Palo Alto Networks, Inc.

Foodfx Inc

Skoopmagic, Inc.

Jun Du

Yilin Zhao

Mei Wang

Gong Cheng

Pui-Chuen Yip

Ke Tian

Fengmin Gong

Xiaoyi Duan

Min Fan

Weijun Zhang

Hector Daniel Regalado

Jianlin Zeng

Jianhong Xia

Kalyan Siddam

Samir Virmani

Techniques for enforcing policy on multiple levels are disclosed. A multi-level policy includes at least one policy at a low level of abstraction and at least one policy at a high level of abstraction. An Internet of Things (IoT) device is discovered on a network. The IoT device is classified. The set of multi-level policies is applied to the IoT device based on the classification of the IoT device.

Multi-layered policy management

Methods, systems, and apparatuses, including computer programs encoded on computer storage media, for tracking consumption rate of food in food containers. An example method includes capturing an image of a food station using an RGB camera, determining bounding boxes on the image that correspond to food containers in the food station, capturing an overall point cloud of the food station using a depth camera, cropping a point cloud for each food container from the overall point cloud based on the bounding boxes. Then for each food container, a volume of remaining food in the food container is determined based on the point cloud of the food container, and the food consumption information of the food containers is obtained by tracking volume changes of the remaining food in food containers.

System and method for food service consumption tracking

Techniques for providing Internet of Things (IoT) security are disclosed. An applicable system includes profiling IoT devices to limit the number of network signatures applicable to the IoT devices and performing pattern matching using a pattern that is appropriate for the profile of a given IoT device.

Pattern match-based detection in IOT security

Methods, systems, and apparatuses, including computer programs encoded on computer storage media, for dietary tracking with instant dietary feedback using a portable multi-sensor device are described. An example method may include: obtaining a first machine learning model trained based on a plurality of food images and corresponding labels; receiving a series of images from one or more cameras capturing a user taking food out of a food-serving storage; determining, using the first machine learning model based on the series of images, an identification of the food being taken by the user; determining, using a second machine learning model based on the series of images and the identification of the food, an estimated weight of the food being taken by the user; determining and displaying portion-based food information of the food being taken by the user.

Multi-sensor device for dietary tracking

Identifying Internet of Things (IoT) devices with packet flow behavior including by using machine learning models is disclosed. Information associated with a network communication of an IoT device is received. A determination of whether the IoT device has previously been classified is made. In response to determining that the IoT device has not previously been classified, a determination is made that a probability match for the IoT device against a behavior signature exceeds a threshold. The behavior signature includes at least one time series feature for an application used by the IoT device. Based at least in part on the probability match, a classification of the IoT device is provided to a security appliance configured to apply a policy to the IoT device.

IoT device identification by machine learning with time series behavioral and statistical features

Techniques for enforcing policies on Internet of Things (IoT) device communications are disclosed. Information associated with a network communication of an IoT device is received. The received information is used to determine a device profile, including a device type, to associate with the IoT device. A recommended security policy to be applied to the IoT device by a security appliance is generated.

IoT security policy on a firewall

A system and method for performing automated learning of an Internet-of-Things (IoT) application are disclosed. The automated learning is based on generation of application-agnostic events, allowing the automated learning to be performed without prior knowledge of the IoT application.

IoT application learning

Techniques for detecting anomalous behavior of an Internet-of-Things (IoT) device in an IoT network. IoT events of an IoT device are captured and analyzed to identify periodic activities of the IoT device. The periodic activities of the IoT device are tracked over time, and variations in the periodic activities are analyzed to assess potential threats to the IoT network.

Multi-dimensional periodicity detection of IOT device behavior

An anomalous behavior detector has been designed to detect novel behavioral changes of devices based on network traffic data that likely correlate to anomalous behaviors. The anomalous behavior detector uses the local outlier factor (LOF) algorithm with novelty detection. After initial semi-supervised training with a single class training dataset representing stable device behaviors, the obtained model continues learning frontiers that delimit subspaces of inlier observations with live network traffic data. Instead of traffic variables being used as features, the features that form feature vectors are similarities of network traffic variable values across time intervals. A feature vector for the anomalous behavior detector represents stability or similarity of network traffic variables that have been chosen as device identifiers and behavioral indicators.

Detecting behavioral change of IoT devices using novelty detection based behavior traffic modeling

Internet of Things (IoT) device application workload capture is disclosed. A target IoT device is selected. A flow associated with the target IoT device is determined and tagged. Packets from the tagged flow are admitted into a ring buffer. An indication is received that an extraction should be performed on a portion of the packets included in the ring buffer.

IoT device application workload capture

Correlating Internet of Things (IoT) security events is disclosed. A set of security events is received. A graph is generated, where nodes of the graph correspond to at least some of the received security events in the set. The edges in the graph correspond to identifiable patterns of correlation. A determination of whether or not the generated graph matches a prebuilt scenario is determined and a remedial action is taken in response to the determination.

IoT security event correlation

Methods, systems, and apparatuses, including computer programs encoded on computer storage media, for automated foodservice are described. An example method includes receiving one or more images from one or more cameras capturing a food container comprising a plurality of compartments; determining, using a first machine learning model based on the one or more images, a user action comprising a user taking food from a first compartment of the plurality of compartments; receiving a plurality of pieces of weight sensor data from a plurality of weight sensors coupled to a frame hosting the food container; determining, using a second machine learning model based on the plurality of pieces of weight sensor data, a second compartment of the plurality of compartments; in response to the first compartment being the same as the second compartment, displaying the weight and the food information of the food taken by the user.

Method and system for foodservice with instant feedback

Techniques for grouping and labeling Internet of Things (IoT) devices are disclosed. A first set of raw events associated with a first IoT device is identified, including a transmission made by the first IoT device. A communication manner of the first IoT device is determined, based at least in part on a communication manner of the first IoT device. The first set of raw events over the first time period is examined to generate one or more formatted events of the first IoT device. The formatted events are used to extract a set of features. Similar processing is performed with respect to a second IoT device. A context-based IoT device grouping model is generated based on at least one of: (1) the features extracted for the first IoT device or (2) the features extracted for the second IoT device. The model is applied to determine that a third IoT device belongs to a particular group. A deviation by the third IoT device from group behavior is detected and an alert is generated in response.

IoT device grouping and labeling

Internet of Things (IoT) device application workload capture is disclosed. A target IoT device is selected. A flow associated with the target device is determined and tagged. Packets from the tagged flow are admitted into a ring buffer. An indication is received that an extraction should be performed on a portion of the packets included in the ring buffer.

Growing community of inventors

Cupertino, CA, United States of America

Jun Du