Device classification using machine learning models
Systems, methods, and related technologies for classification are described. Network traffic transmitted by a first device is obtained. A set of features is determined based on the network traffic. A first classification for the device is determine a first classification for the first device based on the set of features. The first classification is associated with a first classification level. A second machine learning model is identified based on the first classification. The second machine learning model is associated with the first classification. A second classification for the first device is determined based on the second machine learning model. The second classification is associated with a second classification level. At least one of the first classification and the second classification is stored.
1. A method, comprising:
obtaining network traffic from a network, wherein the network traffic is transmitted by a first device that is communicatively coupled to the network;
determining a set of features based on the network traffic;
determining a first classification for the first device based on the set of features and a first machine learning model, wherein determining the first classification comprises determining a first confidence level associated with the first classification, and wherein the first classification is associated with a first classification level;
in response to the first confidence level being above a threshold, selecting a second machine learning model from a plurality of machine learning models based on the first classification, wherein the second machine learning model is associated with the first classification;
determining a second classification for the first device based on the second machine learning model, wherein determining the second classification comprises determining a second confidence level associated with the second classification, and determining the second classification in response to the second confidence level being above the threshold, and wherein the second classification is associated with a second classification level; and
storing at least one of the first classification and the second classification.
2. The method of claim 1 , further comprising:
performing an action based on at least one of the first classification or the second classification.
3. The method of claim 2 , wherein the action comprises one or more of a remediation action or a security action.
4. The method of claim 1 , further comprising:
obtaining additional network traffic from the network, wherein the additional network traffic is transmitted by the first device; and
determining an updated classification for the first device based on the additional network traffic.
5. The method of claim 1 , further comprising:
determining a third classification for the first device based on the set of features, wherein the third classification is associated with the first classification level;
identifying a third machine learning model based on the third classification, wherein the third machine learning model is associated with the third classification;
determining a fourth classification for the first device based on the third machine learning model, wherein the fourth classification is associated with the second classification level; and
storing at least one of the third classification and the fourth classification.
6. The method of claim 1 , wherein the set of features comprises one or more of textual features and a device fingerprint.
7. The method of claim 1 , wherein the second classification is determined further based on one or more of the set of features or a subset of the set of features.
8. The method of claim 1 , wherein the set of features are associated with a set of properties associated with the first device.
9. The method of claim 1 , wherein:
selecting the second machine learning model based on the first classification comprises determining whether at least one machine learning model is associated with the first classification; and
the second machine learning model is identified in response to at least one machine learning model being associated with the first classification.
10. A system, comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
obtain network traffic from a network, wherein the network traffic is transmitted by a first device that is communicatively coupled to the network;
determine a set of features based on the network traffic;
determine a first classification for the first device based on the set of features a first machine learning model, wherein the first classification is associated with a first classification level;
select a second machine learning model from a plurality of machine learning models based on the first classification, wherein the second machine learning model is associated with the first classification, wherein to select the second machine learning model comprises to determine whether at least one machine learning model is associated with the first classification, and to identify the second machine learning model in response to at least one machine learning model being associated with the first classification;
determine a second classification for the first device based on the second machine learning model, wherein the second classification is associated with a second classification level; and
store at least one of the first classification and the second classification.
11. The system of claim 10 , wherein the processing device is further to:
perform an action based on at least one of the first classification or the second classification.
12. The system of claim 11 , wherein the action comprises one or more of a remediation action or a security action.
13. The system of claim 10 , wherein:
determine the first classification for the first device the processing device is further to determine a first confidence level associated with the first classification;
the processing device is further to determine whether the first confidence level is above a threshold confidence level; and
the second machine learning model is identified in response to the first confidence level being above the threshold confidence level.
14. The system of claim 10 , wherein the processing device is further to:
obtain additional network traffic from the network, wherein the additional network traffic is transmitted by the first device;
determine a second set of features based on the additional network traffic;
determine an updated first classification for the first device based on the second set of features;
identify a third machine learning model based on the updated first classification, wherein the third machine learning model is associated with the updated first classification;
determine an updated second classification for the first device based on the third machine learning model; and
store at least one of the updated first classification and the updated second classification.
15. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
obtain network traffic from a network, wherein the network traffic is transmitted by a first device that is communicatively coupled to the network;
determine a set of features based on the network traffic;
determine a first classification for the first device based on the set of features a first machine learning model, wherein to determine the first classification comprises to determine a first confidence level associated with the first classification, and wherein the first classification is associated with a first classification level;
in response to the first confidence level being above a threshold, select a second machine learning model from a plurality of machine learning models based on the first classification, wherein the second machine learning model is associated with the first classification;
determine a second classification for the first device based on the second machine learning model, wherein to determine the second classification comprises to determine a second confidence level associated with the second classification, and to determine the second classification in response to the second confidence level being above the threshold, and wherein the second classification is associated with a second classification level; and
store at least one of the first classification and the second classification.
16. The non-transitory computer readable medium of claim 15 , wherein the processing device is further to perform an action based on at least one of the first classification or the second classification.
17. The system of claim 16 , wherein the action comprises one or more of a remediation action or a security action.