Kernel Space Packet Processing for IoT Device Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of Internet of Things (IoT) devices in networks poses security challenges due to their vulnerability to attacks, with existing machine-learning-based detection methods being impractical for large-scale environments and prone to the curse of dimensionality, and requiring frequent retraining to recognize new devices.
Innovation Solution
Efficient kernel space packet processing and IoT device classification are achieved through intelligent packet dropping and a novel feature extractor, using kernel space packet processing to identify IoT devices by their network information, extracting header information from packets associated with predetermined protocols, and applying a machine-learning model to classify devices with a variable-length feature set.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine-learning-based detection methods are used to identify IoT devices, then detection accuracy is improved, but the system becomes impractical for large-scale environments and requires frequent retraining
Solution Approach 1:
The patent extracts only the essential header information from packets (source/destination IP addresses, ports, protocol types) rather than using complete packet data. This extraction approach maintains detection accuracy while reducing the dimensionality of input features, making the system scalable and eliminating the need for frequent retraining in large-scale IoT environments
Solution Approach 2:
The patent changes the parameters being analyzed by focusing on specific packet header fields rather than entire packet contents. This parameter selection strategy reduces the curse of dimensionality and creates a streamlined detection model that remains effective across large-scale deployments without requiring frequent updates
2Measurement precision
If complete packet data is processed for IoT device detection, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system extracts only critical header information (source/destination IP addresses, ports, protocol types) from packets, discarding unnecessary packet contents. This extraction significantly reduces processing time and computational resource requirements while maintaining the ability to accurately identify IoT devices through their network communication patterns
Solution Approach 2:
The patent applies partial action by processing only the essential header portion of packets rather than complete packet data. This partial processing approach is sufficient for IoT device detection purposes and dramatically reduces the time and computational resources needed compared to analyzing entire packets
3Reliability
If all packets are processed and forwarded through the network stack, then network functionality is maintained, but processing overhead and energy consumption increase
Solution Approach 1:
The system extracts and processes only packet header information in kernel space, separating this lightweight processing from the full network stack processing. This extraction enables the system to maintain network functionality for packets that need it while efficiently handling and dropping packets that don't require complete processing, thereby reducing overall energy consumption
Solution Approach 2:
The patent applies partial action by processing only the header portion of packets through the detection system, rather than forwarding all packets through the complete network stack. This partial processing approach maintains necessary network functionality while significantly reducing energy consumption by avoiding unnecessary full-stack processing
Data Source
AI summary
Systems and methods for efficient kernel space packet processing and IoT device classification are provided. According to an embodiment, a computer system receives a packet in kernel space, ascertains whether the packet is destined for the computer system, when the ascertaining is affirmative the packet is forwarded to user space; otherwise, it is determined whether the packet is associated with a protocol used by IoT devices. When the determination is affirmative, header information is extracted from the packet, and subsequent IoT device detection processing is facilitated by sending the header information to the user space. The same or a separate computer system may perform the IoT device detection processing based on the header information by for each identified TCP or UDP flow: creating a variable-length feature set; and inferring whether the TCP or UDP flow represents an IoT device or a non-IoT device communication by applying an ML model.