Device Profiling via Text Classification and Vector Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional device classification methods, such as manually developed fingerprints, fail to provide accurate and scalable solutions for network-connected devices, especially in the context of IoT and industrial IoT systems, due to their inability to handle partial property resolution and deliver fuzzy classifications.
Innovation Solution
The application of natural language processing to raw device properties data collected from network-connected entities, generating text strings that are then processed to create numerical multi-dimensional vectors for device classification, allowing for automated model generation and updating, and enabling robust and scalable entity profiling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manually developed fingerprints are used for device classification, then domain expertise can be leveraged, but scalability and accuracy deteriorate due to inability to handle partial property resolution
Solution Approach 1:
The patent replaces manual fingerprint development by security researchers with an automated machine learning system. The system uses gradient boosting classifiers and text classification models to automatically generate device fingerprints from network traffic data, eliminating the need for manual rule creation while improving scalability and accuracy in handling partial property resolution.
Solution Approach 2:
The system enables automated model generation and updating where the classification models self-improve by automatically learning from new network traffic data. The models can be regenerated without human intervention, allowing the system to adapt to new device types and maintain accuracy as the network environment evolves.
2Ease of operation
If conventional fingerprinting methodologies are used, then simple matching rules can be applied, but robustness deteriorates when properties are only partially resolved
Solution Approach 1:
The patent transforms discrete property matching into continuous probability-based classification. Instead of requiring exact matches on all properties, the system uses gradient boosting classifiers to evaluate multiple properties and generate probability scores, allowing robust classification even when some properties are missing or partially resolved.
Solution Approach 2:
The system performs classification with partial property resolution by using ensemble methods that can work with incomplete data. The gradient boosting classifier evaluates available properties and makes classification decisions based on partial information, rather than requiring complete property sets for matching.
3Adaptability or versatility
If manually developed fingerprints are used, then specific device types can be identified, but adaptability deteriorates for fuzzy classifications and new device types
Solution Approach 1:
The patent creates a universal classification system using gradient boosting classifiers that can handle multiple device types and classification scenarios through a single model architecture. The text classification approach and embedding generation provide a unified framework that adapts to different device types without requiring separate fingerprint rules for each category.
Data Source
AI summary
Systems and methods for generating an entity classification model using text classification of raw text information of entities are described. Generating the classification model includes obtaining raw text information associated with a plurality of entities, converting the raw text information for each entity of the plurality of entities into one or more character strings, generating a numerical vector for each entity of the plurality of entities based on the one or more character strings for each entity, and selecting, based on the numerical vectors for each entity of the plurality of entities, one or more entity properties to be used for entity classification. A classification of a first entity coupled to a network is performed based on the one or more selected entity properties.