Patent SG-11201907943W-A (SG)
Title: Method and apparatus for determining an identity of an unknown internet-of-things (iot) device in a communication network
Inventor: OCHOA MARTIN
IPC: G06N99/00
Filed: 2018-02-27
Abstract: Receive network traffic 711 generated by an unknown loT device 150a. 720 730 740 Extract device network behaviour 721 from the generated network traffic 711 of the unknown loT device 150a. W O 20 18/ 160 136 Al Apply a selected machine learning based classifier 731a from a set of machine learning based classifiers 731 to analyse the device network behaviour 721. Determine the iden ity of the unknown loT device 150a from a list of known loT devices 103 Figure 7 (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau (43) International Publication Date 07 September 2018 (07.09.2018) WIPO I PCT omit VIII °nolo omioollm mom oimIE (10) International Publication Number WO 2018/160136 Al (51) International Patent Classification: HO4L 12/24 (2006.01) G06N 99/00 (2010.01) GOON 3/00 (2006.01) HO4L 29/00 (2006.01) GO6F 19/24 (2011.01) (21) International Application Number: PCT/SG2018/050089 (22) International Filing Date: 27 February 2018 (27.02.2018) (25) Filing Language: English (26) Publication Language: English (30) Priority Data: 10201701692Y 02 March 2017 (02.03.2017) SG (71) Applicants: SINGAPORE UNIVERSITY OF TECH- NOLOGY AND DESIGN [SG/SG]; 8 Somapah Road, Singapore 487372 (SG). B. G. NEGEV TECH- NOLOGIES AND APPLICATIONS LTD., AT BEN- GURION UNIVERSITY [IL/IL]; P.O. Box 653, Beer- Sheva 8410501 (IL). (72) Inventors: OCHOA, Martin; c/o Singapore University of Technology and Design, 8 Somapah Road, Singapore 487372 (SG). TIPPENHAUER, Nils Ole; c/o Singapore University of Technology and Design, 8 Somapah Road, Singapore 487372 (SG). GUARNIZO, Juan; c/o Singa- pore University of Technology and Design, 8 Somapah Road, Singapore 487372 (SG). ELOVICI, Yuval; BGN Technologies Ltd., The Energy St. 77, (Ha Energia St), Ad- vanced Technologies Park, Building 1, 3rd. Floor, POB 653, 8410501 Beer-Sheva (IL). SHABTAI, Asaf; BGN Tech- nologies Ltd., The Energy St. 77, (Ha Energia St), Ad- vanced Technologies Park, Building 1, 3rd. Floor, POB 653, 8410501 Beer-Sheva (IL). BOHADANA, Michael; BGN Technologies Ltd., The Energy St. 77, (Ha Energia St), Ad- vanced Technologies Park, Building 1, 3rd. Floor, POB 653, 8410501 Beer-Sheva (IL). MEIDAN, Yair; BGN Tech- nologies Ltd., The Energy St. 77, (Ha Energia St), Ad- vanced Technologies Park, Building 1, 3rd. Floor, POB 653, 8410501 Beer-Sheva (IL). (74) Agent: POH, Chee Kian, Daniel; Marks & Clerk Singa- pore LLP, Tanjong Pagar, P 0 Box 636, Singapore 910816 (SG). (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, = (54) Title: METHOD AND APPARATUS FOR DETERMINING AN IDENTITY OF AN UNKNOWN INTERNET-OF-THINGS (I0T) DEVICE IN A COMMUNICATION NETWORK 700 (57) : A method 100 and apparatus for determining an identi- ty of an unknown Internet-of-Things (IoT) device 150a in a communi- cation network is disclosed. The method 100 includes the steps of re- ceiving network traffic 711 generated by the unknown IoT device 150a at 710, extracting device network behavior 721 from the generated net- work traffic 711 at 720, and determining the identity of the unknown IoT device 150a from a list of known IoT devices 103 at 740 by ap- plying a selected machine learning based classifier 731a from a set of machine learning based classifiers 731 at 730 to analyze the device net- work behavior 721. Each machine learning based classifier of the set 731 is trained by a dataset including a plurality of features represent- ing network behavior 721 of a respective known IoT device 103 from the list and the known IoT device's identity. The plurality of features is associated with the corresponding device network behavior 721 of the generated network traffic 711. [Continued on next page] WO 2018/160136 Al MUNRO DOI 01011MHE OMMINIIMOMMEONVOIS HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: — of inventorship (Rule 4.17(iv)) Published: — with international search report (Art. 21(3))