Granted Patent B1

US 11,019,085 · App. 16/222,385 · Granted May 25, 2021

Inventors: Ilya Sokolov (Boston, MA); Bruce McCorkendale (Manhattan Beach, CA)

H04L63/1425G06F21/566H04L63/1416H04L63/1491

Abstract

Claims (59)

1. A computer-implemented method for identifying potentially risky traffic destined for network-connected devices, at least a portion of the method being performed by a cloud-based server comprising at least one processor, the method comprising:

receiving, at the cloud-based server, characteristics of a network-connected device being added to a network;

creating, at the cloud-based server, a digital virtual image of the network-connected device;

intercepting and quarantining, by a network monitoring device, a request sent to a port on the network-connected device;

sending the request from the network monitoring device to the cloud-based server;

receiving, at the cloud-based server, the request; and

performing, at the cloud-based server, a security action comprising:

sending the request to the digital virtual image of the network-connected device;

identifying the request as a potentially risky request by monitoring a runtime reaction of the digital virtual image of the network-connected device to the request; and

sending, to the network monitoring device, a message indicating the request is a potentially risky request.

2. The computer-implemented method of claim 1 , wherein the network-connected device is an Internet-of-Things device.

3. The computer-implemented method of claim 1 , wherein the network is at least in part an Internet-of-Things network.

4. The computer-implemented method of claim 1 , wherein the network monitoring device is a network router.

5. The computer-implemented method of claim 1 , further comprising:

detecting, by the network monitoring device, the characteristics of the network-connected device upon adding the network-connected device to the network; and

sending the characteristics from the network monitoring device to the cloud-based server.

6. The computer-implemented method of claim 5 , wherein detecting comprises:

scanning open ports on the network; and

detecting a type of computer-readable instructions stored on the network-connected device.

7. The computer-implemented method of claim 6 , further comprising detecting a version identifier of the computer-readable instructions and a revision identifier of the computer-readable instructions.

8. The computer-implemented method of claim 1 , wherein:

the digital virtual image of the network-connected device comprises at least some computer-readable instructions stored on the network-connected device; and

the computer-readable instructions are configured to monitor the port on the network-connected device.

9. The computer-implemented method of claim 8 , wherein the digital virtual image of the network-connected device comprises a same version and revision of the computer-readable instructions stored on the network-connected device.

10. The computer-implemented method of claim 1 , wherein creating the digital virtual image of the network-connected device at the cloud-based server comprises running firmware of the network-connected device in a virtual environment.

11. The computer-implemented method of claim 1 , wherein receiving the request is triggered by at least one of:

the request originating from a suspicious source;

the request being novel for a type of the network-connected device; and

the request specifically targeting the network-connected device.

12. The computer-implemented method of claim 1 , wherein receiving the request comprises decrypting the request.

13. The computer-implemented method of claim 1 , wherein the runtime reaction of the digital virtual image of the network-connected device to the request comprises at least one of:

a service crash;

a service hang;

a return of a server error status code;

a redirection of network traffic to another device; and

an unanticipated response.

14. The computer-implemented method of claim 1 , further comprising resetting the digital virtual image of the network-connected device following sending the message.

15. The computer-implemented method of claim 1 , further comprising blocking the potentially risky request from reaching at least one device in the network.

16. A system for identifying potentially risky traffic destined for network-connected devices, the system comprising:

at least one physical processor at a cloud-based server; and

physical memory comprising computer-executable instructions that, when executed by the at least one physical processor, cause the at least one physical processor to:

receive, at the cloud-based server, characteristics of a network-connected device being added to a network;

create, at the cloud-based server, a digital virtual image of the network-connected device;

receive, from a network monitoring device, a request sent to a port on the network-connected device, wherein the network monitoring device intercepted and quarantined the request; and

perform a security action comprising:

sending the request to the digital virtual image of the network-connected device;

identifying the request as a potentially risky request by monitoring a runtime reaction of the digital virtual image of the network-connected device to the request; and

sending, to the network monitoring device, a message indicating the request is a potentially risky request.

17. The system of claim 16 , wherein the network is at least in part an Internet-of-Things network.

18. The system of claim 16 , further comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to block the potentially risky request from reaching at least one device in the network.

19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a cloud-based server computing device, cause the computing device to:

receive, at the cloud-based server computing device, characteristics of a network-connected device being added to a network;

create, at the cloud-based server computing device, a digital virtual image of the network-connected device;

receive, from a network monitoring device, a request sent to a port on the network-connected device, wherein the network monitoring device intercepted and quarantined the request; and

perform a security action comprising:

sending the request to the digital virtual image of the network-connected device;

identifying the request as a potentially risky request by monitoring a runtime reaction of the digital virtual image of the network-connected device to the request; and

sending, to the network monitoring device, a message indicating the request is a potentially risky request.

20. The non-transitory computer-readable medium of claim 19 , wherein the network is at least in part an Internet-of-Things network.

Assignments (7)