Manufacturer-Specific Port Usage Models for Device Type Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions struggle to accurately profile devices accessing networks due to the lack of industry standards for querying device information and the reliance on rules-based mechanisms that require manual definition, tuning, and maintenance.
Innovation Solution
A method and system for inferring device types based on port usage behavior using machine learning models trained for specific manufacturers, where each model predicts device types by analyzing ports used and volumes of traffic communicated via those ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rules-based mechanisms are used for device profiling, then device behavior can be monitored, but manual definition, tuning, and maintenance are required which increases operational complexity
Solution Approach 1:
The system enables automatic device type inference through machine learning models that self-train on network traffic data. The models automatically update and adapt to new device types without requiring manual rule definition or tuning, allowing the system to serve itself in terms of profile creation and maintenance.
Solution Approach 2:
The patent replaces manual rules-based mechanisms with automated machine learning models. Instead of security analysts manually creating and maintaining rules, the system uses ML models trained on traffic patterns to automatically infer device types, substituting mechanical manual processes with automated intelligent systems.
2Measurement precision
If device type information is obtained through industry standards, then profiling accuracy improves, but lack of standardized querying methods increases implementation complexity
Solution Approach 1:
Instead of querying devices directly for type information (which would require industry standards), the system inverts the approach by analyzing network traffic patterns to infer device type. The inference flows from observable behavior back to device identity, eliminating the need for standardized device responses.
Solution Approach 2:
The machine learning models serve as intermediaries between raw network traffic data and device type classification. Rather than directly extracting device information from devices, the ML models mediate by learning patterns from traffic data and translating them into device type predictions.
3Measurement precision
If manufacturer-specific models are used, then inference accuracy for each manufacturer improves, but the number of models to maintain increases
Solution Approach 1:
The system implements dynamic model selection where the appropriate manufacturer-specific model is automatically chosen based on the device's manufacturer identifier. This allows the system to adaptively switch between different specialized models without requiring all models to be actively maintained simultaneously, managing complexity through dynamic routing.
Solution Approach 2:
The patent segments the device profiling task into multiple manufacturer-specific models, each specialized for a particular manufacturer. This segmentation allows each model to be smaller and more specialized, improving accuracy for that manufacturer while the overall system manages complexity through modular organization and selective deployment.
Data Source
AI summary
A system and method for inferring device types. A method includes selecting a device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; and determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected device type inference model to a plurality of features, wherein the plurality of features is extracted from device activity data indicating ports used by the device and at least one volume of traffic communicated via each port used by the device.