Static and dynamic device profile reputation using cloud-based machine learning
Disclosed herein are cloud-based machine learning systems and methods for monitoring networked devices to identify and classify characteristics, to infer typical or atypical behavior and assign reputation profiles across various networked devices, and to make remediation recommendations. In some embodiments, a cloud-based machine learning system may learn the typical operation and interfacing of a plurality of reputable devices that are known to be free from malicious software and other threats. In some embodiments, a cloud-based machine learning system may learn the typical operation and interfacing of a device, and may identify atypical operations or interfaces associated with that device by comparing the operations and interfaces to those of a plurality of networked devices or to those of a defined standard reference device.
1. A method comprising:
identifying a collection of data stored in a memory element, wherein the collection of data comprises device data generated by a plurality of networked devices during device boot, at application startup, and when interfacing with another device in the plurality of networked devices, and wherein the device data comprises device platform identification data including hardware configuration and software configuration; and
executing a cloud-based machine learning algorithm on the collection of data to:
aggregate received device data;
assign a context to the aggregated device data, wherein the context identifies a status or location of a device when the device data was generated;
generate identified characteristics from the aggregated device data;
perform rules-based inferences on the identified characteristics and the context to determine whether a device is performing in accordance with an aggregated device profile for similar devices of the plurality of networked devices, wherein the identified characteristics include a hardware characteristic based on the hardware configuration and a software characteristic based on the software configuration;
generate a ranking of the identified characteristics, wherein an identified characteristic is ranked higher if the identified characteristic is observed greater than a threshold number of times, if the identified characteristic is atypical for the hardware configuration, or if the identified characteristic is atypical for the software configuration;
determine, based on the ranking of the identified characteristics and the rules-based inferences, whether to make a first remediation recommendation;
make a first remediation recommendation based on the determination to make a first remdiation recommendation;
receive feedback;
adapt the rules-based inferences based on the feedback; and
determine whether to make a second remediation recommendation based on the adapted rules-based inferences.
2. The method of claim 1 , further comprising:
executing the cloud-based machine learning algorithm on the collection of data to further:
make a second remediation recommendation based on the determination to make a second remediation recommendation.
3. The method of claim 1 , wherein determining whether to make the first or the second remediation recommendation is based at least in part on an identified characteristic in a device as compared to the identified characteristic in the plurality of networked devices.
4. The method of claim 1 , further comprising:
executing the cloud-based machine learning algorithm on the collection of data to further:
assign a reputation score based at least in part on the identified characteristics and the rules-based inferences.
5. The method of claim 1 , wherein receiving the collection of data occurs intermittently for a period of time.
6. The method of claim 1 , wherein receiving device data further includes receiving device security policy data; and wherein determining whether to make the first or the second remediation recommendation is based at least in part on the device security policy data.
7. An apparatus comprising:
one or more memory elements operable to store a cloud-based machine learning algorithm; and
one or more processors operable to execute the cloud-based machine learning algorithm, such that the apparatus is configured to:
receive a collection of data, wherein the collection of data comprises device data generated by a plurality of networked devices during device boot, at application startup, and when interfacing with another device in the plurality of networked devices, and wherein the device data comprises device platform identification data including hardware configuration and software configuration;
aggregate received device data;
assign a context to the aggregated device data, wherein the context identifies a status or location of a device the device data was generated;
generate identified characteristics from the aggregated device data;
perform rules-based inferences on the identified characteristics and the context to determine whether a device is performing in accordance with an aggregated device profile for similar device of the plurality of networked devices, wherein the identified characteristics include a hardware characteristic based on the hardware configuration and a software characteristic based on the software configuration;
generate a ranking for the identified characteristics, wherein an identified characteristic is ranked higher if the identified characteristic is observed greater than a threshold number of times, if the identified characteristic is atypical for the hardware configuration, or if the identified characteristic is atypical for the software configuration;
determine, based on the ranking of the identified characteristics and the rules-based inferences, whether to make a first remediation recommendation;
make a first remediation recommendation based on the determination to make a first remediation recommendation;
receive feedback;
adapt the rules-based inferences based on the feedback; and
determine whether to make a second remediation recommendation based on the adapted rules-based inferences.
8. The apparatus of claim 7 , further configured to:
make a second remediation recommendation based on the determination to make a second remediation recommendation.
9. The apparatus of claim 7 , further configured to:
assign a reputation profile based at least in part on the identified characteristics and the rules-based inferences.
10. The apparatus of claim 7 , wherein determining whether to make the first or the second remediation recommendation is based at least in part on an identified characteristic in a device as compared to the identified characteristic in the plurality of networked devices.
