RU2747452C2 - Method for forming device clusters - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: invention relates to the field of computer technology for multiplatform synchronization and determining belonging of several devices to one user. The technical result described below is achieved by collecting information that characterizes unknown devices (hereinafter, device characteristics), and information that characterizes the environment of unknown devices (hereinafter, device environment characteristics); based on the collected characteristics for each of the unknown devices, at least one connection between the device and the device environment is detected; forming a communication profile for the detected communication based on the collected characteristics of the device and the environment, where the communication profile contains the characteristics of the connection and interaction between the selected device and other devices; selecting links for clustering and combining unknown devices into at least one cluster based on the similarity of the selected links, where the similarity of links is determined based on the similarity of the communication profile.

EFFECT: invention is aimed at increasing reliability and ensuring long-term binding of devices, their correlation with the profile and rapid response to changes in the user profile.

13 cl, 21 dwg

Description

Technology area

The invention relates to methods for multi-platform synchronization and determination of the belonging of several devices to one user.

State of the art

The number of electronic devices per household (English householder) or user is constantly growing, among these devices the share of devices with a network interface is growing. Now these are not only personal computers and smartphones, but also televisions, game consoles and even electric kettles. Accordingly, it became necessary to logically link these devices into one household around their owner / user, this is the concept of a smart home, and in the future, a smart environment. Associated devices are required at least for:

• centralized device management (including device security management);

• conducting marketing campaigns;

• effective communication with the user;

• authentication on multiple devices (English cross-device), etc.

Leaders in the development of device linking technologies and user activity analysis are companies that are engaged in advertising, e-commerce, profiling for the customer data platform (CDP) or have multi-platform software and hardware-software solutions. For example, US 20150235275 describes tracking, linking, and advertising targeting mechanisms based on matching attributes from a user profile. And in the publication US 20160125471 describes the mechanism for synchronizing cookies.

Computer security companies also need to discover new devices in the environment and relate them to the user to protect the device and the device's network environment. The necessity follows from the fact that devices interact with each other and any of the devices in the environment can become an attack vector against another device and user data, therefore all user's devices must be protected, but for this they need to be detected and tied to the user.

Modern automated device pairing methods rely on data that can be deleted (cookies can be cleared) or on heuristics that are not accurate enough. A technology is needed that would ensure reliable and long-term pairing of devices, correlate them with a profile, and respond quickly to changes in the user profile.

Brief Description of Drawings

The accompanying drawings are included to provide a further understanding of the invention and form part of this description, show embodiments of the invention, and together with the description serve to explain the principles of the invention.

The claimed invention is illustrated by the following drawings, in which:

FIG. 1a shows examples of device clusters.

FIG. 1b - depicts examples of environment profiles that are a mapping of device clusters from the previous figure.

FIG. 1c depicts an example of an extended device cluster with subclusters.

FIG. 1d - depicts an example of an extended environment profile, which is a display of the extended cluster from the previous figure, where, in addition to the environment devices, users of these devices are distinguished.

FIG. 1e - depicts an example of an extended environment profile, where, in addition to users, an M2M network is also allocated within the HomeID1 household.

FIG. 2 - depicts a device clustering system.

FIG. 3 depicts a method for forming clusters of devices.

FIG. 3a depicts a plurality of devices obtained to form clusters.

FIG. 3b - depicts a plurality of devices with detected connections.

FIG. 3c - depicts a set of devices with detected connections, after typing these connections.

FIG. 3d - depicts a set of devices with detected connections, after typing connections and highlighting connections that relate to local home networks - cluster HomeID1 and cluster HomeID2, while the clusters are shown conventionally in the form of a tree, where the root node is the cluster identifier

FIG. 3d - in a conditional form (in the form of a tree, where the root node is the cluster identifier, the internal node is the subcluster identifiers) depicts the extended clusters HomeID1 and HomeID2, where devices inside the device cluster are additionally clustered by users.

FIG. 4 depicts a method for assigning an unknown device to a cluster.

FIG. 4a depicts clustering devices.

FIG. 4b - depicts devices with detected connections.

FIG. 4c - depicts devices with detected links, after typing the links.

FIG. 4d - shows the result of comparing the discovered links with the known ones.

