoT) devices are widespread and take many forms. For example, a household can include wearable devices, home climate controllers, smart speakers, and smart appliances that are capable of connecting to the Internet via a network terminal, e.g., a satellite terminal. These terminals also process other types of network traffic, such as web browsing, video streaming, etc. US2019042937A1 relates to federated training of a neural network using trusted edge devices. An example system includes an aggregator device to aggregate model updates provided by one or more edge devices. The one or more edge devices implement respective neural networks, and provide the model updates to the aggregator device. At least one of the edge devices to implement the neural network is within a trusted execution environment. YAIR MEIDAN ET AL, "ProfilloT", APPLIED COMPUTING, ACM, 2 PENN PLAZA, SUITE 701 NEW YORK NY 10121-0701 USA, (20170403), ISBN 978-1-4503-4486-9, pages 506 - 509 relates to applying machine learning algorithms on network traffic data for accurate identification of loT devices connected to a network. To train and evaluate the classifier, network traffic data was collected and labeled from nine distinct loT devices, and PCs and smartphones. Using supervised learning, a multi-stage meta classifier was trained; in the first stage, the classifier can distinguish between traffic generated by loT and non-loT devices. In the second stage, each loT device is associated a specific loT device class.SUMMARY

[0002] In some implementations, a communication system, e.g., a satellite communication system, can train and use machine learning models to classify network traffic as loT traffic or non-loT traffic and manage the traffic based on the classification. For example, a computer system can train a global machine learning model using machine learning parameters received from multiple edge devices, e.g., multiple satellite terminals. The terminals can train local machine learning models based on local network traffic processed by the terminal, e.g., local network traffic received from devices connected to the terminals. The terminals can then send machine learning parameters of the trained models to the computer system. The machine learning parameters received from the terminals can include gradients and / or weights of a neural network trained by the terminals.

[0003] The computer system can aggregate the machine learning parameters and use the machine learning parameters to train a global machine learning model that classifies network traffic as being loT traffic or non-loT traffic. In some implementations, the computer system can also train a machine learning model to classify the type of IoT device from which network traffic is received in a similar manner, e.g., using machine learning parameters of local machine learning models trained by the terminals to classify network traffic based on the types of loT devices. The computer system can then provide the trained global model(s) to the terminals for classifying network traffic at the terminals.

[0004] In this way, the terminals can classify the network traffic locally, which enables the terminals to manage network traffic based on the classification without having to wait for a remote system to perform the classification. For example, the terminals can prioritize network traffic based on whether the traffic is loT traffic or non-loT traffic and / or based on the type of loT device (e.g., health monitoring device may have a higher priority than a toaster). The terminals can also use selective compression techniques based on the classification(s).

[0005] Training the global machine learning model(s) based on machine learning parameters received from terminals in this manner can result in more accurate and / or more robust models as the models are being trained based on a substantial amount of network traffic processed by many different terminals that may process different types of IoT and non-loT network traffic.

[0006] The machine learning models can be trained to classify network traffic based on characteristics of the network traffic, e.g., the size of data packets, time between successive data packets, the number of data packets in a data transmission, times at which data is sent to or received from a device, and / or patterns of network traffic. In this way, the terminals can use the machine learning models to distinguish between loT and non-loT network traffic without any explicit knowledge or configuration specific to the devices.

[0007] This use of machine learning models provides several advantages over rule-based systems that classify traffic based on the type of data packets and / or port numbers and that depend on deep packet inspection devices in the gateway to react to exceptions in the rule-based system. For example, streaming video downloads can look similar to HyperText Transfer Protocol Secure (HTTPS) traffic from a port and protocol perspective and can only be identified correctly by a gateway side device by deep packet inspective. This means that loT traffic would likely get incorrectly classified as generic HTTPS traffic by rule-based systems if non-standard port numbers are used, which is likely considering the vast number of different types of loT devices, different manufacturers, etc. In addition, since a substantial amount of loT traffic is push (e.g., upload to a cloud service) rather than pull (e.g., download from a web server), a gateway side traffic prioritization device would not be as useful in prioritizing loT traffic as a terminal side traffic prioritization device. For example, if the classification is performed at the gateway, the pushed traffic would not be prioritized at the terminal meaning that higher priority traffic may be delayed at the terminal while lower priority traffic is sent from the terminal to the gateway.

