Automating IoT device identification using statistical payload fingerprints

1 . A system, comprising:

a processor configured to:

obtain byte frequency information from an application executing on an Internet of Things (IoT) device that has a corresponding observed flow, wherein the processor is unable to determine a classification of the application, at least in part because the processor lacks access to a protocol decoder applicable to the corresponding observed flow;

transmit the obtained byte frequency information to a remote system;

receive the classification of the application from the remote system; and

apply a policy to the IoT device based at least in part on the received classification; and

a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system of claim 1 , wherein the byte frequency information comprises a byte flow distribution.

3 . The system of claim 1 , wherein the remote system is configured to determine a byte flow distribution using the obtained byte frequency information.

4 . The system of claim 1 , wherein the classification is determined based at least in part on a threshold match.

5 . The system of claim 4 , wherein the byte frequency information is determined to be within a threshold of byte frequency information associated with an existing byte frequency profile and in response the remote system is configured to classify the IoT device with other devices associated with the profile.

6 . The system of claim 4 , wherein the byte frequency information is determined to be outside a threshold of byte frequency information associated with one or more existing byte frequency profiles and in response the remote system is configured to generate a new profile.

7 . The system of claim 4 , wherein the threshold match is based at least in part on a plurality of features.

8 . The system of claim 1 , wherein the classification is determined based at least in part on a model.

9 . The system of claim 8 , wherein the model is trained using a set of features that include at least some portion of byte flow distribution information.

10 . The system of claim 1 , wherein the byte frequency information is determined based at least in part on a predefined number of packets in the flow.

11 . The system of claim 1 , wherein the byte frequency information is determined using a transport layer payload.

12 . A method, comprising:

obtaining, at a system, byte frequency information from an application executing on an Internet of Things (IoT) device that has a corresponding observed flow, wherein the system is unable to determine a classification of the application, at least in part because the system lacks access to a protocol decoder applicable to the corresponding observed flow;

transmitting the obtained byte frequency information to a remote system;

receiving the classification of the application from the remote system; and

applying a policy to the IoT device based at least in part on the received classification.

13 . A computer program product embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

obtaining, at a system, byte frequency information from an application executing on an Internet of Things (IoT) device that has a corresponding observed flow, wherein the system is unable to determine a classification of the application, at least in part because the system lacks access to a protocol decoder applicable to the corresponding observed flow;

transmitting the obtained byte frequency information to a remote system;

receiving the classification of the application from the remote system; and

applying a policy to the IoT device based at least in part on the received classification.

14 . The method of claim 12 , wherein the byte frequency information comprises a byte flow distribution.

15 . The method of claim 12 , wherein the remote system is configured to determine a byte flow distribution using the obtained byte frequency information.

16 . The method of claim 12 , wherein the byte frequency information is determined to be within a threshold of byte frequency information associated with an existing byte frequency profile and in response the remote system is configured to classify the IOT device with other devices associated with the profile.

17 . The method of claim 12 , wherein the byte frequency information is determined to be outside a threshold of byte frequency information associated with one or more existing byte frequency profiles and in response the remote system is configured to generate a new profile.

18 . The method of claim 12 , wherein the classification is determined based at least in part on a model trained using a set of features that include at least some portion of byte flow distribution information.

19 . The method of claim 12 , wherein the byte frequency information is determined based at least in part on a predefined number of packets in the flow.

20 . The method of claim 12 , wherein the byte frequency information is determined using a transport layer payload.