System and method for inferring device type based on port usage
A system and method for inferring device types. A method includes selecting a device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction; and determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected device type inference model to a plurality of features, wherein the plurality of features is extracted from device activity data indicating ports used by the device and at least one volume of traffic communicated via each port used by the device.
1. A method for inferring device types, comprising:
selecting a manufacturer-specific device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction;
determining, from device activity data of the device, a port usage distribution indicating traffic volumes for each port used by the device, wherein the device activity data indicates ports used by the device and at least one volume of traffic communicated via each port used by the device;
extracting a plurality of features from device activity data of the device and the port usage distribution; and
determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected manufacturer-specific device type inference model to the extracted plurality of features.
2. The method of claim 1 , wherein determining the distribution of port usage further comprises:
applying a distribution dissimilarity model to the port usage distributions, wherein the distribution dissimilarity model outputs a plurality of distances, wherein each distance is based on a difference between a distribution of values for each port indicated in the port usage distribution and a distribution of values for each corresponding port of each of a plurality of device types capable of being output by the selected manufacturer-specific device type inference model, wherein the extracted plurality of features includes the plurality of distances.
3. The method of claim 1 , further comprising:
adding the inferred device type for the device to a device profile of the device.
4. The method of claim 1 , further comprising:
normalizing a plurality of manufacturer values among the device activity data, wherein the manufacturer of the device is determined based on the normalized plurality of manufacturer values.
5. The method of claim 1 , further comprising:
determining a manufacturer of the device based on the device activity data, wherein the respective manufacturer for each of the plurality of device type inference models is the determined manufacturer.
6. The method of claim 1 , further comprising:
monitoring behavior of the device with respect to the inferred device type in order to detect at least one abnormal behavior of the device.
7. The method of claim 6 , wherein the abnormal behavior is a deviation from a predetermined normal behavior associated with the inferred device type.
8. The method of claim 6 , further comprising:
performing at least one mitigation action based on the detected at least one anomaly in behavior of the device.
9. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
selecting a manufacturer-specific device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction;
determining, from device activity data of the device, a port usage distribution indicating traffic volumes for each port used by the device, wherein the device activity data indicates ports used by the device and at least one volume of traffic communicated via each port used by the device;
extracting a plurality of features from device activity data of the device and the port usage distribution; and
determining an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected manufacturer-specific device type inference model to the extracted plurality of features.
10. A system for inferring device types, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
select a manufacturer-specific device type inference model from among a plurality of device type inference models based on a manufacturer of a device, wherein each device type inference model corresponds to a respective manufacturer and is trained using training data of devices manufactured by the respective manufacturer, wherein each device type inference model is trained to output a device type prediction;
determine, from device activity data of the device, a port usage distribution indicating traffic volumes for each port used by the device, wherein the device activity data indicates ports used by the device and at least one volume of traffic communicated via each port used by the device;
extract a plurality of features from device activity data of the device and the port usage distribution; and
determine an inferred device type for the device, wherein determining the inferred device type for the device further comprises applying the selected manufacturer-specific device type inference model to the extracted plurality of features.
11. The system of claim 10 , wherein the system is further configured to:
apply a distribution dissimilarity model to the port usage distributions, wherein the distribution dissimilarity model outputs a plurality of distances, wherein each distance is based on a difference between a distribution of values for each port indicated in the port usage distribution and a distribution of values for each corresponding port of each of a plurality of device types capable of being output by the selected manufacturer-specific device type inference model, wherein the extracted plurality of features includes the plurality of distances.
12. The system of claim 10 , wherein the system is further configured to:
add the inferred device type for the device to a device profile of the device.
13. The system of claim 10 , wherein the system is further configured to:
normalize a plurality of manufacturer values among the device activity data, wherein the manufacturer of the device is determined based on the normalized plurality of manufacturer values.
14. The system of claim 10 , wherein the system is further configured to:
determine a manufacturer of the device based on the device activity data, wherein the respective manufacturer for each of the plurality of device type inference models is the determined manufacturer.
15. The system of claim 10 , wherein the system is further configured to:
monitor behavior of the device with respect to the inferred device type in order to detect at least one abnormal behavior of the device.
16. The system of claim 15 , wherein the abnormal behavior is a deviation from a predetermined normal behavior associated with the inferred device type.
17. The system of claim 15 , wherein the system is further configured to:
perform at least one mitigation action based on the detected at least one anomaly in behavior of the device.