[0008] In one general aspect, the techniques disclosed herein describe methods of training machine learning models to classify network traffic as loT traffic or non-loT traffic. The invention is defined by the appended claims.

[0009] The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, the drawings, and the claims.BRIEF DESCRIPTION OF THE DRAWINGS

[0010] FIG. 1 is a diagram that illustrates an example of a system for using machine learning models to classify network traffic and manage the traffic based on the classification. FIG. 2 is a diagram that illustrates an example of a terminal that trains local machine learning models and uses global machine learning models to classify network traffic. FIG. 3 is a flow diagram that illustrates an example process for training local machine learning models to classify network traffic. FIG. 4 is a flow diagram that illustrates an example process for training a global machine learning model and providing the global machine learning model to terminals. FIG. 5 is a flow diagram that illustrates an example process for classifying network traffic and managing the network traffic based on the classification.

[0011] Like reference numbers and designations in the various drawings indicate like elements.DETAILED DESCRIPTION

[0012] FIG. 1 is a diagram that illustrates an example of a system 100 for using machine learning models to classify network traffic and manage the traffic based on the classification. The system 100 includes a satellite gateway 110 that communicates with a satellite 120, which in turn, communicates with satellite terminals 130a and 130b. The terminal 130a can transfer data between the gateway 110 and one or more devices 135a that are connected to the terminal 130a, e.g., via a wireless link. Similarly, the terminal 130b can transfer data between the gateway 110 and one or more devices 135b that are connected to the terminal 130b, e.g., via a wireless link.

[0013] The terminals 130a and 130b can process loT traffic and non-loT traffic. For example, many loT devices, such as wearable devices, smart appliances, smart thermostats, send data to remote devices via the gateway 110 and a network 150 connected to the gateway 110. For example, a wearable health monitoring device can send health-related data, e.g., blood pressure, of a person wearing the device to a server of a health monitoring service connected to the network 150. In this example, the device can connect to a terminal 130a, send the data to the terminal 130a, and the terminal 130a can send the data to the server of the health monitoring service via the satellite 120, the gateway 110, and the network 150. The terminals 130a and 130b can also process non-loT traffic, such as web browsing traffic, video streaming, etc. between the gateway 110 and terminals 130a and 130b.

[0014] For the purposes of this document, loT traffic is considered network traffic that is received from or sent to an loT device repetitively, e.g., periodically, without requiring a user intervention or initiation for the repetitive transmissions. For example, an loT device can send periodic updates based on a specified time period. In a particular example, a smart thermostat can send temperature measurements or settings once per hour. In contrast, a web browser of a computer may request web pages or other resources in response to user navigation or selection of controls on a web page and a video streaming device may download video in response to user requests. IoT traffic can also be considered repetitive network traffic that has up to a maximum data size.

[0015] Some devices can operate in an loT mode, while also generating and / or receiving non-loT traffic. For example, a smart television (TV) can send repetitive updates to user settings or receive repetitive updates to video listings while in an loT mode. The TV can also operate outside of this loT mode when sending user-generated requests for videos and / or receiving streaming video from a terminal. The machine learning models described in this document can differentiate between loT and non-loT traffic for devices that generate and / or receive both types of network traffic.

[0016] IoT traffic can have characteristics that differentiate it from non-loT traffic. For example, loT traffic from a given loT device tends to occur at a regular frequency and the data transmissions are typically similar (e.g., within a threshold difference) in data size. For example, a health monitoring device may send the same type of health related data every ten minutes. Being that the same type of data is sent each time, the data size is typically similar. In contrast, user-requested web browsing traffic and video streaming can vary widely based on the size of the web page or video and occurs at irregular frequencies (e.g., a user may spend more time viewing one web page than another).

[0017] The system 110 includes a computer system 140 that trains machine learning models to classify network traffic as loT traffic or non-loT traffic and / or to classify loT traffic based on the type of IoT device from which the traffic is received or to which the traffic is being sent. The computer system 140 can use federated machine learning techniques to train global machine learning models 138a and 138b using machine learning parameters 137a and 137b received from the terminals 130a and 130b. In general, the computer system 140 can provide, to multiple terminals, an initial machine learning model that becomes a local machine learning model at the terminal. Each of these terminals can update its local machine learning model based on its local network traffic. The terminals can provide machine learning parameters of their local machine learning models to the computer system 140. The computer system 140 can update a global machine learning model based on the machine learning parameters received from the terminals. The computer system 140 can then update the local machine learning models with the parameters of the global machine learning model. The computer system 140 and terminals can repeat this process until the global machine learning model is trained, e.g., until a loss function of the global machine learning model converges.