11. The apparatus of claim 7 , wherein receiving the collection of data occurs intermittently for a period of time.
12. The apparatus of claim 7 , wherein receiving device data further includes receiving device security policy data; and wherein, determining whether to make the first or the second remediation recommendation, is based at least in part on the device security policy data.
13. A system comprising:
a plurality of networked devices;
a device behavior model generator comprising:
one or more memory elements; and
one or more processors, the one or more processors operable to execute instructions to:
receive a collection of data, wherein the collection of data comprises device data generated by a plurality of networked devices during device boot, at application startup, and when interfacing with another device in the plurality of networked devices, and wherein the device data comprises device platform identification data including hardware configuration and software configuration; and
execute a cloud-based machine learning algorithm on the collection of data to:
aggregate received device data;
assign a context to the aggregated device data, wherein the context identifies a status or location of a device when the device data was generated;
generate identified characteristics from the aggregated device data;
perform rules-based inferences on the identified characteristics and the context to determine whether a device is performing in accordance with an aggregated device profile for similar devices of the plurality of networked devices, wherein the identified characteristics include a hardware characteristic based on the hardware configuration and a software characteristic based on the software configuration;
generate a ranking of the identified characteristics, wherein an identified characteristic is ranked higher if the identified characteristic is observed greater than a threshold number of times, if the identified characteristic is atypical for the hardware configuration, or if the identified characteristic is atypical for the software configuration;
determine, based on the ranking of the identified characteristics and the rules-based inferences, whether to make a first remediation recommendation;
make a first remediation recommendation based on the determination to make a first remediation recommendation;
receive feedback;
determine whether to make a second remediation recommendation based on the adapted rules-based inferences; and
a network, wherein the network connects the plurality of networked devices and the device behavior model generator.
14. The system of claim 13 , wherein determining whether to make the first or the second remediation recommendation is based at least in part on an identified characteristic in a device as compared to the identified characteristic in the plurality of networked devices.
15. The system of claim 14 , wherein the one or more processors are further configured to execute the cloud-based machine learning algorithm on the collection of data to:
make a second remediation recommendation based on the determination to make a second remediation recommendation.
16. The system of claim 14 , wherein the one or more processors are further configured to execute the cloud-based machine learning algorithm on the collection of data to:
assign a reputation profile based at least in part on the identified characteristics and the rules-based inferences.
17. At least one non-transitory computer readable storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
receive a collection of data, wherein the collection of data comprises device data generated by a plurality of networked devices during device boot, at application startup, and when interfacing with another device in the plurality of networked devices, and wherein the device data comprises device platform identification data including hardware configuration and software configuration; and
execute a cloud-based machine learning algorithm on the collection of data to:
aggregate received device data;
apply privacy policy to private device data;
assign a context to the aggregated device data, wherein the context identifies a status or location of a device when the device data was generated;
generate identified characteristics from the aggregated device data;
perform rules-based inferences on the identified and the context to determine whether a device is performing in accordance with an aggregated device profile for similar devices of the plurality of network devices, wherein the identified characteristics include a hardware characteristic based on the hardware configuration and a software characteristic based on the software configuration;
generate a ranking for the identified characteristics, wherein an identified characteristic is ranked higher if the identified characteristic is observed greater than a threshold number of times, if the identified characteristic is atypical for the hardware configuration, or if the identified characteristic is atypical for the software configuration;
determine, based on the ranking of the identified characteristics and the rules-based inferences, whether to make a first remediation recommendation:
make a first remediation recommendation based on the determination to make a first remediation recommendation;
receive feedback;
determine whether to make a second remediation recommendation based on the adapted rules-based inferences.
18. The at least one non-transitory computer readable storage medium of claim 17 , wherein receiving device data further includes receiving device security policy data; and wherein, determining whether to make the first or the second remediation recommendation, is based at least in part on the device security policy data.
19. The at least one non-transitory computer readable storage medium of claim 17 , wherein the instructions, when executed, further cause the machine to:
make a second remdiation recommendation based on the determination to make a second remediation recommendation.
20. The at least one non-transitory computer readable storage medium of claim 17 , wherein the instructions, when executed, further cause the machine to:
assign a repuatation profile based at least in part on the identified characteristics and the rules-based inferences.
21. The at least one non-transitory computer readable storage medium of claim 17 , wherein determining whether to make the first or the second remediation recommendation is based at least in part on an identified characteristic in a device as compared to the identified characteristic in the plurality of networked devices.