Identifying device type using machine learning on sparsely populated log data
Systems and methods for identifying device type within a network include receiving data associated with monitoring network communication traffic associated with a plurality of devices; analyzing the data of the plurality of devices, wherein the analyzing includes identifying one or more features of the data of each of the plurality of devices; and labeling each of the plurality of devices as one of a user device and a non-user device based on the one or more features.
1 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
receiving data associated with monitoring network communication traffic associated with a plurality of devices as sparsely populated log data;
analyzing the data of the plurality of devices with a trained machine learning model comprising a trained binary classification model trained using ground truth data, wherein the analyzing includes identifying one or more features of the data of each of the plurality of devices, wherein the one or more features includes a top Uniform Resource Locator (URL) ratio or a stop URL ratio; and
labeling each of the plurality of devices as one of a user device and a non-user device based on the one or more features, wherein a device is labeled as a non-user device when the top URL ratio is above a threshold value or when the stop URL ratio is below another threshold value and augmenting the sparsely populated log data with the label and enforcing, by a cloud-based enforcement node, a security or firewall policy based on the label.
2 . The non-transitory computer-readable medium of claim 1 , wherein a user device is a device with an end user, and wherein a non-user device is one of an Internet-of-Things (IoT) device and a server.
3 . The non-transitory computer-readable medium of claim 1 , wherein the monitoring is via a cloud-based system having a plurality of nodes, and wherein the one or more processors are in one of the plurality of nodes.
4 . The non-transitory computer-readable medium of claim 1 , wherein the one or more features includes an application class ratio, and wherein the steps further comprise:
responsive to the application class ratio of a device being above a threshold value, labeling the device as a non-user device.
5 . The non-transitory computer-readable medium of claim 1 , wherein the analyzing includes determining a top Uniform Resource Locator (URL), and wherein the steps further comprise:
responsive to the top URL of a device being a stop URL, labeling the device as a user device.
6 . The non-transitory computer-readable medium of claim 1 , wherein the analyzing includes identifying, within network communication traffic associated with a device of the plurality of devices, traffic to an application within a user application class, and wherein the labeling includes labeling the device as a user device based thereon.
7 . The non-transitory computer-readable medium of claim 1 , wherein the steps comprise:
training the machine learning model with historical network communication traffic data based on the one or more features.
8 . A method comprising steps of:
receiving data associated with monitoring network communication traffic associated with a plurality of devices as sparsely populated data;
analyzing the data of the plurality of devices with a trained machine learning model comprising a trained binary classification model trained using ground truth data, wherein the analyzing includes identifying one or more features of the data of each of the plurality of devices, wherein the one or more features includes a top Uniform Resource Locator (URL) ratio or a stop URL ratio; and
labeling each of the plurality of devices as one of a user device and a non-user device based on the one or more features, wherein a device is labeled as a non-user device when the top URL ratio is above a threshold value or when the stop URL ratio is below another threshold value and, at a cloud-based enforcement node, enforcing a security or firewall policy for the device based on whether the device is labeled as the user device or the non-user device.
9 . The method of claim 8 , wherein a user device is a device with an end user, and wherein a non-user device is one of an Internet-of-Things (IoT) device and a server.
10 . The method of claim 8 , wherein the monitoring is via a cloud-based system having a plurality of nodes.
11 . The method of claim 8 , wherein the one or more features includes an application class ratio, and wherein the steps further comprise:
responsive to the application class ratio of a device being above a threshold value, labeling the device as a non-user device.
12 . The method of claim 8 , wherein the analyzing includes determining a top Uniform Resource Locator (URL), and wherein the steps further comprise:
responsive to the top URL of a device being a stop URL, labeling the device as a user device.
13 . The method of claim 8 , wherein the analyzing includes identifying, within network communication traffic associated with a device of the plurality of devices, traffic to an application within a user application class, and wherein the labeling includes labeling the device as a user device based thereon.
14 . The method of claim 8 , wherein the steps comprise:
training the machine learning model with historical network communication traffic data based on the one or more features.
15 . A method comprising steps of:
receiving data associated with monitoring network communication traffic associated with a plurality of devices as sparsely populated log data;
analyzing the data of the plurality of devices with a trained machine learning model comprising a trained binary classification model trained using ground truth data, wherein the analyzing includes identifying one or more features of the data of each of the plurality of devices, wherein the analyzing includes determining a top Uniform Resource Locator (URL); and
labeling each of the plurality of devices as one of a user device and a non-user device based on the one or more features, and, responsive to the top URL of a device being a stop URL, labeling the device as a user device and augmenting the sparsely populated log data with the label and enforcing, by a cloud-based enforcement node, a security or firewall policy based on the label.
16 . The method of claim 15 , wherein a user device is a device with an end user, and wherein a non-user device is one of an Internet-of-Things (IoT) device and a server.
17 . The method of claim 15 , wherein the monitoring is via a cloud-based system having a plurality of nodes.
18 . The method of claim 15 , wherein the one or more features includes an application class ratio, and wherein the steps further comprise:
responsive to the application class ratio of a device being above a threshold value, labeling the device as a non-user device.
19 . The method of claim 15 , wherein the analyzing includes identifying, within network communication traffic associated with a device of the plurality of devices, traffic to an application within a user application class, and wherein the labeling includes labeling the device as a user device based thereon.
20 . The method of claim 15 , wherein the steps comprise:
training the machine learning model with historical network communication traffic data based on the one or more features.