[0018] The terminals 130a and 130b include a machine learning module 131a and 131b, respectively. The machine learning module 131a can train and update a local machine learning model to classify network traffic processed by the terminal 130a as loT traffic or non-loT traffic based on characteristics of the network traffic. This local machine learning model is also referred to in this document as a local loT traffic classifier model. For example the devices 135a, which can include loT devices and non-loT devices, can send data to the gateway 110 by way of the terminal 130a. Similarly, the gateway 110 can send data to the devices 135a by way of the terminal 130a. The terminal 130a processes the data, e.g., receives and prepares the data for forwarding, in both directions.

[0019] In some implementations, the machine learning module 131a trains, as the local loT traffic classifier model, a local neural network using the network traffic that the terminal 130a processes for the devices 135a. In training a local machine learning model, the machine learning module 131a can determine parameters of the model, such as weights and / or biases of the model. The machine learning module 131a can also update the weights and / or biases based on computed gradients of a loss function with respect to the weights and / or biases. For example, when training a neural network using backpropagation, the machine learning module 131a can compute the gradient of the loss function with respect to weights of the neural network and update the weights to minimize loss.

[0020] The machine learning module 131a can train the local loT traffic classifier model based on characteristics of the network traffic processed by the terminal 130a. As a significant portion of network traffic is secured, the amount of data of the network traffic that can be used to train a local loT traffic classifier model and classify network traffic may be limited. Thus, the machine learning module 131a can train the local loT traffic classifier model based on the available characteristics, which can include a device type and / or manufacturer identifier included in data traffic for a device. For example, even if the data is secure, the data can include plaintext that may identify the type of device or manufacturer.

[0021] Another characteristic of network traffic that can be used to train the local loT traffic classifier model is the data size of network transmissions to or from devices. For example, loT traffic often has the same or similar data sizes, whereas the data size of other types of traffic may vary more widely.

[0022] Another characteristic of network traffic that can be used to train the local loT traffic classifier model is the frequency of network traffic sent to or from the devices. For example, loT traffic tends to be more periodic than other types of network traffic. The variance in time periods between data transmissions can also be used to train the local loT traffic classifier model the time periods between data transmissions for loT traffic tends to be more consistent than non-loT traffic.

[0023] The times at which a device sends or receives data can also be used to train the local loT traffic classifier model. For example, some loT devices may be configured to send updates at night when other network traffic may be at a minimum.

[0024] Another characteristic of network traffic that can be used to train the local loT traffic classifier model is the signal power of data transmissions to or from the devices. For example, a person wearing a smart watch can move around relative to a terminal 130a, which can cause changes in the signal power of data transmissions between the terminal 130a and the smart watch. Thus, loT traffic can have a higher variance than other types of network traffic, such as video streaming traffic. Another characteristic of network traffic that can be used to train the local loT classifier model is wake and sleep times for devices.

[0025] Using federated machine learning techniques, multiple terminals, e.g., terminals 130a and 130b can train a local loT traffic classifier model and provide the machine learning parameters of the local loT traffic classifier model to the computer system 140. For example, the machine learning module 131a can train a local loT traffic classifier model and provide machine learning parameters 137a of the local loT traffic classifier model to the computer system 140. Similarly, the machine learning module 131b can train a local loT traffic classifier model, in a similar manner as the machine learning module 131a, and provide machine learning parameters 137b of the local loT traffic classifier model to the computer system 140. These parameters 137a and 137b can include the weights and / or biases of the local loT traffic classifier models, the gradients, and / or other machine learning parameters.

[0026] In some implementations, the machine learning parameters 137a and 137b can include the characteristics of the network traffic and / or statistics of the network traffic used to train the local loT traffic classifier model. In either example, the terminals 130a and 130b can encrypt the machine learning parameters 137a and 137b prior to transmitting the machine learning parameters to the computer system 140, which can decrypt the machine learning parameters.

[0027] The terminals 130a and 130b can also train a second local machine learning model to classify the type of IoT device from which loT traffic is received based on characteristics of the network traffic. This local machine learning model is also referred to in this document as a local IoT device type model. For example, the machine learning modules 131a and 131b can train the local IoT device type model using the same or similar characteristics as used to train the local loT traffic classifier model. The output of the loT device type model is a type of device, e.g., smart watch, wearable health monitor, smart toaster, etc. The network traffic sent by the same types of loT devices can be similar in frequency, data sizes, time of day, etc. while different types of IoT devices can vary significantly. For example, a wearable health monitoring device can send data according to a strict frequency while a smart toaster may send data irregularly.

