Systems and methods for device fingerprinting
Systems and methods to continuously classify temporal communication data associated with a computing device are described. In one embodiment, temporal communication data associated with the computing device is accessed and processed to create a plurality of preprocessing models. The preprocessing models are used to train a neural network. The neural network derives one or more properties associated with the computing device from the temporal communication data. A device fingerprint is defined from the one or more properties. Subsequent to defining the device fingerprint, additional temporal communication data associated with the computing device is accessed. The neural network derives one or more additional properties associated with the computing device from the additional temporal communication data. The one or more additional properties are aggregated into the defined device fingerprint, refining the defined device fingerprint.
1. A method to continuously classify temporal communication data associated with a computing device, the method comprising:
accessing temporal communication data associated with the computing device;
vectorizing the temporal communication data to generate one or more feature vectors, wherein the vectorizing includes converting one or more words in the temporal communication data to a vectorized form while preserving a semantic relationship between the words;
performing one or more vector averaging and vector normalization operations on the feature vectors;
combining the averaged and normalized feature vectors to generate a feature matrix;
further processing the temporal communication data to generate a plurality of preprocessing models, wherein at least one preprocessing model in the plurality of preprocessing models includes the feature matrix;
training, using data generated by the preprocessing models, a neural network;
deriving, by the neural network, one or more properties associated with the computing device from the temporal communication data;
defining, a device fingerprint from the one or more properties;
subsequent to defining the device fingerprint, accessing additional temporal communication data associated with the computing device;
deriving, by the neural network, one or more additional properties associated with the computing device from the additional temporal communication data; and
aggregating the one or more additional properties into the defined device fingerprint refining the defined device fingerprint.
2. The method of claim 1 , wherein the neural network is a convolutional neural network.
3. The method of claim 1 , wherein the temporal communication data includes data associated with a wireless communication protocol or a wired communication protocol.
4. The method of claim 3 , wherein the wireless communication protocol is any of WiFi, Bluetooth, Bluetooth Low Energy, Zigbee, Long-Term Evolution, mobile network data, ultrasound, or an optical communication protocol.
5. The method of claim 3 , wherein the wired communication protocol is any of Ethernet, SCADA, USB, IoT, or an arbitrary network protocol.
6. The method of claim 1 , wherein the refining is performed on a continuous basis.
7. The method of claim 1 , further comprising:
detecting a radio interface information for each interface supported by the computing device;
detecting an operating system, a type, and a classification associated with the computing device from the temporal communication data;
detecting a micro location of the computing device;
detecting a mobility of the computing device;
detecting an ownership and control of the computing device; and
detecting protocol and data characteristics of the computing device.
8. The method of claim 1 , wherein the properties are any combination of RF signal strength, spectrum analysis, MAC address, one or more frames, transmission rate, medium access frame size, and inter packet arrival.
9. The method of claim 1 , further comprising generating a label responsive to generating the defined device fingerprint.
10. The method of claim 9 , further comprising generating a policy to control access to and from the computing device.
11. An apparatus to continuously classify temporal communication data associated with a computing device, the apparatus comprising:
a database configured to store temporal communication data associated with the computing device;
a processing system configured to:
vectorize the temporal communication data to generate one or more feature vectors, wherein the vectorizing includes converting one or more words in the temporal communication data to a vectorized form while preserving a semantic relationship between the words;
perform one or more vector averaging and vector normalization operations on the feature vectors;
combine the averaged and normalized feature vectors to generate a feature matrix; and
further process the data to generate a plurality of preprocessing models, wherein at least one preprocessing model in the plurality of preprocessing models includes the feature matrix; and
a neural network, wherein the neural network is trained using data generated by the preprocessing models, wherein the neural network derives one or more properties associated with the computing device from the temporal communication data, wherein the neural network defines a device fingerprint from the one or more properties, wherein the neural network accesses additional temporal communication data, wherein the neural network derives one or more additional properties associated with the computing device from the additional temporal communication data, and wherein the neural network aggregates the one or more additional properties into the defined fingerprint refining the defined device fingerprint.
12. The apparatus of claim 11 , wherein the neural network is a convolutional neural network.
13. The apparatus of claim 11 , wherein the temporal communication data includes data associated with a wireless communication protocol or a wired communication protocol.
14. The apparatus of claim 13 , wherein the wireless communication protocol is any of WiFi, Bluetooth, Bluetooth Low Energy, Zigbee, Long-Term Evolution, mobile network data, ultrasound, or an optical communication protocol.
15. The apparatus of claim 13 , wherein the wired communication protocol is any of Ethernet, SCADA, USB, IoT, or an arbitrary network protocol.
16. The apparatus of claim 11 , wherein the temporal communication data is comprised of historical communication data and communication data for a present time interval.
17. The apparatus of claim 11 , wherein the properties are any combination of RF signal strength, spectrum analysis, MAC address, one or more frames, transmission rate, medium access frame size, and inter packet arrival.
18. The apparatus of claim 11 , further comprising a network gateway, wherein the network gateway receives the temporal communication data from the computing device, and wherein the network gateway stores the temporal communication data on the database.
19. The apparatus of claim 18 , wherein the network gateway includes a wireless sensor array and a network traffic sensor array.
20. The apparatus of claim 19 , wherein the wireless sensor array includes a WiFi packet sniffer and a Bluetooth packet sniffer.