Autonomous application of security measures to IoT devices

1. A method comprising:

performing, by one or more computing devices:

receiving network activity data associated with a plurality of devices in a network, including a first device labeled as an Internet-of-Things (IoT) device and a second device labeled as a non-IoT device;

extracting one or more features from the network activity data, wherein the one or more features are included in a training data set;

providing the training data set including the one or more features as input to a machine learning model;

training the machine learning model using the training data set to classify unlabeled devices as IoT or non-IoT devices;

after the training, using the machine learning model to identify another device in the network as another IoT device; and

in response to the identifying of the other IoT device;

labeling the other IoT device with an IoT label, and

autonomously applying one or more security measures to the other IoT device including banning the other IoT device from the network, isolating the other IoT device, or limiting data sent by the other IoT device.

2. The method of claim 1 , further comprising the one or more computing devices performing a feature engineering technique to transform the one or more features prior to training the machine learning model.

3. The method of claim 2 , wherein the feature engineering technique includes one or more of:

calculating an average of an extracted feature,

calculating a standard deviation of the extracted feature,

filtering a portion of the network activity data, and

combining the network activity data with historical data.

4. The method of claim 1 , wherein the one or more features includes at least one of:

connection history of a device,

duration of a device connection,

ports used by the device,

timestamps of connections made by the device,

connection states of the device,

number of packets communicated to or from the device,

bytes transmitted to or from the device,

source IP address of connection involving the device,

destination IP address of a connection involving the device, and

one or more services utilized by the device.

5. The method of claim 1 , wherein the machine learning model includes one or more of:

a logistic regression model,

a Support Vector Machine (SVM) model, and

a random forest model.

6. The method of claim 1 , further comprising the one or more computing devices performing:

storing device data about the other IoT device in a database, wherein the device data indicates a classification of the other IoT device determined by the machine learning model.

7. The method of claim 1 , further comprising the one or more computing devices performing:

generating additional labels for additional devices in the network based on additional network activity data of the additional devices; and

retraining the machine learning model using the additional labels and additional network activity data.

8. The method of claim 1 , further comprising the one or more computing devices performing:

generating additional labels for additional devices in the network based on additional network activity data of the additional devices; and

retraining the machine learning model using the additional labels and additional network activity data.

9. The method of claim 1 , further comprising the one or more computing devices performing:

in response to the identifying of the other IoT device, elevating the other IoT device to a watch list for further monitoring.

10. The method of claim 6 further comprising the one or more computing devices performing:

detecting anomalous network activity associated with the other IoT device; and

issuing an alert using a user interface upon detecting the anomalous activity associated with the other IoT device.

11. A system comprising:

one or more computing devices configured to:

receive network activity data associated with a plurality of devices in a network, including a first device labeled as an Internet-of-Things (IoT) device and a second device labeled as a non-IoT device;

extract one or more features from the network activity data, wherein the one or more features are included in a training data set;

provide the training data set including the one or more features as input to a machine learning model;

train the machine learning model using the training data set to classify unlabeled devices as IoT or non-IoT devices;

after the training, use the machine learning model to identify another device in the network as another IoT device; and

in response to the identifying of the other IoT device;

label the other IoT device with an IoT label, and autonomously apply one or more security measures to the other IoT device including banning the other IoT device from the network, isolating the other IoT device, or limiting data sent by the other IoT device.

12. The system of claim 11 , wherein the one or more computing devices are configured to:

monitor the network over one or more wide area networks (WANs); and

collect the network activity data from the network over the one or more WANs.

13. The system of claim 11 , wherein the one or more computing devices are configured to:

perform a feature engineering technique to transform the one or more features prior to training the machine learning model.

14. The system of claim 13 , wherein to perform the feature engineering technique, the one or more computing devise is configured to:

calculate an average of an extracted feature,

calculate a standard deviation of the extracted feature,

filter a portion of the network activity data, or

combine the network activity data with historical data.

15. The system of claim 11 , wherein the one or more features includes at least one of:

connection history of a device,

duration of a device connection,

ports used by the device,

timestamps of connections made by the device,

connection states of the device,

number of packets communicated to or from the device,

bytes transmitted to or from the device,

source IP address of connection involving the device,

destination IP address of a connection involving the device, and

one or more services utilized by the device.

16. The system of claim 11 , wherein the machine learning model includes one or more of:

a logistic regression model,

a Support Vector Machine (SVM) model, and

a random forest model.

17. The system of claim 1 , wherein the one or more computing devices are configured to:

store device data about the other IoT device in a database, wherein the device data indicates a classification of the other IoT device determined by the machine learning model.

18. The system of claim 1 , wherein the one or more computing devices are configured to:

retrain the machine learning model using additional labels of devices in the network and additional network activity data received from the network.

19. The method of claim 1 , wherein the one or more computing devices are configured to:

in response to the identifying of the other IoT device, elevate the other IoT device to a watch list for further monitoring.

20. One or more non-transitory computer-readable media storing program instructions that when executed on one or more processors cause the one or more processors to:

receive network activity data associated with a plurality of devices in a network, including a first device labeled as an Internet-of-Things (IoT) device and a second device labeled as a non-IoT device;

extract one or more features from the network activity data, wherein the one or more features are included in a training data set;

provide the training data set including the one or more features as input to a machine learning model;

train the machine learning model using the training data set to classify unlabeled devices as IoT or non-IoT devices;

after the training, use the machine learning model to identify another device in the network as another IoT device; and

in response to the identifying of the other IoT device;

label the other IoT device with an IoT label, and autonomously apply one or more security measures to the other IoT device including banning the other IoT device from the network, isolating the other IoT device, or limiting data sent by the other IoT device.