Palo Alto Networks, Inc.

Zingbox, Ltd.

Gong Cheng

Mei Wang

Pui-Chuen Yip

Yilin Zhao

Mayuresh Ektare

Jun Du

Ran Xia

Zhiwei Xiao

Jianlin Zeng

Xu Zou

Anil Kumar Reddy Sirigiri

Dylan Stewart Spagnuolo

Venkata Sarat Kumar Vajrapu

Sultanbek Omurzakov

Madhusudhan Donthi Nagaraju

Aveek Kumar Das

Rahul Devidas Rajewar

Arunkumar Mutharasanallur Desigan

Vamsidhar Valluri

A software bill of materials (SBOM) and vulnerability management system ('system') disclosed herein extracts software component-related identifiers for Internet of Things (IoT) devices using deep packet inspection. The system filters the identifiers by removing identifiers that match a blacklist of identifiers known to not correspond to software components. The system then populates SBOM fields using a database storing the filtered identifiers with a schema that is uniform across SBOM file formats and queries a vulnerability database with software components indicated in the filtered identifiers to identify vulnerabilities for each IoT device for security risk assessment.

Software bill of materials and vulnerability management via deep packet inspection

An Internet of Things (IoT) device profile applicable to an IoT device is determined. Data packets transmitted to and from the IoT device are analyzed. A risk level of the IoT device is determined based at least in part on the data packet analysis. A determination is made that the risk level exceeds a threshold and a remedial action is taken in response.

IoT device risk assessment

Increasing use of web-based applications or Software-as-a-Service and IoT devices within enterprise networks increases the variety of network traffic and variables for consideration in managing security posture, which includes policy management. A security posture management system as disclosed herein leverages application identification and device discovery from ongoing collection and analysis of network traffic data to manage policies at device granularity allowing tailored security posture management. The system can tailor policies to handle network traffic depending on identified application and device type inputs obtained from the ongoing collection and analysis. The security posture management system can configure SD-WAN construct based parameters of a policy to tailor policies for different application traffic from different types of devices.

SD-WAN IOT security posture management

Data packets transmitted to and from an IoT device are obtained and at least one of the data packets are analyzed using deep packet inspection to identify transaction data from payload of the at least one of the data packets. An event log is generated for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device. The IoT device into a device profile based on the historical record for the IoT device. The event log is updated in real-time to indicate current operation of the IoT device. Abnormal device behavior of the IoT device is determined using the event log and the device profile. The device profile is updated to indicate the abnormal device behavior of the IoT device.

Packet analysis based IOT management

A service obtains traffic logs for traffic of a network that has been sent according to a Layer 7 protocol (e.g., SNMP or DNS). The service identifies from the traffic logs device names that appear to correspond to different devices/NICs as names of candidate multi-NIC devices. The service extracts features from names of the candidate multi-NIC devices and generates respective feature vectors. The service can generate 'documents' representing each device name from which it extracts features by determining n-grams of each device name, where a set of n-grams of a device name is treated as a document, and each n-gram is treated as a term in the document. Exemplary features that can be extracted based on a device name document include within-document and cross-document uniqueness scores. The service clusters the feature vectors with unsupervised learning and identifies clusters of a size that satisfies a criterion as corresponding to multi-NIC devices.

Identifying devices with multiple network interface cards in a network

Techniques for grouping and labeling Internet of Things (IoT) devices are disclosed. A first set of raw events associated with a first IoT device is identified, including a transmission made by the first IoT device. A communication manner of the first IoT device is determined, based at least in part on a communication manner of the first IoT device. The first set of raw events over the first time period is examined to generate one or more formatted events of the first IoT device. The formatted events are used to extract a set of features. Similar processing is performed with respect to a second IoT device. A context-based IoT device grouping model is generated based on at least one of: (1) the features extracted for the first IoT device or (2) the features extracted for the second IoT device. The model is applied to determine that a third IoT device belongs to a particular group. A deviation by the third IoT device from group behavior is detected and an alert is generated in response.

IoT device grouping and labeling

A set of data packets transmitted by an IoT device is received at a system. At least one packet included in the set of data packets is analyzed. An Authentication, and Account (AAA) message, including contextual information associated with the IoT device, is transmitted on behalf of the IoT device.

Network entity ID AAA

A first device governs operation of a second device based on a network security risk posed by the second device. The second device is disposed locally to the first device and in local network communication with the first device. The first device is in network communication with a cloud-based computational service.

Techniques for grouping and labeling Internet of Things (IoT) devices are disclosed. A set of raw events associated with a first IoT device is identified. A context of the first IoT device is identified, and used to enrich at least some of the raw events. At least some of the raw events are aggregated. A context-based IoT device grouping model is generated based at least in part on the aggregated events and events associated with a second IoT device in operation. The model is applied to determine that a third IoT device belongs to a particular group. A deviation by the third IoT device from group behavior is detected and an alert is generated in response.

Techniques for passively providing AAA support for an IoT device in a network are disclosed. A set of data packets transmitted by an IoT device is obtained. At least one packet included in the set of data packets is analyzed. A message, including information associated with the IoT device, is transmitted on behalf of the IoT device.

Network entity id AAA

Techniques for assessing risks of IoT devices. A system utilizing such techniques can include a packet analysis based IoT device risk assessment system and an IoT device risk assessment system. A method utilizing such techniques can include extraction of IoT device risk factors from a device profile of an IoT device and application of assessment weights to the IoT device risk factors to assess a risk level of an IoT device.

Techniques for grouping and labeling Internet of Things (IoT) devices are disclosed. In accordance with an aspect of the invention, there is provided a computer program product configured to be operable to perform the techniques described in this paper to enable grouping and labeling of IoT devices. As devices are grouped and labeled, and behavior is matched to or deviates from known or expected behavior, the network can be more readily understood and alerts can be more timely and appropriate.

Data packets transmitted to and from an IoT device are obtained and at least one of the data packets are analyzed using deep packet inspection to identify transaction data from payload of the at least one of the data packets. An event log is generated for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device. The IoT device is profiled into a device profile based on the historical record for the IoT device. The event log is updated in real-time to indicate current operation of the IoT device. Abnormal device behavior of the IoT device is determined using the event log and the device profile. The device profile is updated to indicate the abnormal device behavior of the IoT device.

Packet analysis based IoT management

Techniques for assessing risks of IoT device. A system utilizing such techniques can include a packet analysis based IoT device risk assessment system and an IoT device risk assessment system. A method utilizing such techniques can include extraction of IoT device risk factors from a device profile of an IoT device and application of assessment weights to the IoT device risk factors to assess a risk level of an IoT device.

Growing community of inventors

Sunnyvale, CA, United States of America

Gong Cheng