IP Library › Granted Patent US 11,343,149
Granted Patent B2
US 11,343,149 · App. 17/024,469 · Granted May 24, 2022

Self-training classification

Inventors: Siying Yang (Cupertino, CA); Yang Zhang (Fremont, CA)
Assignee: Forescout Technologies, Inc.
H04L41/0853G06K9/6267G06N20/00H04L43/04H04L43/10
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,343,149
App. No.
17/024,469
Granted
May 24, 2022
Kind
B2
Abstract

Systems, methods, and related technologies for self-training classification are described. In certain aspects, a plurality of device classification methods with associated models are accessed. Each of the classification methods have an associated reliability level. The models of classification methods with a higher reliability level than other classifications methods are used to train the models associated with lower reliability level. The trained models and associated classification methods are thus improved.

Claims (48)

1. A training method comprising:

accessing a plurality of device classification methods, wherein each of the plurality of methods has a respective associated model, and wherein each of the plurality of methods has a respective associated reliability level;

generating a respective data set associated with each of the device classification methods based on classifying a plurality of devices communicatively coupled to a network;

selecting a set of device classification methods from the plurality of device classification methods, wherein the set of device classification methods comprises a hierarchy of reliability;

determining a training data set using a respective data set associated with a first device classification method of the set of classification methods;

training, by a processing device, a second device classification method using the training data set generated from performing the first device classification method and wherein the second device classification method has a higher reliability level than the first device classification method;

determining a second training data set using an output of the second device classification method;

training a third device classification method using the second training data set generated from performing the second device classification method, wherein the second device classification method has a higher reliability level for classifying a device than the third classification method; and

storing the trained second device classification model and the trained third device classification method.

2. The training method of claim 1 , further comprising:

performing an initial classification of the plurality of devices communicatively coupled to the network; and

determining which of the plurality of device classification methods can be used based on the initial classification of the plurality of devices communicatively coupled to the network.

3. The training method of claim 1 , further comprising:

performing classification using the second device classification method.

4. The training method of claim 1 , wherein the training of the second device classification method model using the training data set is performed on a per device basis.

5. The training method of claim 1 , wherein each respective model associated with the plurality of device classification methods is a machine learning model.

6. The training method of claim 1 , wherein the respective associated reliability level associated with the plurality of device classification methods is configurable.

7. The training method of claim 1 , wherein the respective associated reliability level associated with a device classification method is automatically adjusted based on one or more classification results based on the device classification method.

8. The training method of claim 1 , wherein the selecting of the first device classification method and the second device classification method of the plurality of device classification methods is based on a network environment.

9. The training method of claim 1 , wherein the first device classification method comprises at least one of an agent based classification method, an aggregator based method, an active probing based method, a passive traffic analysis method, a traffic log analysis method, or a traffic based behavior heuristic method.

10. A system comprising:

a memory; and

a processing device, operatively coupled to the memory, to:

access a plurality of device classification methods, wherein each of the plurality of methods has a respective associated model, and wherein each of the plurality of methods has a respective associated reliability level;

generate a respective data set associated with each of the device classification methods based on classifying a plurality of devices communicatively coupled to a network;

select a set of device classification methods from the plurality of device classification methods, wherein the set of device classification methods comprises a hierarchy of reliability;

determine a training data set using a respective data set associated with a first device classification method of the set of classification methods;

train a second device classification method using the training data set generated from performing the first device classification method and wherein the second device classification method has a higher reliability level than the first device classification method;

determine a second training data set using an output of the second device classification method;

train a third device classification method using the second training data set generated from performing the second device classification method, wherein the second device classification method has a higher reliability level for classifying a device than the third classification method; and

store the trained second device classification model and the trained third device classification model.

11. The system of claim 10 , wherein the processing device further to:

perform an initial classification of the plurality of devices communicatively coupled to the network; and

determine which of the plurality of device classification methods can be used based on the initial classification of the plurality of devices communicatively coupled to the network.

12. The system of claim 10 , wherein the processing device further to:

perform classification using the second device classification method.

13. The system of claim 10 , wherein the training of the second device classification method model using the training data set is performed on a per device basis.

14. The system of claim 10 , wherein each respective model associated with the plurality of device classification methods is a machine learning model.

15. The system of claim 10 , wherein the respective associated reliability level associated with the plurality of device classification methods is configurable.

16. The system of claim 10 , wherein the selecting of the first device classification method and the second device classification method of the plurality of device classification methods is based on a network environment.

17. The system of claim 10 , wherein the first device classification method comprises at least one of an agent based classification method, an aggregator based method, an active probing based method, a passive traffic analysis method, a traffic log analysis method, or a traffic based behavior heuristic method.

18. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

determine which of a plurality of device classification methods can be used based on an initial classification of a plurality of devices communicatively coupled to a network;

generate a respective data set associated with each of a plurality of device classification methods based on classifying a plurality of devices communicatively coupled to a network, wherein each of the plurality of methods has a respective associated model, and wherein each of the plurality of methods has a respective associated reliability level for classifying a device communicatively coupled to the network;

determine a training data set using one of the respective data sets associated with a first device classification method of the plurality of the methods; and

train, by the processing device, a second device classification method model using the training data set.

19. The non-transitory computer readable medium of claim 18 , wherein to train the second device classification method model using the training data set is performed on a per device basis.

20. The non-transitory computer readable medium of claim 18 , wherein the first device classification method and the second device classification method of the plurality of device classification methods are selected based on a network environment.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 17, 2020
From: YANG, SIYING; ZHANG, YANG
To: FORESCOUT TECHNOLOGIES, INC.
Reel/Frame 053808/0560 →
Continuity (2)
Continuation 16023413 · Jun 29, 2018
Related Publication 20210006465A1 · Jan 7, 2021