Internet-of-things device classifier
Methods and systems for classifying a device on a network. The systems and methods may receive network activity data associated with an unknown device. A classifier executing one or more machine learning models may then classify the device as an internet of things (IoT) device or a non-IoT device.
1. A method for classifying a device on a network, the method comprising:
receiving network activity data associated with a device on a network;
extracting at least one feature from the network activity data associated with the device on the network;
providing the at least one extracted feature as input to a classifier executing a machine learning model configured to classify the device as an internet-of-things (IoT) device or a non-IoT device based on the at least one extracted feature;
receiving a label indicating that the device is an IoT device or a non-IoT device from the classifier executing the machine learning model; and
executing at least one security measure upon receiving the label that the device is an IoT device, wherein the at least one security measure includes banning the IoT device from the network, isolating the IoT device, or setting a limit on data able to be sent from the IoT device.
2. The method of claim 1 further comprising training the machine learning model based on network activity data associated with at least one training device labeled as an IoT device or a non-IoT device.
3. The method of claim 2 further comprising extracting at least one training feature from the network activity data associated with the at least one training device, wherein the machine learning model is trained based on the at least one extracted training feature.
4. The method of claim 3 further comprising performing at least one feature engineering technique to enhance the at least one extracted training feature prior to training the machine learning model.
5. The method of claim 1 wherein the at least one feature includes at least one of connection history of the device, duration of a device connection, ports used by the device, timestamps of connections made by the device, connection states of the device, number of packets communicated to or from the device, bytes transmitted to or from the device, source IP address of connection involving the device, destination IP address of a connection involving the device, and services utilized by the device.
6. The method of claim 1 further comprising, upon receiving a label indicating that the device is an IoT device, elevating the IoT device to a watch list for further monitoring.
7. The method of claim 6 further comprising:
detecting anomalous network activity associated with the IoT device; and
issuing an alert using a user interface upon detecting the anomalous activity associated with the IoT device.
8. The method of claim 1 further comprising updating the machine learning model with the received label.
9. A system for classifying a device on a network, the system comprising:
an interface for receiving network activity data associated with a device on a network; and
a processor executing instructions stored on memory to provide:
a feature extraction module configured to extract at least one feature related to the network activity data associated with the device on the network, and
a classifier executing a machine learning model configured to:
receive the at least one extracted feature as input, and
provide a label indicating that the device is an internet-of-things (IoT) device or a non-IoT device, wherein the processor is further configured to execute at least one security measure upon receiving the label that the device is an IoT device, wherein the at least one security measure includes banning the IoT device from the network, isolating the IoT device, or setting a limit on data able to be sent from the IoT device.
10. The system of claim 9 wherein the machine learning model is trained based on network activity data associated with at least one training device labeled as an IoT device or a non-IoT device.
11. The system of claim 10 wherein the feature extraction module is configured to extract at least one training feature from the network activity data associated with the at least one training device, wherein the machine learning model is trained based on the at least one extracted training feature.
12. The system of claim 11 wherein the classifier is further configured to perform at least one feature engineering technique to enhance the at least one extracted training feature prior to training the machine learning model.
13. The system of claim 9 wherein the at least one feature includes at least one of connection history of the device, duration of a device connection, ports used by the device, timestamps of connections made by the device, connection states of the device, number of packets communicated to or from the device, bytes transmitted to or from the device, source IP address of connection involving the device, destination IP address of a connection involving the device, and services utilized by the device.
14. The system of claim 9 wherein the processor is further configured to, upon the classifier providing a label indicating that the device is an IoT device, elevate the IoT device to a watch list for further monitoring.
15. The system of claim 14 , wherein the processor is further configured to:
detect anomalous network activity associated with the IoT device; and
issue an alert using a user interface upon detecting the anomalous activity associated with the IoT device.
16. The system of claim 9 wherein the classifier is further configured to update the machine learning model with the provided label indicating that the device is an IoT device or a non-IoT device.
17. A method for training an internet of things (IoT) device classifier, the method comprising:
deploying at least one labeled IoT device in a network environment;
deploying at least one labeled non-IoT device in the network environment;
receiving network activity data associated with each of the IoT device and the non-IoT device;
extracting at least one feature related to the network activity data associated with each of the IoT device and the non-IoT device;
providing the at least one extracted feature associated with each of the IoT device and the non-IoT device and the devices' label to a machine learning model; and
training the machine learning model to, when executed by a classifier, classify an unlabeled device as an IoT device or a non-IoT device based on the at least one extracted feature associated with each of the IoT device and the non-IoT device and the devices' labels.
18. The method of claim 17 further comprising performing at least one feature engineering technique to enhance the at least one extracted feature prior to providing the extracted feature to the classifier for training.
19. The method of claim 17 further comprising:
providing network activity data regarding an unlabeled device to the machine learning model; and
receiving from the machine learning model a classification of the unlabeled device as an IoT device or a non-IoT device.
20. The method of claim 19 further comprising retraining the machine learning model based on the classification of the unlabeled device as IoT device or a non-IoT device.