[0028] The terminals 130a and 130b can also provide, to the computer system 140, the machine learning parameters of the local IoT device type model. Although only two terminals are shown in FIG. 1, many terminals can train local machine learning models and provide the machine learning parameters of the models to the computer system 140. In some implementations, a proper subset of a set of all terminals can train local machine learning models and provide the parameters. For example, there may be thousands of terminals but only a few hundred train machine learning models and provide machine learning parameters of the models to the computer system 140. The subset of terminals that train the local loT traffic classifier models can be the same or different from the subset or terminals that train the local IoT device type models.

[0029] The computer system 140 includes a machine learning model parameter aggregator 141. The machine learning model parameter aggregator 141 receives the machine learning parameters for each type of machine learning model and aggregates the parameters for each model, e.g., separately. For example, the machine learning model parameter aggregator 141 can receive, from the subset of terminals, the machine learning parameters for the local loT traffic classifier models and aggregate these parameters. The machine learning model parameter aggregator 141 can also receive, from the subset of terminals, the machine learning parameters for the local IoT device type models and aggregate these parameters.

[0030] The computer system 140 also includes an loT traffic classifier model generator 143 that generates a global loT traffic classifier model using the aggregated machine learning parameters received for the local loT traffic classifier models. The computer system 140 can generate the global loT traffic classifier model by combining the machine learning parameters of the local loT traffic classifier models. For example, the computer system 140 can compute combined gradients and / or combined weights between nodes using the machine learning parameters. In some neural network implementations, combining weights of the neural networks can include averaging the weights of each link of the deep neural network reported by each terminal. In addition to a simple average, other forms of statistical summaries for combining the weights will also be tried.

[0031] The computer system 140 also includes an loT device type model generator 145 that generates a global loT device type model using he aggregated machine learning parameters received for the local IoT device type models. The computer system 140 can generate the global loT device type model by combining the machine learning parameters of the local loT device type models, in a similar manner as the global loT traffic classifier model.

[0032] In some implementations, the computer system 140 can then update each of the local machine learning models with the parameters of the global machine learning models. For example, the terminals can periodically send their machine learning parameters to the computer system 140 and the computer system 140 can update the global machine learning models based on the received parameters. The computer system 140 and terminals can repeat this process at least until the global machine learning models are trained. Once trained, the computer system 140 can provide the trained global machine learning models 138a and 138b to the terminals, e.g., the terminals 130a and 130b.

[0033] The computer system 140 can provide the trained global machine learning models to the subset of terminals that trained the local machine learning models and to other terminals. For example, the computer system 140 can provide the trained global machine learning models to all of the terminals in the satellite communication system. The terminals can use the trained global machine learning models to classify network traffic processed by the terminals as loT traffic or non-loT traffic and / or to classify the device from which network traffic is received.

[0034] In some implementations, the computer system 140 and the terminals can continue updating the local machine learning models and the global machine learning models even after the global machine learning models are trained. In this way, the models can adapt to new loT devices and / or to changes in the network traffic of IoT devices.

[0035] The terminals 130a and 130b also include a network traffic manager 132a and 132b, respectively. The network traffic managers 132a and 132b can manage network traffic based on the classification of the network traffic. For example, the network traffic managers 132a and 132b can be configured to prioritize loT traffic over non-loT traffic or vice versa. The network traffic managers 132a and 132b can be configured to assign respective priority values to loT traffic and non-loT traffic. The priority values represent the priority of the network traffic and can be used by the terminals 130a and 130b to prioritize the network traffic. That is, the terminals 130a and 130b can delay network traffic having a lower priority value in order to forward network traffic having a higher priority value.

[0036] The terminals 130a and 130b can also process loT traffic in a different way than non-loT traffic or based on the type of loT device. For example, the terminals 130a and 130b can compress loT traffic in a different way relative to how non-loT traffic is compressed. In another example, the terminals 130a and 130b can compress loT traffic from one type of loT device in a different manner relative to how traffic from a second type of loT device is compressed. In some implementations, the terminals 130a and 130b can route network traffic differently based on whether the network traffic is loT traffic or non-loT traffic, e.g., using different Wide Area Networks (WANs) and / or different satellites for loT traffic relative to the WAN(s) or satellite(s) for non-loT traffic. In another example, one type of network traffic can be sent using a satellite while the other type of network traffic can be sent using a terrestrial network, e.g., a mobile network. In another example, the terminals 130a and 130b can block network traffic for (e.g., to or from) a particular type of device, e.g., as a form of parental controls.