FIG. 4e - shows the result of comparing the generated user profiles with the known user profiles of devices belonging to the cluster.

FIG. 5 - depicts a method of forming connections between clusters of devices.

FIG. 5a - depicts clusters of devices and connections of some devices.

FIG. 5b - depicts extended device clusters and extended environment profiles, as well as the relationships between them.

FIG. 6 depicts an example of a general purpose computer system.

Disclosure invention

The present invention is intended to build an ambience profile with linking ambience devices to a user. In the present invention, information about the device and the environment of the device is collected for its implementation.

The technical result of the present invention is to ensure the formation of clusters as a result of the implementation of the method, in which at the first stage information is collected characterizing unknown devices (hereinafter, device characteristics) and information characterizing the environment of unknown devices (hereinafter, characteristics of the device environment). In a particular case, at least the following acts as a device environment:

• computer networks to which the device is connected, in this case, in a particular case, the type of network is determined;

• other devices to which the device is connected.

The characteristics of the device can be at least:

• hardware characteristics of the device;

• characteristics of the device software;

• characteristics of network traffic generated by the device.

And the characteristics of the environment of the device are at least:

• characteristics of the networks to which the device is connected, including the type of network;

• services operating on computer networks with which the device exchanges data;

• other devices to which the device is connected;

• services running on devices to which the device is connected.

Further, based on the collected characteristics for each of the unknown devices, at least one connection between the device and the environment of the device is detected. In a particular case, communication is described by communication characteristics, which include at least the characteristics of the environment.

After the links are found, links for clustering are selected and unknown devices are combined into at least one cluster based on the similarity of the selected links. Relationships can be considered similar if at least one characteristic of the detected relationship of one device is similar to the characteristic of the detected relationship of another device. The type of network to which the device is connected can determine the type of connection, and in a particular case, one type of connection is selected for clustering, for example, for clustering, the type of network can be selected - a local private (home) network.

Additionally, in a particular case, the cluster is classified on the basis of connections that are similar for the devices of this cluster.

In a particular case, based on the collected characteristics of the device and the environment, a device user profile is formed and devices from the formed cluster of devices with similar profiles are combined into a sub-cluster.

Description of embodiments of inventions

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The foregoing description is intended to assist a person skilled in the art for a comprehensive understanding of the invention, which is defined within the scope of the appended claims. Below is a disclosure of the key concepts used in the application.

A relation profile is an abstract entity that in a particular case contains connection and interaction characteristics (communication characteristics), between a personal device and an access point, between a personal device and a personal device, between a personal device and an IoT device. Thus, a link profile is information characterizing a link, which is transformed and packed into a data structure suitable for processing, comparison, building aggregates and surrogates (vectors). Personal devices are understood as mobile phones, laptops, tablets, personal computers, etc. One of the characteristics of communication can be the type of network within which connections with devices are established and communication is formed (home wireless network, public wireless network, M2M, GSM, etc.). The profile can be expressed as an N-dimensional vector of characteristics, the components of which are the characteristics of the link, where the subset of the characteristics of the link are the characteristics of the network connection (therefore, the link is used, not the connection, the link is described by a greater number of characteristics than the connection and is broader). Communication characteristics can at least be:

• a rule for forming a network connection between the device and the device's environment;

• the duration of the established connection between the device and the environment of the device;

• the type of connection between the device and the environment of the device;

• stability of the connection between the device and the environment of the device;

• geolocation of connection of the device with the environment of the device;

• characteristics of network traffic between the device and the environment of the device

• characteristics of the device with which communication is established.

The environment of a device refers to computer networks or other devices with which a connection has been established or can be established using any of the known protocols.

An N-dimensional vector of communication characteristics is an ordered set of N numbers, where the numbers are the coordinates of the vector. Qualitative (so-called categorical) characteristics can be encoded in numbers. The number of coordinates of a vector is called the dimension of the vector. Coordinates define the position of the associated device link or some link characteristics (eg link type, MAC address, SSID). The vector is obtained by transforming information about the environment and the device. The vector reflects some information about the environment.

Device clustering is the ordering of devices into comparative homogeneous groups (clusters) based on one or more attributes, such as links or individual characteristics of links. And by clustering devices a is meant finding a cluster of devices that have similar connections, where, in the absence of such clusters, a new cluster is created. An example of device clusters is depicted in FIG. 1a.

