Granted Patent B2

US 12,309,148 · App. 16/809,377 · Granted May 20, 2025

Inventors: Srinivas Akella (San Jose, CA); Shahab Sheikh-Bahaei (Atherton, CA)

Assignee: NETSKOPE, INC.

H04L63/0876G06N3/08G06N20/00H04L67/306

Abstract

Claims (73)

1. A method to generate a hyper context associated with a computing device, the method comprising:

receiving, by a network gateway, communication data from the computing device;

storing, by the network gateway, the communication data in a database;

accessing the communication data associated with the computing device from the database;

extracting one or more features associated with the computing device from the communication data;

detecting a type of the computing device;

detecting an operating system associated with the computing device;

detecting a control associated with the computing device;

detecting a functionality of the computing device;

detecting an ownership of the computing device; and

defining a hyper context associated with the computing device, wherein the hyper context is comprised of a type context, a category context, an operating system context, an ownership context related to information regarding an entity that owns the computing device, a connectivity context, and a control context, and wherein the defining a hyper context includes at least one normalization operation on at least one weighted matrix that includes one or more predicted features of the computing device.

2. The method of claim 1 , wherein the communication data includes packet data, WiFi radio data, Bluetooth data, or Bluetooth Low Energy data.

3. The method of claim 1 , wherein the features include a manufacturer, a device host name, a list of top sites visited, a number of sites visited, one or more top user-agents used, one or more network features, one or more operating system signatures, one or more active hours, an hourly behavior profiling, and a realtime behavior profiling.

4. The method of claim 1 , wherein detecting a type of the computing device comprises:

running one or more type-detection rules;

generating a weighted matrix of predicted types;

running a trained machine learning type-detection model;

generating a prediction responsive to the running;

adding the prediction to the weighted matrix;

normalizing one or more weights;

computing a probability for a type of the computing device;

predicting a type of the computing device based on a value of the probability; and

computing a device category responsive to the prediction.

5. The method of claim 1 , wherein detecting an operating system associated with the computing device comprises:

running one or more operating system detection rules;

generating a weighted matrix of predicted operating systems;

running a machine learning operating system detection model;

generating a prediction by the machine learning operating system detection model;

adding the prediction to the weighted matrix;

normalizing one or more weights associated with the weighted matrix;

calculating a probability for each operating system; and

predicting a device operating system responsive to the calculating.

6. The method of claim 1 , wherein detecting a control associated with the computing device comprises:

running one or more control-detection rules;

generating a weighted matrix of predicted control;

normalizing one or more weights associated with the weighting matrix;

calculating a probability to determine automatic operation versus user-controlled operation for the computing device; and

determining a device control responsive to the calculation.

7. The method of claim 1 , wherein detecting a functionality of the computing device comprises:

running function-detection rules,

generating a weighted prediction matrix, wherein the weighted prediction matrix includes a type of the computing device, an operating system associated with the computing device, and a control associated with the computing device;

generating a prediction using a trained machine learning model;

adding the prediction to the weighted prediction matrix;

normalizing one or more numerical weights associated with the prediction;

calculating a probability for a plurality of functions associated with the prediction; and

detecting a functionality of the computing device as a function with a substantially maximum probability.

8. The method of claim 1 , further comprising classifying the computing device based on ownership, wherein the computing device is classified as a corporate device, an employee-owned device, a visitor device, a transient device, or a neighboring device.

9. The method of claim 8 , wherein the classification is performed on a basis of an average visibility over time associated with the computing device, and an average visibility to one or more sensors.

10. The method of claim 1 , wherein the communication data includes data associated with a wireless communication protocol or a wired communication protocol.

11. The method of claim 1 , wherein the hyper context is defined independently of an IP address associated with the computing device.

12. The method of claim 1 , wherein the communication data is associated with the computing device communicating over a computer network independently of the network gateway.

13. An apparatus to generate a hyper context associated with a computing device, the apparatus comprising:

a database;

a network gateway configured to receive communication data from the computing device and store the communication data in the database;

a processing system configured to access the communication data from the database and process the communication data, wherein the processing system:

extracts one or more features associated with the computing device from the communication data;

detects a type of the computing device;

detects an operating system associated with the computing device;

detects a control associated with the computing device;

detects a functionality of the computing device;

detects an ownership of the computing device; and

defines a hyper context associated with the computing device, wherein the hyper context is comprised of a type context, a category context, an operating system context, an ownership context related to information regarding an entity that owns the computing device, a connectivity context, and a control context, and wherein the defining a hyper context includes at least one normalization operation on at least one weighted matrix that includes one or more predicted features of the computing device.

14. The apparatus of claim 13 , wherein at least one of the detecting a type of the computing device, detecting an operating system, detecting a control, and detecting a functionality includes calculating a respective probability measure.

15. The apparatus of claim 13 , wherein the network gateway includes a wireless sensor array and a network traffic sensor array.

16. The apparatus of claim 15 , wherein the wireless sensor array includes a WiFi packet sniffer and a Bluetooth packet sniffer.

17. The apparatus of claim 13 , wherein the processing system classifies the computing device, and wherein the computing device is classified as a corporate device, an employee-owned device, a visitor device, a transient device, or a neighboring device.

18. The apparatus of claim 17 , wherein the classification is performed on a basis of an average visibility over time associated with the computing device, and an average visibility to one or more sensors.

19. The apparatus of claim 13 , wherein the communication data includes packet data, WiFi radio data, Bluetooth data, or Bluetooth Low Energy data.

20. The apparatus of claim 13 , wherein the features include a manufacturer, a device host name, a list of top sites visited, a number of sites visited, one or more top user-agents used, one or more network features, one or more operating system signatures, one or more active hours, an hourly behavior profiling, and a realtime behavior profiling.

21. The apparatus of claim 20 , wherein an operating system signature includes one or more unique sites visited by an operating system associated with the computing device.

22. The apparatus of claim 20 , wherein an active hour includes active hours associated with the computing device based on packet traffic data, and observed hours associated with WiFi sniff data.

23. The apparatus of claim 13 , wherein the hyper context is defined independently of an IP address associated with the computing device.

24. The apparatus of claim 13 , wherein the communication data is associated with the computing device communicating over a computer network independently of the network gateway.

Assignments (2)

Continuity (1)

References Cited (56)