Systems and methods for detecting vulnerabilities in internet-of-things (IOT) devices
Disclosed herein are systems and method for detecting vulnerabilities in devices within a network. In one exemplary aspect, a method includes: intercepting a plurality of packets in a network with a plurality of devices; identifying a subset of packets corresponding to a first device of the network; extracting and embedding a plurality of features representing device behavior from the subset of packets into an input vector; executing a machine learning algorithm that receives the input vector and outputs a device type of the first device, wherein the machine learning algorithm is trained using a training dataset including network traffic information labelled with device types and a list of attributes of each respective device type; performing, for the first device, a security scan specific to the device type; and in response to detecting a vulnerability based on the security scan, generating a vulnerability assessment report for the first device.
1. A method for detecting vulnerabilities in devices within a network, the method comprising:
intercepting a plurality of packets being transmitted in a network with a plurality of devices;
identifying, from the plurality of packets, a subset of packets corresponding to a first device of the network;
extracting a plurality of features representing device behavior from the subset of packets;
embedding the plurality of features into an input vector;
executing a machine learning algorithm that receives the input vector and outputs a device type of the first device, wherein the machine learning algorithm has a zero-shot framework and is trained using a training dataset comprising network traffic information pre-labelled into a set of seen device types and a list of attributes of each respective device type of the seen device types, wherein an attribute in the list comprises a relationship of each device of a particular device type with other devices, and wherein a true device type of the first device is not in the seen device types;
performing, for the first device, a security scan specific to the device type classified by the machine learning algorithm to detect vulnerabilities in the first device; and
in response to detecting a vulnerability based on the security scan, generating a vulnerability assessment report for the first device.
2. The method of claim 1 , wherein a different security scan is performed for a different device type.
3. The method of claim 2 , further comprising:
identifying, from the plurality of packets, another subset of packets corresponding to a second device of the network;
extracting another plurality of features representing device behavior from the another subset of packets;
embedding the another plurality of features into another input vector;
executing the machine learning algorithm that receives the another input vector and outputs the different device type of the second device;
performing, for the second device, the different security scan specific to the different device type to detect vulnerabilities in the second device; and
in response to detecting a vulnerability based on the different security scan, generating a vulnerability assessment report for the second device.
4. The method of claim 1 , wherein identifying the subset of packets comprises:
determining a device identifier in a first packet of the plurality of packets; and
identifying, from the plurality of packets, the subset of packets that include the device identifier.
5. The method of claim 1 , wherein the machine learning algorithm further outputs a respective prediction probability that indicates an accuracy of a predicted device type, further comprising:
performing, for the first device, the security scan in response to determining that a prediction probability associated with the first device is greater than a threshold probability.
6. The method of claim 5 , wherein the security scan is not performed for devices for which prediction probabilities associated with corresponding predictions are not greater than the threshold probability.
7. The method of claim 1 , wherein the plurality of features are one or both of: sequence-based features obtained by extracting raw values for each packet in a continuous sequence, and aggregation-based features obtained by engineering aggregate features from network traffic sessions, wherein a network traffic session is a time-window of packets generated by a given device.
8. The method of claim 1 , wherein an attribute of the list of attributes describes one of: a type of device and a network parameter of the device.
9. The method of claim 1 , further comprising performing a remediation action that resolves the detected vulnerability of the first device.
10. A system for detecting vulnerabilities in devices within a network, comprising:
a memory; and
a hardware processor communicatively coupled with the memory and configured to:
intercept a plurality of packets being transmitted in a network with a plurality of devices;
identify, from the plurality of packets, a subset of packets corresponding to a first device of the network;
extract a plurality of features representing device behavior from the subset of packets;
embed the plurality of features into an input vector;
execute a machine learning algorithm that receives the input vector and outputs a device type of the first device, wherein the machine learning algorithm has a zero-shot framework and is trained using a training dataset comprising network traffic information pre-labelled into set of seen device types and a list of attributes of each respective device type of the seen device types, wherein an attribute in the list comprises a relationship of each device of a particular device type with other devices, and wherein a true device type of the first device is not in the seen device types;
perform, for the first device, a security scan specific to the device type classified by the machine learning algorithm to detect vulnerabilities in the first device; and
in response to detecting a vulnerability based on the security scan, generate a vulnerability assessment report for the first device.
11. The system of claim 10 , wherein a different security scan is performed for a different device type.
12. The system of claim 11 , wherein the hardware processor is further configured to:
identify, from the plurality of packets, another subset of packets corresponding to a second device of the network;
extract another plurality of features representing device behavior from the another subset of packets;
embed the another plurality of features into another input vector;
execute the machine learning algorithm that receives the another input vector and outputs the different device type of the second device;
perform, for the second device, the different security scan specific to the different device type to detect vulnerabilities in the second device; and
in response to detecting a vulnerability based on the different security scan, generate a vulnerability assessment report for the second device.
13. The system of claim 10 , wherein the hardware processor is further configured to identify the subset of packets by:
determining a device identifier in a first packet of the plurality of packets; and
identifying, from the plurality of packets, the subset of packets that include the device identifier.
14. The system of claim 10 , wherein the machine learning algorithm further outputs a respective prediction probability that indicates an accuracy of a predicted device type, wherein the hardware processor is further configured to:
perform, for the first device, the security scan in response to determining that a prediction probability associated with the first device is greater than a threshold probability.
15. The system of claim 14 , wherein the security scan is not performed for devices for which prediction probabilities associated with corresponding predictions are not greater than the threshold probability.
16. The system of claim 10 , wherein the plurality of features are one or both of:
sequence-based features obtained by extracting raw values for each packet in a continuous sequence, and aggregation-based features obtained by engineering aggregate features from network traffic sessions, wherein a network traffic session is a time-window of packets generated by a given device.
17. The system of claim 10 , wherein an attribute of the list of attributes describes one of: a type of device and a network parameter of the device.
18. A non-transitory computer readable medium storing thereon computer executable instructions for detecting vulnerabilities in devices within a network, including instructions for:
intercepting a plurality of packets being transmitted in a network with a plurality of devices;
identifying, from the plurality of packets, a subset of packets corresponding to a first device of the network;
extracting a plurality of features representing device behavior from the subset of packets;
embedding the plurality of features into an input vector;
executing a machine learning algorithm that receives the input vector and outputs a device type of the first device, wherein the machine learning algorithm has a zero-shot framework and is trained using a training dataset comprising network traffic information pre-labelled into a set of seen device types and a list of attributes of each respective device type of the seen device types, wherein an attribute in the list comprises a relationship of each device of a particular device type with other devices, and wherein a true device type of the first device is not in the seen device types;
performing, for the first device, a security scan specific to the device type classified by the machine learning algorithm to detect vulnerabilities in the first device; and
in response to detecting a vulnerability based on the security scan, generating a vulnerability assessment report for the first device.