Device Type Identification via Behavior Attribute Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing device classification methods, particularly rule-based classification, often misclassify devices by grouping multiple types together based on fixed properties and fail to identify devices of the same type that do not match these properties, leading to incorrect identification of unknown device types.
Innovation Solution
The method involves identifying device types based on behavior attributes, such as statistical properties and network behavior attributes, using a clustering equation to group devices with similar behavior attributes and assigning appropriate identifiers, with the aid of a recommendation engine that suggests or creates device identifiers based on these attributes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If rule-based classification is used to group devices based on fixed properties, then device classification can be achieved, but misclassification occurs when devices of different types share the same fixed properties or when devices of the same type have varying properties
Solution Approach 1:
The patent transitions from using fixed static properties to using dynamic behavior attributes for device classification. Behavior attributes include statistical properties (packet sizes, inter-arrival times, transmission rates) and network behavior attributes (protocol usage, port access patterns, connection states) that change over time and better represent actual device characteristics, thereby improving identification accuracy while maintaining classification feasibility
Solution Approach 2:
The patent implements dynamic device classification by continuously monitoring behavior attributes over time windows and updating device type identifications. The system captures behavioral data at multiple time points, analyzes changes in behavior patterns, and adapts classifications dynamically rather than relying on static fixed properties, resolving the contradiction between ease of classification and accuracy
2Measurement precision
If behavior attributes are used to identify device types, then device identification accuracy is improved, but the complexity of the classification system increases
Solution Approach 1:
The patent segments behavior attributes into distinct categories: statistical properties (packet size distributions, inter-arrival times, transmission rates) and network behavior attributes (protocol usage, port access patterns, connection states). This segmentation allows the system to process complex behavior data in manageable components, reducing overall system complexity while maintaining high identification accuracy through multi-dimensional analysis
Solution Approach 2:
The patent introduces behavior profiles as intermediary representations that capture typical behavior patterns for different device types. These profiles serve as mediators between raw behavior attributes and device type classifications, simplifying the comparison process by providing standardized reference patterns against which unknown devices can be matched, thereby reducing classification system complexity
3Reliability
If clustering based on behavior attributes is implemented, then misclassification is reduced, but the computational resources and time required for analysis increase
Solution Approach 1:
The patent applies partial action by analyzing only the most discriminative behavior attributes and using time-windowed sampling rather than continuous monitoring of all device behaviors. The system captures behavioral data at strategic intervals and focuses on key distinguishing features, achieving high classification reliability while significantly reducing the computational time and resources required compared to exhaustive analysis approaches
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An example non-transitory memory resource including instructions executable by the processing resource to monitor device information for a plurality of devices, wherein the plurality of devices comprise at least one device of an unknown device type, identify behavior attributes for the plurality of devices based on the monitored device information, cluster the plurality of devices into groups based on the behavior attributes, identify a device type for the plurality of devices based on the group of the plurality of devices; and present identifiers for each of the plurality of devices, based on the device type of the plurality of devices.