[0037] In some implementations, the terminals of different groups of users can receive different global machine learning models. For example, the types of loT devices and / or how they operate may vary based on geographic regions. In this example, terminals in a given geographic region can train local machine learning models that are used to generate global machine learning models for that geographic region. In another example, the computer system 140 can generate global machine learning models for each beam. In this example, the computer system 140 can generate the global machine learning models for a beam using machine learning parameters of local machine learning models trained by terminals within a geographic region covered by the beam.

[0038] FIG. 2 is a diagram that illustrates an example of a terminal 200 that trains local machine learning models and uses global machine learning models to classify network traffic. The terminal 130a and / or the terminal 130b of FIG. 1 can be implemented as the terminal 200.

[0039] The terminal 200 includes a machine learning module 220 and a network traffic manager 230. The machine learning module 220 can receive and process network traffic from multiple devices 205 connected to the terminal 200. These devices can include loT devices and non-loT devices. Although not shown, the machine learning module 220 can also receive and process network traffic being sent to the devices 205, e.g., that the terminal 200 received from a gateway.

[0040] The machine learning module 220 includes an loT traffic classifier 222 that uses a machine learning model to classify network traffic received by the terminal 200. The loT network classifier 222 can use the machine learning model to classify the network traffic to / from each device as loT traffic or non-loT traffic. For example, the loT network classifier 222 can provide, as inputs to the machine learning model, the characteristics of the network traffic received from or sent to the device. The machine learning model can output, based on the inputs, a classification as loT or non-loT traffic. In some cases, it may take the machine learning model multiple data transmissions from a device to classify the device as loT traffic or non-loT traffic.

[0041] Once classified, the network traffic received from or sent to the device can be considered that type of traffic and handled by the network traffic manager 230 according to the classification. In some implementations, the loT traffic classifier 222 uses a global loT traffic classifier model received from the computer system 140 to classify the network traffic for each device.

[0042] The machine learning module 220 also includes an loT device type classifier 224. The loT device type classifier 224 can use a machine learning model to classify each loT device connected to the terminal 200 to a type of loT device, e.g., as a wearable device, smart appliance, smart toaster, etc. For example, the loT device type classifier 224 can provide, as inputs to the machine learning model, the characteristics of the network traffic received from or sent to the loT device. The machine learning model can output, based on the inputs, a type of loT device. In some cases, it may take the machine learning model multiple data transmissions from a device to classify the type of the device.

[0043] Once classified, the network traffic manager 230 can handle traffic received from or being sent to the device based on the type of the device. In some implementations, the loT device type classifier 224 uses a global loT device type model received from the computer system 140 to classify the type of each loT device.

[0044] The machine learning module 220 also includes an loT traffic model trainer 226. The loT traffic model trainer 226 can train a local loT traffic classifier model based on the network traffic received from and / or sent to the devices 205. In some implementations, the loT traffic model trainer 226 can receive an initial loT traffic classifier model from the computer system 140 and update the loT traffic classifier model based on the network traffic received from and / or sent to the devices 205.

[0045] The loT traffic model trainer 226 can send machine learning parameters of the local loT traffic classifier model to the computer system 140, e.g., via the satellite 120. For example, the loT traffic model trainer 226 can periodically send the machine learning parameters of the local loT traffic classifier model to the computer system 140. As described above, the computer system 140 can update a global loT traffic classifier model based on the machine learning parameters received from multiple terminals. In some implementations, the computer system 140 can also provide the machine learning parameters of the global loT traffic classifier model to the terminals. The loT traffic model trainer 226 can update the local loT traffic classifier model with the updated machine learning parameters of the global loT traffic classifier model. The loT traffic model trainer 226 can then continue updating the local loT traffic classifier model based on the network traffic of the devices 205.

[0046] The machine learning module 220 also includes an loT device type model trainer 228. The loT device type model trainer 228 can train a local IoT device type model based on the network traffic received from and / or sent to the devices 205. In some implementations, the loT device type model trainer 228 can receive an initial loT device type model from the computer system 140 and update the loT device type model based on the network traffic received from and / or sent to the devices 205.

