Method and procedure for generating reputation scores for IoT devices based on distributed analysis

• US 10,785,125 B2
• Filed: 12/03/2018
• Issued: 09/22/2020
• Est. Priority Date: 12/03/2018
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Ramachandran, Jayaraman, Levy, Donald, Serban, Cristina, Gross, David
• Primary Examiner(s): Higa, Brendan Y
• Application Number:
  US16/207,771
• Publication Number:
  US 20200177467A1
• Time in Patent Office: 659 Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/30 Decision processes by autonomous network management units using voting and bidding
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/1044 Group management mechanisms management of multicast group membership H04L12/185; reconfiguring of node membership in a computing system to eliminate errors G06F11/1425
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers
• CPC Class Codes: H04L 67/12 : specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 9/0643 : Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 40/24 : Connectivity information management, e.g. connectivity discovery or connectivity update

Abstract

Aspects of the subject disclosure may include, for example, a method including obtaining a first set of votes from devices that are registered and enabled by a registration system to form a first network communicating with a processing system. The first set of votes relate to performance of a target device and indicate conformance to performance criteria for the first network. The processing system receives a reputation score for the target device from the registration system, and receives a second set of votes regarding target device performance from voting systems over a second network comprising a peer network including the processing system and the voting systems. The first and second sets of votes and the reputation score are aggregated to generate an updated reputation score for the target device. The registration system disables the target device when the reputation score falls below a threshold. Other embodiments are disclosed.

Claims

1. A method, comprising:

obtaining, by a processing system including a processor, a first set of votes from a plurality of devices, the plurality of devices registered at and enabled by a registration system to form a first network communicating with the processing system, the first set of votes regarding performance of a target device and indicating a degree of conformance of the target device to performance criteria for the first network;

receiving, by the processing system, a reputation score for the target device from the registration system;

receiving, by the processing system, a second set of votes regarding performance of the target device from a plurality of voting systems over a second network, the second network comprising a peer network including the processing system and the plurality of voting systems;

aggregating, by the processing system, the first set of votes, the reputation score, and the second set of votes to generate an updated reputation score for the target device; and

transmitting, by the processing system, the updated reputation score for the target device to the registration system, wherein the registration system disables the target device responsive to the updated reputation score being below a predetermined threshold.

2. The method of claim 1, wherein the first set of votes from the plurality of devices are weighted according to respective reputation scores of the plurality of devices.

3. The method of claim 1, wherein subsequent to disabling the target device, the registration system re-enables the target device according to a reputation score aging procedure based on an elapsed time since the disabling.

4. The method of claim 3, wherein the reputation score aging procedure applies a half-life value to determine a new reputation score for the target device.

5. The method of claim 1, wherein subsequent to disabling the target device, the registration system re-enables the target device responsive to receiving a notification that a remedial action has been performed for the target device.

6. The method of claim 1, wherein the processing system comprises one of the plurality of voting systems, and wherein the processing system is uniquely associated with the target device.

7. The method of claim 6, wherein the processing system is uniquely associated with the target device in accordance with a hashing procedure using a first identifier of the target device and a second identifier for the processing system.

8. The method of claim 1, wherein the first set of votes is obtained via a multicast message.

9. The method of claim 1, wherein the first set of votes is obtained via a voting proxy.

10. The method of claim 9, wherein the voting proxy comprises the registration system.

11. The method of claim 1, wherein the aggregating to generate the updated reputation score for the target device is in accordance with votes received from a source external to the first network and the second network.

12. The method of claim 1, wherein the reputation score received from the registration system is based at least in part on information regarding the target device provided to the registration system by a source external to the first network and the second network.

13. A device comprising:

a processing system including a processor; and

a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations comprising;

obtaining a first set of votes from a plurality of devices, the plurality of devices registered at and enabled by a registration system to form a first network communicating with the processing system, the first set of votes regarding performance of a target device and indicating a degree of conformance of the target device to performance criteria for the first network;

receiving a reputation score for the target device from the registration system;

receiving a second set of votes regarding performance of the target device from a plurality of voting systems over a second network, the second network comprising a peer network including the processing system and the plurality of voting systems, the processing system being uniquely associated with the target device;

aggregating the first set of votes, the reputation score, and the second set of votes to generate an updated reputation score for the target device; and

transmitting the updated reputation score for the target device to the registration system, wherein the registration system disables the target device responsive to the updated reputation score being below a predetermined threshold, and wherein subsequent to disabling the target device, the registration system re-enables the target device according to a reputation score aging procedure.

14. The device of claim 13, wherein the first set of votes from the plurality of devices are weighted according to respective reputation scores of the plurality of devices.

15. The device of claim 13, wherein the registration system re-enables the target device responsive to receiving a notification that a remedial action has been performed for the target device.

16. The device of claim 13, wherein the first set of votes is obtained via a multicast message.

17. The device of claim 13, wherein the aggregating to generate the updated reputation score for the target device is in accordance with votes received from a source external to the first network and the second network.

18. A non-transitory machine-readable medium comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations comprising:

obtaining a first set of votes from a plurality of devices, the plurality of devices registered at and enabled by a registration system to form a first network communicating with the processing system, the first set of votes regarding performance of a target device and indicating a degree of conformance of the target device to performance criteria for the first network, wherein the first set of votes is obtained via a multicast message;

receiving a reputation score for the target device from the registration system;

receiving a second set of votes regarding performance of the target device from a plurality of voting systems over a second network, the second network comprising a peer network including the processing system and the plurality of voting systems, the processing system being uniquely associated with the target device;

aggregating the first set of votes, the reputation score, and the second set of votes to generate an updated reputation score for the target device; and

transmitting the updated reputation score for the target device to the registration system, wherein the registration system disables the target device responsive to the updated reputation score being below a predetermined threshold.

19. The non-transitory machine-readable medium of claim 18, wherein the first set of votes from the plurality of devices are weighted according to respective reputation scores of the plurality of devices.

20. The non-transitory machine-readable medium of claim 18, wherein the processing system is uniquely associated with the target device in accordance with a hashing procedure using a first identifier of the target device and a second identifier for the processing system.