A device cluster is an ordered group of devices united based on the similarity of some characteristics, for example, the similarity of connections, in a particular case, a cluster is described by an environment profile (Fig.1b), and an extended cluster (a cluster with subclusters in Fig.1c) by an extended environment profile ( Fig. 1d and Fig. 1e). A device can belong to a certain cluster if the distance from the N-dimensional communication vector of the device to the center of this cluster is less than the cluster radius ("R") in the direction of the N-dimensional vector. In a particular case, the device belongs to a certain cluster, if the value of the distance (in Fig. 1a "d '") from the N-dimensional vector of the element to the nearest N-dimensional vector of the connection of the given cluster is less than the maximum allowable (threshold value of the distance [d']) or if the value of the distance (in Fig. 1a "d") from the N-dimensional link vector to the center of this cluster is less than the radius of this cluster. Distance options for assessing proximity, for example:

• linear distance;

• Euclidean distance;

• the square of the Euclidean distance;

• generalized power-law distance of Minkowski;

• Chebyshev distance;

• Manhattan distance.

A measure of proximity for assessing proximity (degree of similarity, coefficient of similarity) is a dimensionless indicator for determining the similarity of elements of a web page. To determine the measure of proximity, the following measures are used:

• Ohay;

• Jacquard;

• Sokala-Snita;

• Kulchinsky;

• symmetrical Dies.

The center of the cluster (centroid) is a vector, the elements of which are the average values of the corresponding features, calculated over all vectors of the cluster. For clusters consisting of one vector, this vector will be the center of the cluster.

The radius of the cluster (in Fig. 1a "R") is the maximum distance of the N-dimensional vectors included in the cluster from the center of the cluster.

For clustering, various well-known algorithms and approaches are used, including hierarchical (agglomerative and divisive) and non-hierarchical.

An environment profile is a structured collection of data about a group of devices combined based on links of the same type, in FIG. 1b shows the profiles for the local private (home) network and for M2M. In a particular case, an environment profile is a machine-readable description of a cluster of devices.

Extended environment profile - an environment profile supplemented with data about device users (Fig. 1d) or about adjacent networks, for example, M2M (Fig. 1e).

Connection type - one of the characteristics of a connection that characterizes the type of network to which or within which connections were established. It is possible to distinguish at least the following types of networks:

• local private (home) network;

• local public network;

• GSM network;

• М2М (network with transmission from node to node, in the particular case of connection with IoT);

Mesh network Link typing is the process of defining the link type. To determine the type of connections, both heuristic rules and machine learning (decision trees, neural networks, clustering, etc.) are used. To form heuristic rules, links are selected, the type of which is known and characteristics are identified (for example, they are looking for values of characteristics) that guarantee / do not allow attributing a link to this type and based on these characteristics a heuristic rule is formed, which is applied to links whose type is unknown. ... When there is no heuristic rule or the number of characteristics is insufficient, typing is carried out by comparing (determining similarity) of the link vector, the type of which is unknown with the vectors of links, the type of which is known. For typing relationships, at least the following characteristics can be used:

• availability of authorization to connect to the network;

• the type of encryption used;

• local time of connection to the network and disconnection from it;

• frequency of connections to this network;

• network name (ssid);

• day of the week when the connection was made;

• the number of devices connected to the access point;

• presence of other access points nearby, expanding the network of this point (roaming points).

The similarity is determined in various ways, for example, if a relationship is described by a vector composed of the characteristics of the relationship, then the relationships are considered similar if at least one of the characteristics of the unknown relationship is identical to the analogous characteristic of the other relationship. In a particular case, such characteristics may be the MAC address, the name of the access point, and the type of connection. Links are also considered to be similar if the distance between the vector of one formed link and the vector of another link in N-dimensional space or in projection onto one of the selected dimensions (for example, the dimension on which the duration or frequency of the links on the basis of which the link is formed) is less than the threshold value or in in general, if the dot product of vectors does not exceed a predetermined threshold value.

For typing, a trained neural network can also be used, where the characteristics of the connection are supplied to the input, and the type of connection is obtained at the output. The neural network is trained by methods known from the prior art based on connections, the type of which is known.