[0047] The loT device type model trainer 228 can send machine learning parameters of the local loT device type model to the computer system 140, e.g., via the satellite 120. For example, the loT device type model trainer 228 can periodically send the machine learning parameters of the local loT device type model to the computer system 140. As described above, the computer system 140 can update a global loT device type model based on the machine learning parameters received from multiple terminals. In some implementations, the computer system 140 can also provide the machine learning parameters of the global loT device type model to the terminals. The loT device type model trainer 228 can update the local IoT device type model with the updated machine learning parameters of the global loT device type model. The loT device type model trainer 228 can then continue updating the local loT device type model based on the network traffic of the devices 205.

[0048] In some implementations, the loT traffic classifier 222 and the loT device type classifier 224 use trained global machine learning models received from the computer system to perform their respective classifications. In some implementations, the loT traffic classifier 222 uses the local loT traffic classifier model trained by the loT traffic model trainer 226. In this way, the model used by the loT traffic classifier 222 is continually being updated based on the network traffic of the devices 205 connected to the terminal 200. Similarly, the loT device type classifier 224 can use the local loT device type model trained by the loT device type model trainer 228. In this way, the model used by the loT device typ classifier 224 is continually being updated based on the network traffic of the devices 205 connected to the terminal 200.

[0049] The network traffic manager 230 manages network traffic received from or being sent to the devices 205 based on the classification(s) output by the loT traffic classifier 222 and / or the IoT device type classifier 224. For example, the network traffic manager can prioritize loT traffic being sent from the terminal 200 to a gateway over non-loT traffic being sent from the terminal 200 to the gateway, or vice versa. Similarly, the network traffic manager 230 can prioritize network traffic based on the type of IoT device. The terminal 200 can also compress the data being transmitted differently based on whether the data is loT data, non-loT data, or based on the device type.

[0050] FIG. 3 is a flow diagram that illustrates an example process 300 for training local machine learning models to classify network traffic. The process 300 can be performed by an edge device, such as the terminals 131a and 131b of FIG. 1 or the terminal 200 of FIG. 2.

[0051] In step 302, the edge device receives network traffic from multiple devices (302). The network traffic can include, from each of the multiple devices, one or more data packets of one or more data transmissions. The devices can include different types of devices, e.g., one or more loT devices and one or more non-loT devices, that are connected to the edge device, e.g., over wireless links. The devices can also include different types of loT devices.

[0052] In step 304, the edge device trains a local machine learning model based on the received network traffic. The edge device can train a local loT traffic classifier model that classifies network traffic received from and / or being sent to a device as loT traffic or non-loT traffic based on characteristics of the network traffic. The edge device can train the local loT traffic classifier model using network traffic processed by the edge device, e.g., network traffic received from the devices connected to the edge device and / or network traffic being sent to the devices connected to the edge device.

[0053] The edge device can also train a local IoT device type model that classifies an loT device as a type of IoT device based on characteristics of network traffic received from the device or being sent to the device. The edge device can train the local IoT device type model using network traffic processed by the edge device, e.g., network traffic received from the devices connected to the edge device and / or network traffic being sent to the devices connected to the edge device.

[0054] As described above, a local machine learning model can be trained using an initial machine learning model. For example, the initial machine learning model can be updated based on the local network traffic processed by the edge device. Training a local machine learning model can include updating machine learning parameters, such as gradients, weights, and / or biases, to reduce a loss function for the local machine learning model.

[0055] In step 306, the edge device determines whether to send parameters of the local machine learning model(s) (306). In some implementations, the edge device sends the parameters of the machine learning model(s) based on a specified time period. In some implementations, the edge device sends parameters of a local machine learning model when a loss function converges or meets a training condition.

[0056] In step 308, the edge device sends the machine learning models to a computer system. For example, the edge device can send the machine learning parameters to the computer system 140 of FIG. 1 or another computer system that trains global machine learning models using parameters of local machine learning models. The machine learning parameters can include gradients, weights, biases, and / or other appropriate parameters of the local machine learning model(s).

[0057] FIG. 4 is a flow diagram that illustrates an example process 400 for training a global machine learning model and providing the global machine learning model to terminals. The process 400 can be performed by a computer system, such as the computer system 140 of FIG. 1.

