US 12,289,329 B2
Packet analysis based IOT management
Gong Cheng, Sunnyvale, CA (US); Pui-Chuen Yip, Santa Clara, CA (US); Zhiwei Xiao, Santa Clara, CA (US); Ran Xia, San Jose, CA (US); and Mei Wang, Saratoga, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Jul. 29, 2020, as Appl. No. 16/942,633.
Application 16/942,633 is a continuation of application No. 16/279,984, filed on Feb. 19, 2019, granted, now 10,771,491.
Application 16/279,984 is a continuation of application No. 15/087,861, filed on Mar. 31, 2016, granted, now 10,212,178, issued on Feb. 19, 2019.
Claims priority of provisional application 62/144,077, filed on Apr. 7, 2015.
Prior Publication US 2021/0058417 A1, Feb. 25, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 41/069 (2022.01); H04L 43/00 (2022.01); H04L 43/12 (2022.01); H04L 67/12 (2022.01); H04L 67/303 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 41/069 (2013.01); H04L 43/00 (2013.01); H04L 43/12 (2013.01); H04L 67/12 (2013.01); H04L 67/303 (2013.01)] 22 Claims
OG exemplary drawing
 
1. An IoT device management system, comprising:
a processor configured to:
obtain a set of data packets comprising at least one of: data packets transmitted to an IoT device, or data packets transmitted from an IoT device;
analyze at least one packet included in the set of data packets to identify transaction data from a payload of the at least one packet;
generate an event log for the IoT device from the transaction data;
update the event log, in real-time, to indicate current operation of the IoT device, wherein the event log includes a pattern of events corresponding to at least one of: a specific way in which the IoT device is being interacted with, or is otherwise functioning; and
provide a historical record for the IoT device, generated at least in part from the event log, to a device profiler configured to terminate flow of data associated with the IoT device if it is determined, at least in part, from a deviation from the historical record, that the IoT device is vulnerable to attack, including in response to a determination that either malware is being pushed to the IoT device, or a user interacting with the IoT device is behaving abnormally; and
a memory coupled to the processor and configured to provide the processor with instructions.