×

Determining a device profile and anomalous behavior associated with a device in a network

  • US 10,742,687 B2
  • Filed: 08/30/2018
  • Issued: 08/11/2020
  • Est. Priority Date: 08/30/2018
  • Status: Active Grant
First Claim
Patent Images

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

  • obtaining a first set of one or more data packets associated with a communication session conducted by a first device in a network;

    determining a first value for a first attribute associated with the first device based on the first set of data packets;

    determining a second value for a second attribute associated with the first device based on the first set of data packets;

    determining that any value for a third attribute associated with the first device has not been determined based on the first set of data packets;

    selecting a subset of a set of classifiers, wherein the subset of classifiers;

    includes a first classifier that is associated with the first attribute;

    includes a second classifier that is associated with the second attribute;

    does not include a third classifier that is associated with the third attribute;

    applying at least the first value for the first attribute to the first classifier to determine a first candidate device profile, of a plurality of candidate device profiles, for the first device;

    applying at least the second value for the second attribute to the second classifier to determine a second candidate device profile, of the plurality of candidate device profiles, for the first device;

    refraining from using the third classifier to determine any candidate device profile for the first device;

    based at least on the first candidate device profile and the second candidate device profile, determining the first candidate device profile as a current device profile for the first device;

    wherein determining the first candidate device profile as the current device profile for the first device comprises;

    determining a first weight associated with the first classifier;

    determining a second weight associated with the second classifier;

    determining a first profile score for the first candidate device profile based at least on the first weight;

    determining a second profile score for the second candidate device profile based at least on the second weight;

    determining that the first profile score is greater than the second profile score;

    determining one or more expected values for the first attribute based on the current device profile;

    determining whether a particular value for the first attribute matches the one or more expected values for the first attribute;

    responsive to determining that the particular value for the first attribute does not match the one or more expected values for the first attribute;

    performing a corrective action.

View all claims
  • 3 Assignments
Timeline View
Assignment View
    ×
    ×