Device Profiling via Runtime Signature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network segmentation techniques lack a robust solution for real-time device identification and analysis, failing to account for constantly changing device vulnerabilities and security status in IoT networks, which hampers effective microsegmentation and security.
Innovation Solution
A novel system employing a hybrid of Pearson correlation and deep learning long short-term memory (LSTM) and Sigmoid logistics for device profiling, enabling real-time classification and microsegmentation based on unique device signatures, thereby addressing dynamic device characteristics and security status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network segmentation techniques are used, then network segmentation is provided, but real-time device identification and analysis capability is insufficient
Solution Approach 1:
The patent transforms device identification from static parameter matching to dynamic behavioral analysis by monitoring multiple runtime parameters (CPU usage, memory consumption, network traffic patterns, system calls) and using their temporal changes to generate unique device signatures. This enables accurate real-time identification by analyzing how parameters evolve over time rather than relying on fixed characteristics.
Solution Approach 2:
The patent creates a composite device signature by combining multiple analysis methods (univariate analysis of individual features, multivariate analysis of correlated features, and temporal pattern recognition). This composite approach integrates diverse data sources and analysis techniques to produce a robust identification mechanism that overcomes the limitations of any single method.
2Measurement precision
If device profiling with multiple analysis methods is implemented, then device identification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent divides the complex profiling system into distinct modular components: univariate analysis module for individual feature examination, multivariate analysis module for correlated features, and signature generation module for synthesizing results. Each module handles a specific aspect of analysis, making the overall complex system manageable through clear segmentation of responsibilities and processing stages.
Solution Approach 2:
The patent introduces a feature selection layer as an intermediary between raw device data and the analysis engines. This intermediary filters and preprocesses data by identifying relevant features and their correlations before passing them to univariate and multivariate analysis modules, reducing the complexity burden on downstream components while maintaining identification accuracy.
3Reliability
If dynamic device behavior analysis is performed, then microsegmentation effectiveness is enhanced, but data processing requirements increase
Solution Approach 1:
The patent extracts only the most discriminative features from the full set of device parameters through univariate and multivariate analysis. By identifying and isolating key features that uniquely characterize device behavior patterns, the system reduces the volume of data that needs to be continuously processed while maintaining the reliability needed for effective microsegmentation.
Solution Approach 2:
The patent performs preliminary analysis during device onboarding and idle periods to establish baseline behavior patterns and generate initial device signatures. This preliminary action prepares identification models in advance, reducing the data processing burden during active microsegmentation operations by relying on pre-computed signatures rather than analyzing all raw data in real-time.
Data Source
AI summary
A method may include receiving data from a device within a network, wherein the data is associated with one or more features of the device, and determining a subset of the features of the device that is associated with a runtime behavior of the device. The method may also perform a univariate analysis on a feature dataset that is associated with the subset of the features of the device, perform a multivariate analysis on the feature dataset that is associated with correlated features in the subset of the features, and generate a device signature based on the univariate analysis and the multivariate analysis. The method may also generate a predictive model based on the device signature, wherein the predictive model is trained on historical data of devices in the network, generate a device profile based on the predictive model that may be used to determine a device type and the runtime behavior of the device, and determine a segment of the network associated with the device based on the device type and the runtime behavior of the device.