Automatic integration of IOT devices into a network
Some embodiments provide a novel method that performs an automated process that identifies features of an IoT device connected to a network, and based on the identified features specifies, without an administrator input, one or more network policies (e.g., security policies) to apply to packets sent or received by the IoT device. The method of some embodiments also performs automated processes that (1) analyze packet flows to and from the IoT devices to identify dynamic network behavior of these devices, and then (2) specify network policies based on the identified dynamic network behavior.
1 . A method for defining network policies for IoT (Internet of Things) devices in a network, the method comprising:
detecting that a particular loT device has connected to the network;
after said detecting:
identifying one or more features of the particular IoT device;
using a machine-trained network, and feedback received from a behavioral assessment engine indicating anomalous or misclassified behavior of the particular IoT device, to select a subset of identified features to use for classifying the particular IoT device;
categorizing the particular IoT device based on the selected subset of features,
wherein categorizing the particular IoT device comprises providing the selected subset of features to a device classification system, wherein the device classification system determines a classification of the particular IoT device based on the selected subset of features, and
wherein the device classification system determines the classification of the particular IoT device by comparing the selected subset of features of the particular IoT device with sets of features specified by classification rules, each classification rule specifying a category associated with the rule's associated set of features, such that when an IoT device's selected subset of features matches the rule's set of features, the IoT device is assigned the category that is specified by the classification rule; and
based on categorization, defining a set of network policies to apply to the particular IoT device.
2 . The method of claim 1 , wherein the defined set of network policies comprise a set of security policies for the particular IoT device.
3 . The method of claim 2 , wherein the set of security policies comprise firewall policies.
4 . The method of claim 2 , wherein the set of security policies comprise network access control policies for enforcement by a network access controller that authenticates and authorizes IoT devices newly connected to the network.
5 . The method of claim 1 , wherein defining the set of network policies to apply to the particular IoT device further comprises programming one or more network policy engines to apply the defined set of network policies to the particular IoT device.
6 . The method of claim 1 , wherein each classification in the device classification system is defined by a set of one or more features.
7 . The method of claim 1 , wherein identifying one or more features comprises collecting data tuples regarding the features over a duration of time.
8 . The method of claim 7 , wherein collected data tuples comprises any one of server time-series, transmitted bytes time-series, received bytes time-series, network protocol time-series, Wi-Fi metrics time-series, network attributes time-series, device attributes time-series, and network device time-series.
9 . The method of claim 1 , wherein the machine trained network is trained by using known feature sets of IoT device groups, wherein the selected subset of identified features is associated with a particular IoT device group.
10 . The method of claim 9 , wherein the subset of features are features determined to be relevant to IoT devices of a same classification as the particular IoT device.
11 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for defining network policies for IoT (Internet of Things) devices in a network, the program comprising sets of instructions for:
detecting that a particular IoT device has connected to the network;
after said detecting:
identifying one or more features of the particular IoT device;
using a machine-trained network, and feedback received from a behavioral assessment engine indicating anomalous or misclassified behavior of the particular IoT device, to select a subset of identified features to use for classifying the particular IoT device;
based on the selected subset of features, associating the particular IoT device with a category of IoT devices,
wherein associating the particular IoT device comprises determining a classification of the particular IoT device based on the selected subset of features, and
wherein determining the classification of the particular IoT device comprises comparing the selected subset of features of the particular IoT device with sets of features specified by classification rules, each classification rule specifying a category associated with the rule's associated set of features, such that when an IoT device's selected subset of features matches the rule's set of features, the IoT device is assigned the category that is specified by the classification rule; and
based on the category association, defining a set of network policies for the particular IoT device and applying the set of network policies to the particular IoT device.
12 . The non-transitory machine readable medium of claim 11 , wherein the defined set of network policies comprise a set of security policies for the particular IoT device.
13 . The non-transitory machine readable medium of claim 12 , wherein the set of security policies comprise firewall policies.
14 . The non-transitory machine readable medium of claim 11 , wherein the set of instructions for defining the set of network policies to apply to the particular IoT device further comprises a set of instructions for programming one or more network policy engines to apply the defined set of network policies to the particular IoT device.
15 . The non-transitory machine readable medium of claim 11 , wherein the set of instructions for associating the particular IoT device with a category further comprises a set of instructions for providing the selected subset of features to a device classification system, wherein the device classification system determines a classification the particular IoT device based on the selected subset of features.
16 . The non-transitory machine readable medium of claim 15 , wherein each classification in the device classification system is defined by a set of one or more features.
17 . The non-transitory machine readable medium of claim 11 , wherein the set of instructions for identifying one or more features further comprises a set of instructions collecting data tuples regarding the features over a duration of time.
18 . The non-transitory machine readable medium of claim 17 , wherein collected data tuples comprise any one of server time-series, transmitted bytes time-series, received bytes time-series, network protocol time-series, Wi-Fi metrics time-series, network attributes time-series, device attributes time-series, and network device time-series.
19 . The non-transitory machine readable medium of claim 11 , wherein the machine trained network is trained by using known feature sets of IoT device groups, wherein the selected subset of identified features is associated with a particular IoT device group.
20 . The non-transitory machine readable medium of claim 19 , wherein the subset of features are features determined to be relevant to IoT devices of a same classification as the particular IoT device.