IoT Device Identification Using Time-Series ML in Enterprise Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures are inadequate for detecting and preventing malware attacks on Internet of Things (IoT) devices, particularly in enterprise networks, due to their unmanaged nature and lack of support for standard protocols like RADIUS, leading to potential catastrophic security breaches.
Innovation Solution
Implementing an IoT server within a data appliance that passively monitors network traffic to identify and classify IoT devices, providing AAA support by generating proxy messages on their behalf, and using machine learning models to enhance device discovery and classification, enabling fine-grained policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security measures are used to protect IoT devices, then general network security is maintained, but IoT devices remain vulnerable to malware attacks due to their unmanaged nature and lack of protocol support
Solution Approach 1:
The patent introduces an intermediary system that sits between the network and IoT devices, translating standard security protocols into device-specific communication patterns. This mediator enables secure management of IoT devices without requiring the devices themselves to support standard protocols, thus resolving the contradiction between security reliability and protocol adaptability
Solution Approach 2:
The system creates virtual representations or models of IoT devices and their behavior patterns. By copying normal device communication patterns and comparing actual traffic against these models, the system can identify malware without requiring direct protocol support from the IoT devices, thereby maintaining both security and protocol versatility
2Difficulty of detecting and measuring
If passive monitoring is implemented to identify IoT devices, then device discovery capability is improved, but system complexity increases due to machine learning model integration
Solution Approach 1:
The system segments the device discovery function into multiple independent components: passive traffic capture, feature extraction, machine learning classification, and device profiling. Each component operates independently with well-defined interfaces, reducing overall system complexity while improving discovery capability through specialized processing at each stage
Solution Approach 2:
The machine learning models are trained offline using historical traffic data and deployed as pre-trained classifiers. During runtime, the system only needs to feed captured traffic patterns into these self-contained models, which automatically perform classification without requiring complex real-time processing logic, thus simplifying the operational system architecture
3Measurement precision
If machine learning models are used for device classification, then classification accuracy is improved, but processing time increases due to computational requirements
Solution Approach 1:
The system performs preliminary feature extraction and traffic pattern normalization before feeding data to machine learning models. By pre-processing the traffic data to extract only the most relevant features and normalize variations in communication patterns, the system reduces the computational burden during classification while maintaining high accuracy through focused analysis of key indicators
Data Source
AI summary
Identifying Internet of Things (IoT) devices with packet flow behavior including by using machine learning models is disclosed. A set of training data associated with a plurality of IoT devices is received. The set of training data includes, for at least some of the exemplary IoT devices, a set of time series features for applications used by the IoT devices. A model is generated, using at least a portion of the received training data. The model is usable to classify a given device.