Online generation and updates of IoT mud policies

1. A method, comprising:

analyzing, by a classification device in a computer network, data from a given device in the computer network;

classifying, by the classification device, the given device as a particular type of device based on the data;

determining, by the classification device, whether a manufacturer usage description (MUD) policy exists for the particular type of device;

in response to there being no existing MUD policy for the particular type of device:

determining, by the classification device, patterns of the analyzed data;

classifying, by the classification device, the patterns into context-based policies; and

generating, by the classification device, a derived MUD policy for the particular type of device based on the context-based policies;

applying, by the classification device, one of either the existing or derived MUD policy for the given device within the computer network;

monitoring additional data from the given device for changes to the patterns; and

one of either classifying the changes as legitimate and adjusting derived MUD policy in response or classifying the changes as malware; and

re-evaluating the additional data to classify the changes as obsolete and aging out the existing or derived MUD policy.

2. The method as in claim 1 , wherein applying comprises:

directing configuration of one or more network devices to control network traffic related to the given device.

3. The method as in claim 1 , wherein the existing MUD policy is a previously derived MUD policy based on previously classified devices of the particular type of device.

4. The method as in claim 1 , further comprising:

refining the derived MUD policy based on subsequently classified devices of the particular type of device.

5. The method as in claim 1 , wherein classifying the patterns into context-based policies comprises:

determining functionality roles of network addresses analyzed within the data; and

defining the context-based policies according to the functionality roles.

6. The method as in claim 5 , wherein functionality roles are selected from a group consisting of: manufacturer; devices of a same manufacturer; controller; and my-controller.

7. The method as in claim 1 , further comprising:

determining a confidence level in the derived MUD policy; and

applying the derived MUD policy only in response to the confidence level surpassing a threshold confidence.

8. The method as in claim 1 , wherein the data from the given device comprises an explicit request for a derived MUD file and supplied information to allow classification of the given device.

9. The method as in claim 1 , wherein the data from the given device comprises a model number of the given device.

10. The method as in claim 1 , wherein the context-based policies comprise context-based access control policies for traffic to the given device and context-based access control policies for traffic from the given device.

11. The method as in claim 1 , further comprising:

supplementing the patterns with training data having restrictive rules for classifying the patterns into context-based policies.

12. The method as in claim 1 , further comprising:

applying the derived MUD policy despite there being an existing MUD policy.

13. The method as in claim 1 , wherein classifying the patterns of context-based policies is based on one or more features selected from a group consisting of: number of connections; bytes transferred; hostname:port pairs; packet round-trip time (RTT); periodicity of communication; and sequence of packet lengths and inter-arrival times (SPLT).

14. The method as in claim 1 , further comprising:

enriching the context-based policies based on one or more of: domain name server (DNS) flows; hypertext transfer protocol (HTTP) uniform resource identifiers (URIs); transport layer security (TLS) certificate info; known application protocols; and policy violation logs.

15. A tangible, non-transitory, computer-readable medium storing program instructions that cause a computer to execute a process comprising:

analyzing data from a given device in the computer network;

classifying the given device as a particular type of device based on the data;

determining whether a manufacturer usage description (MUD) policy exists for the particular type of device;

in response to there being no existing MUD policy for the particular type of device:

determining patterns of the analyzed data;

classifying the patterns into context-based policies; and

generating a derived MUD policy for the particular type of device based on the context-based policies;

applying one of either the existing or derived MUD policy for the given device within the computer network; and monitoring additional data from the given device for changes to the patterns; and one of either

classifying the changes as legitimate and adjusting derived MUD policy in response; or

classifying the changes as malware; and

re-evaluating the additional data to classify the changes as obsolete and aging out the existing or derived MUD policy.

16. The computer-readable medium as in claim 15 , wherein the process further comprises:

refining the derived MUD policy based on subsequently classified devices of the particular type of device.

17. The computer-readable medium as in claim 15 , wherein the process, when classifying the patterns into context-based policies, comprises:

determining functionality roles of network addresses analyzed within the data; and

defining the context-based policies according to the functionality roles.

18. The computer-readable medium as in claim 15 , wherein process the further comprises:

determining a confidence level in the derived MUD policy; and

applying the derived MUD policy only in response to the confidence level surpassing a threshold confidence.

19. An apparatus, comprising:

one or more network interfaces to communicate with a computer network;

a processor coupled to the network interfaces and configured to execute one or more process; and

a memory configured to store a process executable by the processor, the process when executed configured to:

analyze data from a given device in the computer network;

classify the given device as a particular type of device based on the data;

determine whether a manufacturer usage description (MUD) policy exists for the particular type of device;

in response to there being no existing MUD policy for the particular type of device:

determine patterns of the analyzed data;

classify the patterns into context-based policies; and

generate a derived MUD policy for the particular type of device based on the context-based policies;

apply one of either the existing or derived MUD policy for the given device within the computer network and

monitor additional data from the given device for changes to the patterns; and one of either

classify the changes as legitimate and adjusting derived MUD policy in response; or

classify the changes as malware; and

re-evaluate the additional data to classify the changes as obsolete and aging out the existing or derived MUD policy.