Network Behavior Analysis for Medical Device Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security management technologies for medical devices lack the ability to automatically identify and track devices connected to networks, especially those not compliant with standardized protocols, leading to inefficient management and security challenges.
Innovation Solution
A device identification apparatus based on network behavior that collects packet data through port mirroring, extracts behavior features, and uses deep-learning techniques to generate unique information for device identification, enabling automatic recognition and security policy establishment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standardized protocols (DICOM, HL7) are used for device identification, then device identification accuracy is improved, but device compatibility deteriorates because many medical devices do not comply with standardized protocols
Solution Approach 1:
The patent changes the identification parameters from protocol-based fields (device ID, name, model in standardized packets) to behavior-based features (packet timing intervals, data volume patterns, communication frequency, destination diversity). This allows identification of devices regardless of their protocol compliance status by observing how they communicate rather than what they claim to be.
Solution Approach 2:
The patent introduces a network behavior analysis system as an intermediary between devices and the identification system. Instead of directly reading device identifiers from packets (which fails for non-compliant devices), the system observes and analyzes communication patterns as an intermediate step to infer device identity, effectively mediating the identification process for devices that don't speak standardized languages.
2Measurement precision
If packet content checking is used for device identification, then identification precision is improved for compliant devices, but identification capability deteriorates for non-compliant devices using arbitrary protocols
Solution Approach 1:
Instead of trying to read identification information from device packets (the traditional approach that fails for non-compliant devices), the patent inverts the approach by having devices identify themselves through their communication behavior patterns. The system observes what devices do rather than what they say, making identification capability independent of protocol compliance.
3Device complexity
If manual input methods are used for device location tracking, then system complexity is reduced, but management efficiency deteriorates and real-time tracking capability is lost
Solution Approach 1:
The system enables devices to be automatically identified and tracked without manual intervention. By analyzing network traffic patterns, the system self-identifies devices and their locations, eliminating the need for manual input while providing real-time tracking capability. This maintains low operational complexity while dramatically improving management efficiency.
4Reliability
If software agents are installed in medical devices for identification, then identification reliability is improved, but device availability deteriorates due to installation constraints in hospital environments
Solution Approach 1:
The patent places the identification functionality in an external network monitoring system rather than within the medical devices themselves. This intermediary approach allows reliable identification through network observation without requiring any software installation in the devices, preserving their availability and avoiding hospital IT policy violations.
Data Source
AI summary
Disclosed herein are a device identification apparatus and method based on network behavior. The device identification apparatus includes one or more processors, and execution memory for storing at least one program that is executed by the one or more processors, wherein the at least one program is configured to collect packet data of a device connected to a network through port mirroring and extract behavior features from the packet data, analyze the behavior features and then generate unique information based on a previously created detection model, and extract an identification number corresponding to the unique information from a database and then identify the device.