IoT MUD Policy Generation via Traffic Pattern Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The adoption of Manufacturer Usage Description (MUD) policies in IoT networks is hindered by inconsistent manufacturer support and the need for manual profiling of legacy devices, which is time-consuming and non-scalable, especially for the vast number of IoT devices entering enterprise networks.

Innovation Solution

A classification device analyzes network data to classify IoT devices and generates derived MUD policies using machine learning techniques, creating context-based policies when no manufacturer-provided policy exists, allowing for dynamic and continuous updates based on observed traffic patterns and policy violation logs.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual profiling methods are used for legacy IoT devices, then security policy coverage is improved, but time consumption and operational complexity increase significantly

Engineering Contradiction:

Improvesecurity policy coverageVSAvoidtime consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system enables self-service by allowing the classification device to automatically generate MUD policies for legacy devices without manual intervention. The device profiles itself by analyzing its traffic patterns and generating appropriate security policies autonomously, eliminating the need for time-consuming manual profiling while maintaining comprehensive security coverage

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Manual mechanical profiling operations are replaced with automated machine learning-based classification. The classification device uses ML models to automatically analyze device behavior, identify traffic patterns, and generate MUD policies, substituting the manual mechanical process with an automated intelligent system that operates at scale without proportional increases in time consumption

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If manual profiling methods are deployed for IoT devices, then policy coverage for legacy devices is improved, but scalability deteriorates due to the sheer number of devices

Engineering Contradiction:

Improvepolicy coverageVSAvoidscalability

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

Manual profiling operations are replaced with automated machine learning-based classification and policy generation. The system processes large volumes of device data through ML models that automatically identify patterns and generate MUD policies, enabling the system to scale to thousands of devices without proportional increases in operational effort

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system creates reusable MUD policy templates based on classified device types. Once a policy is generated for one device of a particular type, the same policy template can be copied and applied to other devices of the same type, dramatically improving scalability while maintaining comprehensive policy coverage across the entire device fleet

Inventive Principle:

Principle #26Copying

3Reliability

If manufacturer-provided MUD policies are used, then security enforcement is improved, but adaptability to legacy and diverse IoT devices deteriorates

Engineering Contradiction:

Improvesecurity enforcementVSAvoiddevice compatibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system transitions from static manufacturer-provided policies to dynamic generated policies that adapt to each device's actual behavior. The classification device continuously monitors traffic patterns and updates MUD policies accordingly, allowing the security enforcement mechanism to adapt to legacy devices and diverse IoT variants that manufacturers may not have anticipated

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs preliminary classification and analysis of device behavior before finalizing security policies. By analyzing traffic patterns and device characteristics in advance, the system can generate appropriate MUD policies for legacy devices without compromising security enforcement, preparing the security framework ahead of time rather than reacting to device diversity

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10841164B2Online generation and updates of IoT mud policies

Publication Date: 2020.11.17 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a classification device in a computer network analyzes data from a given device in the computer network, and classifies the given device as a particular type of device based on the data. The classification device may then determine whether a manufacturer usage description (MUD) policy exists for the particular type of device. In response to there being no existing MUD policy for the particular type of device, the classification device may then determine patterns of the analyzed data, classify the patterns into context-based policies, and generate a derived MUD policy for the particular type of device based on the context-based policies. The classification device may then apply one of either the existing or derived MUD policy for the given device within the computer network.