Palo Alto Networks, Inc.

Zingbox, Ltd.

Ran Xia

Mei Wang

Gong Cheng

Pui-Chuen Yip

Zhiwei Xiao

Fan Zhang

Data packets transmitted to and from an IoT device are obtained and at least one of the data packets are analyzed using deep packet inspection to identify transaction data from payload of the at least one of the data packets. An event log is generated for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device. The IoT device into a device profile based on the historical record for the IoT device. The event log is updated in real-time to indicate current operation of the IoT device. Abnormal device behavior of the IoT device is determined using the event log and the device profile. The device profile is updated to indicate the abnormal device behavior of the IoT device.

Packet analysis based IOT management

A cardinality query associated with a specific attribute is received. One or more in-scope attribute cardinality partitions is enforced on session record analytics. Vertical data compression is performed to eliminate a time dimension. Horizontal data compression is performed to eliminate one or more out-of-scope attributes. One or more like in-scope session records is aggregated. Magnitudes of each in-scope attribute of each enforced cardinality partition are summed. The sum is returned as a response to the cardinality query.

Distributed cardinality optimization

A query requesting a count of unique data values for a specific attribute is received. The received query is used to generate and transmit a plurality of non-overlapping queries to a data store. A plurality of responses is received from the data store. Results from the plurality of responses is summed and the resulting sum is returned.

Data packets transmitted to and from an IoT device are obtained and at least one of the data packets are analyzed using deep packet inspection to identify transaction data from payload of the at least one of the data packets. An event log is generated for the IoT device from the transaction data, the event log, at least in part, used to generate a historical record for the IoT device. The IoT device is profiled into a device profile based on the historical record for the IoT device. The event log is updated in real-time to indicate current operation of the IoT device. Abnormal device behavior of the IoT device is determined using the event log and the device profile. The device profile is updated to indicate the abnormal device behavior of the IoT device.

Growing community of inventors

Campbell, CA, United States of America

Ran Xia