An inter-cluster communication profile is an abstract entity that, in a particular case, contains characteristics of similar links, characteristics of devices from different clusters, the links of which are similar to each other, profiles of users of these devices. The detection of similar links is described in method 500. Thus, the inter-cluster communication profile is information about similar links, the devices in which they are found and the users of these devices, converted and packed into a data structure suitable for processing, comparison, building aggregates and surrogates (for example , vectors). The characteristics of inter-cluster communication can be:

• clusters and sub-clusters between which a link is formed;

• the strength of inter-cluster communication (determined by the degree of similarity of links, described in more detail in the method 500, the number of similar links, their type and the number of devices with similar links);

• types of similar links;

• the duration of the existence of similar relationships;

• profiles of devices with similar connections;

• user profiles of these devices.

An inter-cluster communication profile generally contains information about all similar relationships found between devices from two interconnected clusters.

Typification of inter-cluster communication - based on the profile of inter-cluster communication, typing of communication is performed in order to determine in what relation the users of devices from linked clusters and the clusters themselves are located (and in the particular case of households, if the clusters combine devices of one household). This is done, for example, on the basis of comparing the inter-cluster communication profile with another profile, the type of which is known either using a neural network, where the characteristics of the inter-cluster communication are fed into the input, and the communication type is obtained at the output, where the neural network is pre-trained on marked clusters and inter-cluster connections.

Threat (English threat) - a potential incident that can disrupt the proper functioning of the system and thereby directly or indirectly cause damage. The types of threats are very diverse and have many classifications, within the framework of this application, classifications by the nature of the violation are used, namely:

• violation of data confidentiality;

• violation of data integrity / data substitution;

• failure of the system (including denial of service);

• unauthorized interference with the functioning of the system;

• etc.

A threat model is a formalized description of information security threats to a system. Includes at least:

• type of threat, where the threat is unauthorized use of the system, reflecting the interest of the offender;

• the element through which this type of threat is implemented;

• the way the threat is realized through the specified element;

• vector of influence on the system to implement the method of threat realization (attack vector);

A method of implementing a threat, an attack - actions of an intruder to implement a security threat of a certain type. For each element of the system, a certain type of threat can be implemented in different ways, including involving other components of the system.

An attack vector is a direction or a specific way of influencing a system from an intruder when a security threat is realized. The attribute "attack vector" in the framework of this application is identical to the attribute "vector of impact on the system to implement the method of implementing the threat." Attack vector defining characteristics can at least be:

• source or multiple sources of attack;

• an element or a set of elements that are the target of an attack;

• type of impact;

• means of influence.

The threat model and the use model may not formally differ from each other (with the exception of the attack vector) for the same system or complex. A classifying feature that distinguishes one model from another is that the use model reflects the interest of the authorized user, and the threat model reflects the interest of the offender. Examples of models for real systems will be given below.

FIG. 2 depicts a device clustering system 100 in which there are devices 110. The devices are at least:

• personal devices;

• IoT devices;

• routers, routers and other network equipment.

Clients 120 are installed on devices 110. Clients 120 collect information about the device and the environment of the device. The device environment is:

• other devices 110 with clients 120;

• devices 110a with which a connection can be established, but which do not have clients 120 (for example, personal devices such as a personal computer, mobile phone, tablet, etc.), IoT devices, including household appliances, and network equipment

The information collected by the clients 120 is sent to the server side and used by the link finder 130 and the device profiler 140. The link finder 130 is used to discover the links based on the information collected by the client 120 about the environment of the device 110 and generate a communication profile. The device profiling tool 140, based on the information collected by the client 120, generates a device profile 110 - an abstract entity (eg, a database entry) that describes a device, at least an operating system, installed applications, a device specification, and so on. Each device profile has a device identifier (DeviceID N) attached to it. In a particular case, the means 130 and the means 140 can be located on devices 110. The communication profiles are stored in the link base 150. When it is necessary to type the detected links, this is done by the link typing tool 160. The device profile is stored in the device base 170. The device clustering tool 180 groups devices based on the similarity of connections and the similarity of the user profiles of these devices. Grouping based on the similarity of links can be carried out:

• by any characteristic of the connection, for example, the type of connection;

• by any group of characteristics, for example, the MAC address of the access point and its name (SSID);

• based on all communication characteristics.

