Device attribute determination based on protocol string conventions
A system and method for determining device attributes based on protocol string conventions. A method includes applying at least one machine learning model to an application data set extracted based on at least one first pair of strings, each first pair of strings including a protocol string and a key string indicated in respective fields of communications session data corresponding to a device, wherein each machine learning model is trained based on a training data set including second pairs of strings device attribute labels, wherein each device attribute label corresponds to one of the second pairs of strings, wherein each of the at least one machine learning model is configured to output a predicted device attribute for the device based on the first pair of strings; and determining, based on the output of the at least one machine learning model, at least one device attribute of the device.
1 . A method for determining device attributes based on protocol string conventions, comprising:
applying at least one machine learning model to an application data set extracted based on at least one first pair of strings, each first pair of strings including a protocol string and a key string indicated in respective fields of communications session data corresponding to a device, wherein each of the at least one machine learning model is trained based on a training data set including a plurality of second pairs of strings and a plurality of device attribute labels, wherein each device attribute label corresponds to one of the second pairs of strings, wherein each of the at least one machine learning model is configured to output a predicted device attribute for the device based on the first pair of strings;
determining at least one device attribute of the device when a threshold number of the at least one machine learning model output probabilities is above a respective confidence threshold for the at least one device attribute, wherein each of the at least one machine learning model has a respective confidence threshold calculated for each device attribute label, wherein the at least one device attribute is only determined when no conflicting predictions exist above their respective confidence thresholds;
monitoring activity of the device with respect to at least one policy corresponding to the identified device attribute of the device; and
performing at least one mitigation action based on the monitored activity.
2 . The method of claim 1 , wherein the at least one machine learning model is an ensemble including a plurality of machine learning models, wherein the device attribute is identified based on the output of each of the plurality of machine learning models.
3 . The method of claim 2 , wherein the identified device attribute is a device attribute which was output by at least a threshold number of machine learning models of the ensemble.
4 . The method of claim 1 , further comprising:
extracting the application data set by generating a plurality of substrings from each string of the first pair of strings, wherein each of the at least one machine learning model is applied to each of the plurality of substrings.
5 . The method of claim 4 , wherein each of the at least one machine learning model is a neural network including an inner product layer, each inner product layer having a plurality of nodes representing characters encoded according to a respective encoding standard.
6 . The method of claim 5 , wherein each neural network further includes a convolutional layer, wherein the convolutional layer of each neural network includes a plurality of filters, wherein each filter of each convolutional layer is applied to each of the plurality of substrings and outputs a value representing a degree of similarity between the filter and each applied substring.
7 . The method of claim 6 , wherein each neural network further includes a fully connected layer, wherein the fully connected layer of each neural network is configured to output a probability vector including a plurality of entries indicating a probability that the device has a device attribute corresponding to each of the plurality of device attribute labels.
8 . The method of claim 1 , further comprising:
determining that the device has a disallowed device attribute based on the identified device attribute; and
blocking the device having the disallowed device attribute from accessing at least one network environment.
9 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
applying at least one machine learning model to an application data set extracted based on at least one first pair of strings, each first pair of strings including a protocol string and a key string indicated in respective fields of communications session data corresponding to a device, wherein each of the at least one machine learning model is trained based on a training data set including a plurality of second pairs of strings and a plurality of device attribute labels, wherein each device attribute label corresponds to one of the second pairs of strings, wherein each of the at least one machine learning model is configured to output a predicted device attribute for the device based on the first pair of strings;
determining at least one device attribute of the device when a threshold number of the at least one machine learning model output probabilities is above a respective confidence threshold for the at least one device attribute, wherein each of the at least one machine learning model has a respective confidence threshold calculated for each device attribute label, wherein the at least one device attribute is only determined when no conflicting predictions exist above their respective confidence thresholds;
monitoring activity of the device with respect to at least one policy corresponding to the identified device attribute of the device; and
performing at least one mitigation action based on the monitored activity.
10 . A system for identifying device attributes based on string field conventions, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
apply at least one machine learning model to an application data set extracted based on at least one first pair of strings, each first pair of strings including a protocol string and a key string indicated in respective fields of communications session data corresponding to a device, wherein each of the at least one machine learning model is trained based on a training data set including a plurality of second pairs of strings and a plurality of device attribute labels, wherein each device attribute label corresponds to one of the second pairs of strings, wherein each of the at least one machine learning model is configured to output a predicted device attribute for the device based on the first pair of strings;
determine at least one device attribute of the device when a threshold number of the at least one machine learning model output probabilities is above a respective confidence threshold for the at least one device attribute, wherein each of the at least one machine learning model has a respective confidence threshold calculated for each device attribute label, wherein the at least one device attribute is only determined when no conflicting predictions exist above their respective confidence thresholds;
monitor activity of the device with respect to at least one policy corresponding to the identified device attribute of the device; and
perform at least one mitigation action based on the monitored activity.
11 . The system of claim 10 , wherein the at least one machine learning model is an ensemble including a plurality of machine learning models, wherein the device attribute is identified based on the output of each of the plurality of machine learning models.
12 . The system of claim 11 , wherein the identified device attribute is device attribute which was output by at least a threshold number of machine learning models of the ensemble.
13 . The system of claim 10 , wherein the system is further configured to:
extract the application data set by generating a plurality of substrings from each string of the first pair of strings, wherein each of the at least one machine learning model is applied to each of the plurality of substrings.
14 . The system of claim 13 , wherein each of the at least one machine learning model is a neural network including an inner product layer, each inner product layer having a plurality of nodes representing characters encoded according to a respective encoding standard.
15 . The system of claim 14 , wherein each neural network further includes a convolutional layer, wherein the convolutional layer of each neural network includes a plurality of filters, wherein each filter of each convolutional layer is applied to each of the plurality of substrings and outputs a value representing a degree of similarity between the filter and each applied substring.
16 . The system of claim 15 , wherein each neural network further includes a fully connected layer, wherein the fully connected layer of each neural network is configured to output a probability vector including a plurality of entries indicating a probability that the device has a device attribute corresponding to each of the plurality of device attribute labels.
17 . The system of claim 10 , wherein the system is further configured to:
determine that the device has a disallowed device attribute based on the identified device attribute; and
block the device having the disallowed device attribute from accessing at least one network environment.