Patent ID: 11909741
Assignee: CISCO TECHNOLOGY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 11:
12. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive an access policy and a machine learning-based class behavioral model for a node in the network that are associated with a class that is associated with a Manufacturer Usage Description (MUD) Universal Resource Identifier (URI) asserted by the node, wherein the class behavioral model is generated based on traffic data observed from one or more devices of the class asserted by the node and on synthetic traffic data formed from the access policy associated with the class asserted by the node;
apply the access policy and class behavioral model to traffic associated with the node;
identify a deviation in a behavior of the node from the class behavioral model, based on the application of the class behavioral model to the traffic associated with the node; and
cause performance of a mitigation action in the network based on the identified deviation in the behavior of the node from the class behavioral model.