Granted Patent B2

US 11,822,618 · App. 17/008,361 · Granted Nov 21, 2023

Inventors: Mohammad Rafey (Bangalore, IN); Hung The Dinh (Austin, TX); Bijan Kumar Mohanty (Austin, TX)

Assignee: Dell Products L.P.

G06F17/18G06F16/2462G06N5/04G06N20/00H04L63/20

Abstract

Claims (44)

1. A method comprising:

receiving, by a processor, data from a device within a network, wherein the data is associated with one or more features of the device;

determining a subset of the features of the device that is associated with a runtime behavior of the device;

performing a univariate analysis on a feature dataset that is associated with the subset of the features of the device;

performing a multivariate analysis on the feature dataset that is associated with correlated features in the subset of the features, wherein the multivariate analysis includes a covariance analysis with Pearson correlation method;

generating a device signature based on the univariate analysis and the multivariate analysis;

generating a predictive model based on the device signature, wherein the predictive model is trained on historical data of devices in the network;

generating a device profile based on the predictive model that may be used to determine a device type and the runtime behavior of the device; and

determining a segment of the network associated with the device based on the device type and the runtime behavior of the device.

2. The method of claim 1 , wherein the univariate analysis includes standard deviation analysis.

3. The method of claim 1 , wherein the historical data were collected prior to the multivariate analysis.

4. The method of claim 1 , wherein the predictive model is generated based on a long short-term memory analysis.

5. The method of claim 1 , further comprising determining a correlation between a first feature and a second feature of the subset of the one or more features.

6. The method of claim 1 , further comprising determining a security status of the device based on the device profile.

7. The method of claim 6 , further comprising determining a security policy based on the device profile and the security status of the device.

8. The method of claim 7 , further comprising applying the security policy to the segment of the network.

9. The method of claim 7 , further comprising monitoring the devices in the network.

10. An information handling system, comprising:

a hardware processor; and

a memory device accessible to the hardware processor, the memory device storing instructions that when executed perform operations, the operations including:

receiving data from a device within a network coupled to the information handling system, wherein the data is associated with one or more features of the device;

performing a univariate analysis on the data that is associated with a subset of the features of the device, wherein the subset of the features of the device is associated with a runtime behavior of the device;

performing a multivariate analysis on the data that is associated with correlated features in the subset of the features;

generating a device signature based on the univariate analysis and the multivariate analysis;

performing a deep learning analysis on the data based on the device signature and a predictive model trained on the data;

generating a device profile based on the predictive model and the device signature, wherein the device profile is associated with a device type; and

determining a segment of the network based on the device type.

11. The information handling system of claim 10 , the operations further comprising determining a correlation between a first feature and a second feature of the subset of the one or more features.

12. The information handling system of claim 10 , the operations further comprising determining a security status of the device based on the device profile.

13. The information handling system of claim 12 , the operations further comprising determining a security policy based on the device profile and the security status of the device.

14. The information handling system of claim 13 , the operations further comprising applying the security policy to the network.

15. A non-transitory computer-readable medium including code that when executed performs a method, the method comprising:

receiving data from a device within a network, wherein the data is associated with one or more features of the device;

performing a univariate analysis on the data associated with a subset of the features of the device, wherein the subset of the features of the device is associated with a runtime behavior of the device;

performing a multivariate analysis on the data associated with correlated features in the subset of the features, wherein the multivariate analysis includes a covariance analysis with Pearson correlation method;

generating a device signature based on the univariate analysis and the multivariate analysis;

generating a predictive model trained on historical data, wherein the predictive model is based on the device signature;

generating a device profile based on the predictive model and the data received from the device, wherein the predictive model is associated with a device type; and

determining a microsegment of the network based on the device type.

16. The non-transitory computer-readable medium of claim 15 , wherein the univariate analysis includes a standard deviation analysis.

17. The non-transitory computer-readable medium of claim 15 , wherein the historical data were collected prior to the multivariate analysis.

18. The non-transitory computer-readable medium of claim 15 , wherein the predictive model is generated based on a long short-term memory analysis.

19. The non-transitory computer-readable medium of claim 15 , wherein the univariate analysis generates a standard deviation pattern.

20. The non-transitory computer-readable medium of claim 15 , wherein the multivariate analysis generates a covariance pattern.

Assignments (9)