Coordinated and device-distributed detection of abnormal network device operation

• US 10,063,439 B2
• Filed: 06/03/2016
• Issued: 08/28/2018
• Est. Priority Date: 09/09/2014
• Status: Active Grant

• Current Assignee: Belkin International Incorporated (Hon Hai Precision Industry Co., Ltd.)
• Original Assignee: Belkin International Incorporated (Hon Hai Precision Industry Co., Ltd.)
• Inventors: Kim, Ryan Yong, Pathuri, Venkata Subba Rao, Sidhu, Gursharan
• Primary Examiner(s): Maskulinski, Michael
• Application Number:
  US15/173,290
• Publication Number:
  US 20160285717A1
• Time in Patent Office: 816 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 12/2803 Home automation networks
• CPC Class Codes: H04L 2012/2841 Wireless
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Techniques for coordinated and device-distributed detection of abnormal network device operation are provided. In some embodiments, a method may include identifying a suspicious activity condition associated with a suspect network device. The suspicious activity condition may also be associated with the device itself. Activity of the network device may be detected and analyzed, including additional data corresponding to the activity from one or more other network devices in the same network. In response to determining that the suspicious activity condition is satisfied, an alert communication can be transmitted that identifies the suspect network device. When the activity is associated with the device itself, a local operation at the network device may be changed.

Claims

1. A computer implemented method, comprising:

determining, by a computing device associated with a local area network, a loss of service provider connectivity at a network device associated with the local area network;

transmitting a query requesting network connectivity status information for one or more other network devices associated with the local area network, wherein the network connectivity status information includes service provider connectivity and local area network connectivity;

receiving the network connectivity status information in response to the query;

analyzing the network connectivity status information, wherein analyzing the network connectivity status information includes;

identifying a pattern in the network connectivity status information indicative of a network deficiency;

or

comparing the network connectivity status information with previous network connectivity status information; and

generating instructions for restoring connectivity between the network device and the service provider based on the analysis.

2. The method of claim 1, wherein analyzing the network connectivity status information further includes determining a cause for the loss of service provider connectivity.

3. The method of claim 1, further comprising:

determining that the network device has lost connectivity with the local area network, wherein the instructions include establishing an off-network connection with one or more of the other network devices associated with the local area network.

4. The method of claim 3, wherein the instructions include relaying communications to the service provider using the off-network connection.

5. The method of claim 1, further comprising:

transmitting a notification of the instructions or of the loss of service provider connectivity.

6. The method of claim 1, wherein the network device having lost service provider connectivity is the computing device.

7. The method of claim 1, wherein the instructions include resetting or updating the network device or one or more other network devices.

8. The method of claim 1, further comprising:

detecting, by the computing device, input corresponding to interaction with an interface of the computing device;

determining that the computing device is connected to a network including;

the local area network including the network device;

or

a remote network;

based on determining that the computing device is connected to the local network, sending a message to the network device using the local network, wherein the message corresponds to an operation of the network device; and

based on determining that the computing device is connected to the remote network, sending the message to the network device using the remote network.

9. A system, comprising:

one or more data processors; and

a non-transitory computer-readable storage medium containing instructions, which when executed on the one or more data processors, cause the one or more data processors to perform operations including;

determining a loss of service provider connectivity at a network device associated with a local area network;

transmitting a query requesting network connectivity status information for one or more other network devices associated with the local area network, wherein the network connectivity status information includes service provider connectivity and local area network connectivity;

receiving the network connectivity status information in response to the query;

analyzing the network connectivity status information, wherein analyzing the network connectivity status information includes;

identifying a pattern in the network connectivity status information indicative of a network deficiency;

or

comparing the network connectivity status information with previous network connectivity status information; and

generating restoration instructions for restoring connectivity between the network device and the service provider based on the analysis.

10. The system of claim 9, wherein analyzing the network connectivity status information further includes determining a cause for the loss of service provider connectivity.

11. The system of claim 9, the operations further comprising:

determining that the network device has lost connectivity with the local area network, wherein the restoration instructions include establishing an off-network connection with one or more network devices associated with the local area network.

12. The system of claim 11, wherein the restoration instructions include relaying communications to the service provider using the off-network connection.

13. The system of claim 9, the operations further comprising:

transmitting a notification of the restoration instructions or of the loss of service provider connectivity.

14. The system of claim 9, wherein the network device includes the one or more data processors.

15. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a computing device to perform operations including:

determining a loss of service provider connectivity at a network device associated with a local area network;

transmitting a query requesting network connectivity status information for one or more other network devices associated with the local area network, wherein the network connectivity status information includes service provider connectivity and local area network connectivity;

receiving the network connectivity status information in response to the query;

analyzing the network connectivity status information, wherein analyzing the network connectivity status information includes;

identifying a pattern in the network connectivity status information indicative of a network deficiency;

or

comparing the network connectivity status information with previous network connectivity status information; and

generating restoration instructions for restoring connectivity between the network device and the service provider based on the analysis.

16. The computer-program product of claim 15, wherein analyzing the network connectivity status information further includes determining a cause for the loss of service provider connectivity.

17. The computer-program product of claim 15, the operations further comprising:

determining that the network device has lost connectivity with the local area network, wherein the restoration instructions include establishing an off-network connection with one or more network devices associated with the local area network.

18. The computer-program product of claim 15, wherein the restoration instructions include relaying communications to the service provider using the off-network connection.

19. The computer-program product of claim 15, the operations further comprising:

transmitting a notification of the restoration instructions or of the loss of service provider connectivity.