Systems and methods for network security model
A security apparatus for a local network is in communication with an external electronic communication system and a first electronic device. The apparatus includes a memory device configured to store computer-executable instructions, and a processor in operable communication with the memory device. The processor is configured to implement the stored computer-executable instructions to cause the apparatus to determine a complexity score for the first electronic device, establish a behavioral pattern for the first electronic device operating within the local network, calculate a confidence metric for the first electronic device based on the determined complexity score and the established behavioral pattern, and control access of the first electronic device to the external electronic network according to the calculated confidence metric.
1. A security apparatus for a local network, the apparatus being in communication with an external electronic communication system and a first electronic device, comprising:
a memory device configured to store computer-executable instructions; and
a processor in operable communication with the memory device,
wherein the processor is configured to implement the stored computer-executable instructions to cause the apparatus to:
determine a complexity score for the first electronic device;
establish a behavioral pattern for the first electronic device operating within the local network;
calculate a confidence metric for the first electronic device based on the determined complexity score and the established behavioral pattern; and
control access of the first electronic device to the external electronic network according to the calculated confidence metric.
2. The apparatus of claim 1 , wherein the external electronic communication system is the Internet.
3. The apparatus of claim 1 , wherein the first electronic device capable of connecting with the Internet of Things (IoT).
4. The apparatus of claim 1 , wherein the apparatus comprises a router.
5. The apparatus of claim 1 , wherein the processor is further configured to control access of the first electronic device to the external electronic network by one of routing, limiting, or dropping individual network flows to and/or from the first electronic device.
6. The apparatus of claim 4 , wherein the router is in operable communication with a network traffic monitor configured to monitor the individual network flows.
7. The apparatus of claim 6 , wherein the processor is further configured to determine the complexity score for the first electronic device according to a derived device complexity calculation based on a one of a variance of the individual network flows and an endpoint analysis of the first electronic device.
8. The apparatus of claim 6 , wherein the processor is further configured to determine the complexity score for the first electronic device an aggregated complexity score derived from an analysis of network traffic of the device over time.
9. The apparatus of claim 6 , wherein the processor is further configured to establish the behavioral pattern for the first electronic device by generating a probabilistic behavioral model.
10. The apparatus of claim 9 , wherein the behavioral model considers only network traffic that is sent and received by the first electronic device on the processor.
11. The apparatus of claim 9 , wherein the behavioral model considers a historical record of the individual network flows of the first electronic device on the local network to learn the behavioral pattern of the first device.
12. The apparatus of claim 11 , wherein the processor is further configured to learn the behavioral pattern of past actions of the first device on the local network from the historical record of the individual network flows of the first electronic device.
13. The apparatus of claim 12 , wherein the processor is further configured to determine that a current network state for the device fits within a discovered boundary of the behavioral pattern of past actions.
14. The apparatus of claim 9 , wherein the behavioral model is configured to implement an isolation forest anomaly algorithm to derive a behavioral metric for the first electronic device.
15. The apparatus of claim 6 , wherein the processor is further configured to establish the behavioral pattern based on a ratio of anomalous flows of the individual network flows to a total number of the individual network flows.
16. The apparatus of claim 6 , wherein the processor is further configured to (i) calculate the confidence metric for the first electronic device, and (ii) rank every individual network flow to and from the device based on the confidence metric.
17. The apparatus of claim 16 , wherein the processor is further configured to collate the network traffic into the ranked individual network flows, and wherein each individual network flow comprises a sequence of packets.
18. The apparatus of claim 1 , wherein the processor is further configured to tune the established behavioral pattern according to the determined complexity score.
19. The apparatus of claim 1 , wherein the apparatus is in operable communication with a second electronic device, different from the first electronic device, and wherein the processor is further configured to control access of the first electronic device to the second electronic device according to the calculated confidence metric.
20. The apparatus of claim 1 , wherein the apparatus comprises a network interface in communication with a network control element.