During clustering, vectors are formed from the selected bond characteristics and deposited in the N-dimensional space, and vectors, for example, within the cluster radius, are considered to be assigned to this cluster; in a particular case, the radius can be equal to zero. Based on the results of clustering, profiles are formed, for example, environment profiles, which are saved in the database of environment profiles 190, the clusters themselves can also be stored in this database. Based on information collected from devices and device profiles, as well as information received from other systems, including third-party systems, the user profiling tool 141 generates a user profile, storing it in the user base 170. For user profiling, for example: network activity of the device; data on the movement of the device in space; various personal network identifiers found on the device; email addresses from traffic, logins, phone numbers, etc. This information is converted and packed into a data structure suitable for processing, comparison, building aggregates and surrogates (vectors, dictionaries, etc.) - a user profile. Device Clustering Tool 180 uses device clusters and user profiles to perform additional clustering within device clusters from the environment profile database 190. Tool 180 groups devices within a device cluster based on the similarity of device user profiles. Based on the clustering results, extended environment profiles are formed, which are saved in the database of extended environmental profiles 191, the extended clusters themselves can also be stored in this database.

FIG. 3 depicts a method for clustering devices 200. At step 201, clustering devices 110 / 110a are obtained. At step 210, the client 120 on the devices 110 collects information about the devices 110 on which the client is installed, or about any other device 110a. The client collects information characterizing the device (hereinafter referred to as the characteristics of the device) and information characterizing the environment of the device (hereinafter referred to as the characteristics of the environment of the mobile device). The characteristics of the device can be at least:

• hardware characteristics of the device;

• characteristics of the device software;

• characteristics of network traffic generated by the device.

And the characteristics of the environment can be at least:

• characteristics of the networks to which the device is connected;

• services operating on computer networks with which the device exchanges data;

• other devices to which the device is connected;

• services running on devices to which the device is connected.

In this step, the client 120 discovers other devices (other than those discovered in step 201) and collects connection information, network protocols are used to discover other devices: DHCP, ICMP, ARP, MDNS, UPNP, NetBIOS, etc. Also, the client records all connections in the GSM network and discovers IoT devices, for example, using the capabilities of ZigBee, LPWAN, BLE, etc. At this stage, obviously unknown devices such as 110a can be detected, so in FIG. The process of detection and collection is depicted cyclically (201-210). Based on the collected characteristics, at step 220, communication is detected between the device 110 / 110a and the environment of the device and a communication profile is generated.

Next, it is necessary to compare the detected connections of the devices with each other, so at step 230 the connections are compared. Comparison can be carried out: by surrogates generated from communication profiles; profiles can be compared directly; or by any method known in the art suitable for the type of data to which the communication profile is represented. If similar relationships are found, then at step 231, devices having similar relationships are combined, and at step 232, a device cluster is created. Obviously, a device can be in different clusters at the same time, because:

• links can be compared not only by vectors containing all the characteristics of a link, but also by individual components of vectors (the distance between vectors is measured not in space, but in projection);

• the device has more than one link.

After the cluster has been created in step 232, an environment profile must be created and associated with the cluster, this occurs in step 250.

In a special case (for example, to identify devices belonging to the same household), before performing clustering, it is necessary to determine the type of detected connection (step 221) and select the necessary connections for clustering at step 223 (to identify devices of households, a connection with the type of home network is selected) and then, at step 230, the detected links of the selected type are compared. In general, at step 223, the links are selected based on any link characteristic, not just the type.

At step 210, not only the characteristics of the environment are collected, but also the characteristics of the device, based on the characteristics of the environment, the characteristics of the device, as well as additional information obtained from sources external to the system, at step 222, a profile of the user of the device is formed. The generated user profiles of the devices of the cluster created at step 232 are compared with each other (step 240). This is done in order to find devices used by the same user. If similar profiles are found, then within the cluster of devices these devices are combined at block 241. Combine devices within the created sub-cluster (block 242). For devices whose user profiles are not similar in the cluster, a sub-cluster (single sub-cluster) is created at step 242. The same device can belong to different sub-clusters, since a device can be used by more than one user. After creating the subclusters, at step 260, an extended environment profile is created. User profiles can be compared in ways similar to those used in link comparison or in any other way known in the art.

