System and method for device attribute identification based on host configuration protocols
A system and method for determining device attributes based on host configuration protocols. A method includes applying at least one machine learning model to a test data set extracted from host configuration protocol data including at least one test options sequence, wherein each test options sequence is an ordered series of options requested by a first device, wherein each of the at least one machine learning model is trained based on a train data set including a plurality of training options sequences and a plurality of device attributes, wherein each training options sequence and each device attribute of the train data set corresponds to a respective second device; and determining, based on the output of the at least one machine learning model, at least one device attribute for the first device.
1 . A method for determining device attributes based on host configuration protocols, comprising:
applying at least one machine learning model to a test data set extracted from host configuration protocol data including at least one test options sequence, wherein each test options sequence is an ordered series of options included in a Parameter Request List field requested by a first device, wherein each of the at least one machine learning model is trained based on a train data set including a plurality of training options sequences and a plurality of device attributes, wherein each training options sequence and each device attribute of the train data set corresponds to a respective second device, and wherein low occurrence options sequences are filtered out from the plurality of training options sequences of the train data set prior to training the at least one machine learning model, the low occurrence options sequences are training options sequences that were observed in the train data set less than a threshold number of times;
determining, based on an output of the at least one machine learning model, at least one device attribute of the first device;
monitoring activity of the first device with respect to at least one policy corresponding to the determined at least one device attribute of the first device;
detecting at least one abnormal behavior of the first device when the first device deviates from allowable behavior indicated in the at least one policy; and
performing one or more mitigation actions on the first device in response to the detected at least one abnormal behavior.
2 . The method of claim 1 , further comprising:
determining, with respect to each of at least one device attribute, a frequency for each training options sequence of the train data set, wherein each low occurrence options sequence has a proportion of total options sequences below a threshold, wherein the threshold applied to each training options sequence is defined with respect to a device attribute for which each training options sequence has a highest determined frequency.
3 . The method of claim 1 , wherein the train data set is a second data set, wherein the test data set is a third data set, further comprising:
grouping at least a portion of a first data set with respect to at least one type of device attribute for device data of devices represented in the first data set, wherein the train data set includes the grouped at least a portion of the first data set.
4 . The method of claim 3 , further comprising:
filtering at least a portion of the first data set having device attribute values that are absent from a predetermined list of device attributes.
5 . The method of claim 1 , wherein the at least one device attribute determined for the first device includes at least one operating system.
6 . The method of claim 1 , wherein the series of options of each test options sequence is a series of options indicated in a Parameter Request List field in at least one Dynamic Host Configuration Protocol option 55 packet.
7 . The system of claim 1 , wherein the at least one device attribute determined for the first device includes at least one operating system.
8 . A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:
applying at least one machine learning model to a test data set extracted from host configuration protocol data including at least one test options sequence, wherein each test options sequence is an ordered series of options included in a Parameter Request List field requested by a first device, wherein each of the at least one machine learning model is trained based on a train data set including a plurality of training options sequences and a plurality of device attributes, wherein each training options sequence and each device attribute of the train data set corresponds to a respective second device, and wherein low occurrence options sequences are filtered out from the plurality of training options sequences of the train data set prior to training the at least one machine learning model, the low occurrence options sequences are training options sequences that were observed in the train data set less than a threshold number of times;
determining, based on an output of the at least one machine learning model, at least one device attribute of the first device;
monitoring activity of the first device with respect to at least one policy corresponding to the determined at least one device attribute of the first device;
detecting at least one abnormal behavior of the first device when the first device deviates from allowable behavior indicated in the at least one policy; and
performing one or more mitigation actions on the first device in response to the detected at least one abnormal behavior.
9 . A system for determining device attributes based on host configuration protocols, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
apply at least one machine learning model to a test data set extracted from host configuration protocol data including at least one test options sequence, wherein each test options sequence is an ordered series of options included in a Parameter Request List field requested by a first device, wherein each of the at least one machine learning model is trained based on a train data set including a plurality of training options sequences and a plurality of device attributes, wherein each training options sequence and each device attribute of the train data set corresponds to a respective second device, and wherein low occurrence options sequences are filtered out from the plurality of training options sequences of the train data set prior to training the at least one machine learning model, the low occurrence options sequences are training options sequences that were observed in the train data set less than a threshold number of times;
determine, based on an output of the at least one machine learning model, at least one device attribute of the first device;
monitor activity of the first device with respect to at least one policy corresponding to the determined at least one device attribute of the first device;
detect at least one abnormal behavior of the first device when the first device deviates from allowable behavior indicated in the at least one policy; and
perform one or more mitigation actions on the first device in response to the detected at least one abnormal behavior.
10 . The system of claim 9 , wherein the system is further configured to:
determine, with respect to each of at least one device attribute, a frequency for each training options sequence of the train data set, wherein each low occurrence options sequence has a proportion of total options sequences below a threshold wherein the threshold applied to each training options sequence is defined with respect to a device attribute for which each training options sequence has a highest determined frequency.
11 . The system of claim 9 , wherein the train data set is a second data set, wherein the test data set is a third data set, wherein the system is further configured to:
group at least a portion of a first data set with respect to at least one type of device attribute for device data of devices represented in the first data set, wherein the train data set includes the grouped at least a portion of the first data set.
12 . The system of claim 11 , wherein the system is further configured to:
filter at least a portion of the first data set having device attribute values that are absent from a predetermined list of device attributes.
13 . The system of claim 9 , wherein the series of options of each test options sequence is a series of options indicated in a Parameter Request List field in at least one Dynamic Host Configuration Protocol option 55 packet.