Pattern match-based detection in IOT security
Techniques for providing Internet of Things (IoT) security are disclosed. An applicable system includes profiling IoT devices to limit the number of network signatures applicable to the IoT devices and performing pattern matching using a pattern that is appropriate for the profile of a given IoT device.
1. A method of detecting undesirable behavior of an Internet-of-Things (IoT) device, comprising:
associating a first subset of patterns of a superset of patterns with a first IoT device profile, wherein the first IoT device profile belongs to a set comprising a plurality of IoT device profiles;
attributing the first IoT device profile to a first IoT device as a first provisional profile and attributing a second provisional profile to the first IoT device;
detecting first IoT device events, the first IoT device events including one or more network sessions of the first IoT device;
generating an activity data structure from the first IoT device events and from other events, including by enriching at least one event by associating enrichment data with the at least one event, wherein the enrichment data comprises at least one of: (1) another event, or (2) information appended to the at least one event, wherein the generated activity data structure comprises a labeled collection of events, wherein at least one of the other events comprises a non-network event, and wherein a first event is treated differently for the first provisional profile than the second provisional profile;
determining an activity of the first IoT device based on the activity data structure;
applying the first subset of patterns to the activity of the first IoT device; and
generating an alert when the application of the first subset of patterns to the activity of the first IoT device is indicative of undesirable behavior for a device to which the first IoT device profile is attributed.
2. The method of claim 1 , wherein the first IoT device profile is attributed to the first IoT device prior to deployment of the first IoT device.
3. The method of claim 1 , wherein the first IoT device profile is attributed to the first IoT device after deployment of the first IoT device.
4. The method of claim 1 , wherein the first IoT device profile is attributed to the first IoT device after deployment of the first IoT device, and the first IoT device profile is a default IoT device profile that is dynamically modified using available data.
5. The method of claim 1 , wherein the first IoT device events are detected using passive monitoring.
6. The method of claim 1 , wherein the first IoT device events are detected using packet headers in messages sent to or from the first IoT device.
7. The method of claim 1 , wherein the first IoT device events are aggregated to form one or more composite first IoT device events using machine learning.
8. The method of claim 1 , wherein the first IoT device events are aggregated to form one or more composite first IoT device events using a device implemented as part of a local area network (LAN) that includes the first IoT device.
9. The method of claim 1 , wherein the first IoT device does not have a history of previously exhibited undesirable behavior, and the undesirable behavior includes anomalous behavior of the first IoT device.
10. The method of claim 1 , wherein the first IoT device has a history of previously exhibited undesirable behavior, and the undesirable behavior includes normal behavior of the first IoT device.
11. The method of claim 1 , wherein a plurality of discrete events are aggregated to form one or more composite events using machine learning.
12. The method of claim 11 , wherein the one or more composite events are formed using common factor aggregation.
13. The method of claim 12 , wherein a common factor used in the common factor aggregation includes a device profile common to a plurality of devices.
14. The method of claim 12 , wherein a common factor used in the common factor aggregation includes an operating system vendor common to a plurality of devices.
15. The method of claim 12 , wherein a common factor used in the common factor aggregation includes an operating system version common to a plurality of devices.
16. The method of claim 12 , wherein a common factor used in the common factor aggregation includes use of an application common to a plurality of devices.
17. The method of claim 12 , wherein a common factor used in the common factor aggregation includes communication via a particular subnetwork common to a plurality of devices.
18. A system comprising:
a processor configured to:
associate a first subset of patterns of a superset of patterns with a first IoT device profile, wherein the first IoT device profile belongs to a set comprising a plurality of IoT device profiles;
attribute the first IoT device profile to a first IoT device as a first provisional profile and attribute a second provisional profile to the first IoT device;
detect first IoT device events, the first IoT device events including one or more network sessions of the first IoT device;
generate an activity data structure from the first IoT device events and from other events, including by enriching at least one event by associating enrichment data with the at least one event, wherein the enrichment data comprises at least one of: (1) another event, or (2) information appended to the at least one event, wherein the generated activity data structure comprises a labeled collection of events, wherein at least one of the other events comprises a non-network event, and wherein a first event is treated differently for the first provisional profile than the second provisional profile;
determine an activity of the first IoT device based on the activity data structure;
apply the first subset of patterns to the activity of the first IoT device; and
generate an alert when the application of the first subset of patterns to the activity of the first IoT device is indicative of undesirable behavior for a device to which the first IoT device profile is attributed.
19. The system of claim 18 , wherein the first IOT device profile is attributed to the first IoT device prior to deployment of the first IOT device.
20. The system of claim 18 , wherein the first IoT device profile is attributed to the first IOT device after deployment of the first IOT device.
21. The system of claim 18 , wherein the first IoT device profile is attributed to the first IOT device after deployment of the first IoT device, and the first IoT device profile is a default IoT device profile that is dynamically modified using available data.
22. The system of claim 18 , wherein the first IoT device events are detected using passive monitoring.
23. The system of claim 18 , wherein the first IoT device events are detected using packet headers in messages sent to or from the first IoT device.
24. The system of claim 18 , wherein the first IoT device events are aggregated to form one or more composite first IoT device events using machine learning.
25. The system of claim 18 , wherein the first IoT device events are aggregated to form one or more composite first IoT device events using a device implemented as part of a local area network (LAN) that includes the first IoT device.
26. The system of claim 18 , wherein the first IoT device does not have a history of previously exhibited undesirable behavior, and the undesirable behavior includes anomalous behavior of the first IOT device.
27. The system of claim 18 , wherein the first IOT device has a history of previously exhibited undesirable behavior, and the undesirable behavior includes normal behavior of the first IoT device.
28. The system of claim 18 , wherein a plurality of discrete events are aggregated to form one or more composite events using machine learning.
29. The system of claim 28 , wherein the one or more composite events are formed using common factor aggregation.
30. The system of claim 29 , wherein a common factor used in the common factor aggregation includes a device profile common to a plurality of devices.
31. The system of claim 29 , wherein a common factor used in the common factor aggregation includes an operating system vendor common to a plurality of devices.
32. The system of claim 29 , wherein a common factor used in the common factor aggregation includes an operating system version common to a plurality of devices.
33. The system of claim 29 , wherein a common factor used in the common factor aggregation includes use of an application common to a plurality of devices.
34. The method of claim 29 , wherein a common factor used in the common factor aggregation includes communication via a particular subnetwork common to a plurality of devices.