[0058] In step 402, the computer system receives machine learning parameters from multiple edge devices. The machine learning parameters received from an edge device can be parameters of a local machine learning model being trained by the edge device. For example, the machine learning parameters can be parameters of a local loT traffic classifier model that classifies network traffic received from and / or being sent to a device as loT traffic or non-loT traffic based on characteristics of the network traffic. In another example, the machine learning parameters can be parameters of a local loT device type model that classifies an loT device as a type of loT device based on characteristics of network traffic received from the device or being sent to the device. As described above, the machine learning parameters can include gradients, weights, biases, and / or other appropriate parameters of the local machine learning model.

[0059] In step 404, the computer system trains a global machine learning model using the received machine learning parameters. This training can include updating the machine learning parameters of the global machine learning model based on the machine learning parameters of the local machine learning models. For example, the training can include computing gradients of the global machine learning model based on gradients of the local machine learning model. In another example, the training can include computing weights of the global machine learning model based on weights of the local machine learning models. In some neural network implementations, combining weights of the neural networks can include averaging the weights of each link of the deep neural network reported by each terminal.

[0060] In step 406, the computer system determines whether the global machine learning model is trained. For example, the computer system can determine whether a loss function of the global machine learning model has converged.

[0061] If not, the process 400 can return to step 402 in which updated machine learning model parameters are received from multiple edge devices. For example, the edge devices can continue training the local machine learning models. In some implementations, each time the global machine learning model is updated, the machine learning parameters of the global machine learning model are sent to the edge devices that are training the local machine learning models. The edge devices can update the local machine learning models using the received parameters and continue training the updated local machine learning models.

[0062] In step 408, if the global machine learning model is trained, the computer system sends the global machine learning model to edge devices. The edge devices can then use the global machine learning model to classify network traffic, e.g., as loT traffic or non-loT traffic or to a type of loT device.

[0063] The computer system and edge devices can continue training and updating the global and local machine learning models using the process 400. The updated global machine learning model can be made available to edge devices after each update. The edge devices can be configured to download the latest global machine learning model periodically or in response to an update to the global machine learning model.

[0064] FIG. 5 is a flow diagram that illustrates an example process for classifying network traffic and managing the network traffic based on the classification. The process 500 can be performed by an edge device, such as the terminals 131a and 131b of FIG. 1 or the terminal 200 of FIG. 2.

[0065] In step 502, the edge device receives a machine learning model. The edge device can receive a first global machine learning model that classifies network traffic as loT traffic or non-loT traffic based on various characteristics of the network traffic, as described above. The edge device can also receive a second global machine learning model that classifies loT devices to one or more types of IoT devices.

[0066] In step 504, the edge device receives network traffic. For example, the edge device can receive data packets from a device connected to the edge device over a wireless link.

[0067] In step 506, the edge device classifies the network traffic using the received machine learning model(s). For example, the edge device can evaluate the network traffic to identify characteristics of the network traffic. The edge device can then provide these characteristics as inputs to the first global machine learning model, which classifies the network traffic as loT network or non-loT traffic based on the features.

[0068] The edge device can also use the second global machine learning model that classifies loT devices to one or more types of devices, e.g., in response to the first global machine learning model classifying the network traffic as loT traffic. The second global machine learning model can use the same features as the first global machine learning model or different features from the first global machine learning model.

[0069] In step 508, the edge device can manage network traffic based on the classification(s). In some implementations, the edge device can prioritize non-loT traffic over loT traffic. For example, a user uploading content may take priority over an appliance sending information to a web server. Traffic from some types of loT devices can take priority over other loT devices. For example, network traffic from a health monitoring device can take priority over network traffic from a temperature controller.

[0070] The edge device can be configured to assign respective priority values to loT traffic and non-loT traffic. The priority values represent the priority of the network traffic and can be used by the edge device to prioritize the network traffic. That is, the edge device can delay network traffic having a lower priority value in order to forward network traffic having a higher priority value.

[0071] The edge device can also process loT traffic in a different way than non-loT traffic or based on the type of loT traffic. For example, the edge device can compress loT traffic in a different way relative to how non-loT traffic is compressed. In another example, the edge device can compress loT traffic from one type of loT device in a different manner relative to how traffic from a second type of loT device is compressed.

