Port Usage Device Type Inference With Manufacturer-Specific Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions struggle to accurately profile device types due to the lack of a uniform standard for querying device information and the reliance on cumbersome, rules-based mechanisms that require manual tuning and maintenance, leading to unreliable device type identification.
Innovation Solution
A method and system that utilize device type inference models trained per manufacturer, leveraging machine learning to infer device types based on port usage and traffic volume, enabling accurate device type identification by analyzing port behavior patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rules-based mechanisms are used to identify device types, then device type identification can be performed, but the process becomes cumbersome and requires manual tuning and maintenance
Solution Approach 1:
The patent replaces manual rules-based mechanisms with machine learning models that automatically learn device type patterns from network traffic data. The system trains classifiers on labeled device traffic and uses these models to infer device types, eliminating the need for manual rule creation and tuning while improving accuracy.
Solution Approach 2:
The system enables automatic device type identification through self-learning machine learning models that continuously improve by processing network traffic data. The models automatically adapt to new device types and patterns without requiring manual intervention, making the profiling system self-maintaining and scalable.
2Measurement precision
If manufacturer-specific inference models are used, then device type inference accuracy is improved, but the system complexity increases due to multiple models
Solution Approach 1:
The patent divides the device type inference problem into manufacturer-specific segments, creating dedicated inference models for different device manufacturers. This segmentation allows each model to specialize in detecting patterns unique to its manufacturer's devices, improving overall accuracy while maintaining manageable model complexity through modular organization.
Solution Approach 2:
The system dynamically selects and switches between different inference models based on the detected device manufacturer. By changing the active model parameter based on manufacturer identification, the system achieves high precision for each device type without requiring all models to be active simultaneously, thus managing computational complexity.
3Ease of operation
If device type information is not explicitly identified in device data, then data collection is simpler, but device type identification becomes unreliable
Solution Approach 1:
The patent introduces machine learning inference models as intermediaries that bridge the gap between raw network traffic data (which lacks explicit device type information) and reliable device type identification. These models learn to extract implicit device type signals from traffic patterns, port usage, and behavioral characteristics, converting unstructured data into reliable classification without complicating data collection.
Data Source
AI summary
A system and method for inferring device types. A method includes selecting a device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; and determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected device type inference model to a plurality of features, wherein the plurality of features is extracted from device activity data indicating ports used by the device and at least one volume of traffic communicated via each port used by the device.