Systems and methods for detecting abnormal behavior of networked devices
View Patent ↗A computer-implemented method for detecting abnormal behavior of networked devices may include identifying a purpose-built device expected to have a predictable pattern of behavior on a network, determining a baseline pattern of behavior of the purpose-built device, monitoring the network to detect a behavior of the purpose-built device and comparing the behavior to the baseline pattern of behavior of the purpose-built device in order to determine that the behavior may be an abnormal behavior. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting abnormal behavior of networked devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a purpose-built device expected to have a predictable pattern of behavior on a network;
determining a baseline pattern of behavior of the purpose-built device, wherein determining the baseline pattern of behavior of the purpose-built device comprises determining a type of the purpose-built device and, based on the type of the purpose-built device, querying an observation database populated with at least one observation of baseline behavior of at least one of a plurality of purpose-built devices of the type;
monitoring the network to detect a behavior of the purpose-built device;
comparing the behavior to the baseline pattern of behavior of the purpose-built device in order to determine that the behavior comprises an abnormal behavior.
2. The computer-implemented method of claim 1 , further comprising performing a security action in response to determining that the behavior of the purpose-built device is abnormal.
3. The computer-implemented method of claim 2 , wherein the security action comprises at least one of:
blocking the purpose-built device from the network;
filtering out the abnormal behavior of the purpose-built device on the network;
alerting a user to the abnormal behavior of the purpose-built device.
4. The computer-implemented method of claim 1 , wherein determining the baseline pattern of behavior of the purpose-built device comprises monitoring the purpose-built device for a predetermined period of time to establish by observation the baseline behavior of the purpose-built device.
5. The computer-implemented method of claim 1 , wherein the type indicates a make and model of the purpose-built device.
6. The computer-implemented method of claim 1 , wherein determining the baseline pattern of behavior of the purpose-built device comprises querying the observation database with at least one behavioral observation about the purpose-built device and receiving a response correlating the behavioral observation about the purpose-built device with the baseline pattern of behavior of the purpose-built device.
7. The computer-implemented method of claim 1 , further comprising sending a behavioral observation about the purpose-built device and an identifier of the purpose-built device to the observation database.
8. The computer-implemented method of claim 1 , further comprising receiving information about an update to the purpose-built device and determining a new baseline pattern of behavior of the purpose-built device in response to the update.
9. The computer-implemented method of claim 1 , wherein determining that the behavior comprises the abnormal behavior comprises observing the purpose-built device sending traffic via a network protocol that is not observed in the baseline pattern of behavior for the purpose-built device.
10. The computer-implemented method of claim 1 , wherein determining that the behavior comprises the abnormal behavior comprises observing the purpose-built device sending traffic to a network destination that is not observed in the baseline pattern of behavior for the purpose-built device.
11. A system for detecting abnormal behavior of networked devices:
the system comprising:
an identification module programmed to identify a purpose-built device expected to have a predictable pattern of behavior on a network;
a determination module programmed to determine a baseline pattern of behavior of the purpose-built device, wherein determining the baseline pattern of behavior of the purpose-built device comprises determining a type of the purpose-built device and, based on the type of the purpose-built device, querying an observation database populated with at least one observation of baseline behavior of at least one of a plurality of purpose-built devices of the type;
a monitoring module programmed to monitor the network to detect a behavior of the purpose-built device;
a comparing module programmed to compare the behavior to the baseline pattern of behavior of the purpose-built device in order to determine that the behavior comprises an abnormal behavior;
at least one processor coupled to a memory and configured to execute the identification module, the determination module, the monitoring module and the comparing module.
12. The system of claim 11 , further comprising a security module programmed to perform a security action in response to determining that the behavior of the purpose-built device is abnormal.
13. The system of claim 12 , wherein the security action comprises at least one of:
blocking the purpose-built device from the network;
filtering out the abnormal behavior of the purpose-built device on the network;
alerting a user to the abnormal behavior of the purpose-built device.
14. The system of claim 11 , wherein the determination module is programmed to determine the baseline pattern of behavior of the purpose-built device by monitoring the purpose-built device for a predetermined period of time to establish by observation the baseline behavior of the purpose-built device.
15. The system of claim 11 , wherein the determination module is programmed to determine the baseline pattern of behavior of the purpose-built device by querying the observation database with at least one behavioral observation about the purpose-built device and receiving a response correlating the behavioral observation about the purpose-built device with the baseline pattern of behavior of the purpose-built device.
16. The system of claim 11 , further comprising a sending module programmed to send a behavioral observation about the purpose-built device and an identifier of the purpose-built device to the observation database.
17. The system of claim 11 , further comprising a receiving module programmed to receive information about an update to the purpose-built device and determining a new baseline pattern of behavior of the purpose-built device in response to the update.
18. The system of claim 11 , wherein the type indicates a make and model of the purpose-built device.
19. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a purpose-built device expected to have a predictable pattern of behavior on a network;
determine a baseline pattern of behavior of the purpose-built device, wherein determining the baseline pattern of behavior of the purpose-built device comprises determining a type of the purpose-built device and, based on the type of the purpose-built device, querying an observation database populated with at least one observation of baseline behavior of at least one of a plurality of purpose-built devices of the type;
monitor the network to detect a behavior of the purpose-built device;
compare the behavior to the baseline pattern of behavior of the purpose-built device in order to determine that the behavior comprises an abnormal behavior.
20. The computer-readable-storage medium of claim 19 , wherein the type indicates a make and model of the purpose-built device.