[0072] Embodiments of the invention and all of the functional operations described in this specification may be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Embodiments of the invention may be implemented, in part, as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a computer-readable medium for execution by, or to control the operation of, data processing apparatus. The computer readable medium may be a non-transitory computer readable storage medium, a machine-readable storage device, a machine-readable storage substrate, a memory device, a composition of matter effecting a machine-readable propagated signal, or a combination of one or more of them. The term "data processing apparatus" encompasses all apparatuses, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. The apparatus may include, in addition to hardware, code that creates an execution environment for the computer program in question, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0073] A computer program (also known as a program, software, software application, script, or code) may be written in any form of programming language, including compiled or interpreted languages, and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program does not necessarily correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub programs, or portions of code). A computer program may be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and interconnected by a communication network.

[0074] The processes and logic flows described in this specification may be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows may also be performed by, and apparatus may also be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit).

[0075] While this specification contains many specifics, these should not be construed as limitations on the scope of the invention or of what may be claimed, but rather as descriptions of features specific to particular embodiments of the invention. Certain features that are described in this specification in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination may in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.

[0076] Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems may generally be integrated together in a single software product or packaged into multiple software products.

[0077] Thus, particular embodiments of the invention have been described. Other embodiments are within the scope of the following claims.

Claims

1. A method (400) performed by one or more computers, the method comprising: receiving (402), from each of at least a subset of a set of edge devices (130a, 130b), machine learning parameters (137a, 137b) of a local machine learning model trained by the edge device, the machine learning parameters received from an edge device being parameters of the local machine learning model trained (i) by the edge device based on local network traffic processed by the edge device and (ii) to classify the network traffic as Internet of Things, loT, traffic or non-loT traffic; generating (404), using the machine learning parameters received from the subset of edge devices, a plurality of global machine learning models (143) to classify network traffic processed by edge devices as loT traffic or non-loT traffic, wherein generating, using the machine learning parameters received from the subset of edge devices, the plurality of global machine learning models to classify the network traffic processed by edge devices as loT traffic or non-loT traffic comprises training respective global machine learning models for different groups of users or edge devices; and providing (408), for each of the different groups of users or edge devices, the corresponding global machine learning model (143) to edge devices in the group or edge devices of users in the group, for use in classifying network traffic processed by the edge devices as loT traffic or non-loT traffic.

2. The method of claim 1, wherein each edge device (130a, 130b) trains the local machine learning model of the edge device using local network traffic received from devices connected to the edge device.

3. The method of claim 1 or claim 2, wherein one or more of the plurality of edge devices (130a, 130b) comprise satellite terminals.

4. The method of any one of claims 1-3, wherein the machine learning parameters (137a, 137b) received from a given edge device (130a, 130b) comprise at least one of (i) weights between nodes of the local machine learning model trained by the given edge device or (ii) gradients of loss functions used by the given edge device to train the local machine learning model.

5. The method of any one of claims 1-4, wherein the machine learning parameters (137a, 137b) received from a given edge device (130a, 130b) comprises statistical data that includes a plurality of statistics of the network traffic processed by the given edge device.

6. The method of any one of claims 1-5, wherein each local machine learning model and each global machine learning model (143) are trained to classify network traffic as loT traffic or non-loT traffic based on at least one of (i) a data size of data packets received from a plurality of devices, (ii) a frequency at which the devices transmit data, (iii) an amount of time between successive transmissions by the devices; or (iv) changes in received signal power of data packets received from the devices.

7. The method of any one of claims 1-6, further comprising: receiving (402), from the subset of edge devices, second machine learning parameters of a second local machine learning model trained by the edge device, wherein the edge device trains the second local machine learning model to classify loT traffic to one or more types of loT devices; training (404), using the second machine learning parameters received from the subset of edge devices, a second global machine learning model configured to classify loT traffic to the one or more types of loT devices; and providing (408) the second global machine learning model to the set of edge devices.

8. The method of any one of claims 1-7, further comprising: receiving updated machine learning parameters from one or more edge devices; updating one or more of the global machine learning models (143) using the updated machine learning parameters; and providing the one or more updated global machine learning models (143).

9. The method of claim 1, wherein each group of users or edge devices corresponds to a given geographic area different from a geographic area for each other group of users.

10. A system, comprising: one or more computers; and one or more computer-readable media storing instructions that, when executed by the one or more computers, cause the one or more computers to perform the method of claims 1 to 9.

11. One or more computer-readable media storing instructions that, when executed by one or more computers, cause the one or more computers to perform the method of claims 1 to 9.