Device clusters, once created, can be classified at 233 based on, for example: how are the relationships that have been used to cluster the devices:

• if on the basis of belonging to the type of home network, MAC address and SSID of the network, then the cluster can be classified as household N (in the examples of this application, such clusters are denoted as HomeID N);

• if on the basis of belonging to the type of public network, MAC address and SSID of the network, then the cluster can be classified as public network N (in the examples of this application, such clusters are designated as PublicID N).

FIG. 3a-3d show an example of the implementation of the method for forming clusters. The clusters in the example are shown differently than in FIG. 1, since there is no need to represent them in N-dimensional space, they are expanded into a tree for ease of perception, where the root node corresponds to the cluster identifier, and the internal node (for extended clusters) to the user identifier, leaves correspond to devices. So, there are devices 110 (FIG. 3a) with a client 120 installed (not shown). It is necessary to form clusters of these devices in order to identify devices belonging to the same household and divide these devices by owner / user within the same household.

The client 120 collects information characterizing the device and information characterizing the environment of the device on the devices, this information can be collected and accumulated over a period of time, for example, a week. Further, as shown in FIG. 3b, based on the collected characteristics, links 300 between devices and the environment of devices are detected, access points 310 in a particular case also act as elements of such an environment. The detected links are typed (Fig. 3c), in this example, links are distinguished within the following types of networks:

• local private (home) network - 300a;

• local public network - 300b;

• М2М-300v;

• GSM network - 300g.

The access points are also typed, highlighting home access points 310a and public access points 310b. In a particular case, for typing a connection, the task of typing access points is primary.

Since, according to the conditions, it is necessary to determine devices within one household, from all devices, only those devices are selected (this step corresponds to step 223 of method 300) that have connections of the type - local private (home) network (connection characteristic type of connection = local private ( home) network), in the example these are devices with connections 300a (see Fig. 3d). In order to identify devices from the same household, devices selected by the type of connection, the devices are grouped and create a cluster of devices, where the cluster is formed of devices with similar connections of the same type. In this example, links are considered similar if at least one of the characteristics of one link (in addition to the characteristics of the link type) is identical or similar to a similar characteristic of another link or link taken as a reference. In an example, such communication characteristics can be:

• MAC address of the access point (characteristics must be identical);

• access point name - SSID (characteristics must be identical);

• duration of connection (characteristics should be similar or exceed some threshold value of the reference communication characteristics).

It is on the basis of the "connection duration" characteristic that the device 110b, which has connections in two networks, is assigned to the HomeID1 cluster. Device 110b could belong to a guest, which means that it appears irregularly on the home network and the duration of the connection is significantly lower than other devices.

Further (Fig. 3d) devices belonging to one cluster are grouped by owners using the information collected about the device and user profiles. This creates an extended device cluster, according to which the extended environment profile HomeID1 and HomeID2 is created.

FIG. 4 depicts a method 400 for assigning an unknown device to a cluster. In step 201a, an unknown device is discovered. Detection occurs at least when:

• the client 120 installed on the device 110 sends the identifier of the device 110 on which it is installed, and this identifier is not in the database 170;

• client 120 will commit its first launch to device 110;

• the device 110 with the client 120 installed captures in its surroundings a device 110a that is missing from both the client 120 database and the server side database 170.

Thus, unknown is a device that is not available in the databases of the system 100. At step 210, the client 120 collects information about the device 110 on which the client is installed, or about any other device discovered at step 201. The client collects information characterizing the device (characteristics of the device) and information characterizing the environment of the device (characteristics of the environment of the device). The possible characteristics of the device and environment have been listed above. At step 210, the client discovers other devices (other than those discovered at step 201) and accumulates information about connections where network protocols are used for discovery: DHCP, ICMP, ARP, MDNS, UPNP, NetBIOS, etc. Also, the client records all connections in the GSM network and discovers IoT devices, for example, using the capabilities of ZigBee, LPWAN, BLE, etc. At this stage, obviously unknown devices such as 110a can be detected, so in FIG. 4, the detection and collection process is depicted cyclically (201a - 210). Based on the collected characteristics, at step 220, the communication between the device 110 / 110a and the environment of the device is detected and a communication profile is generated.

Next, you need to discover a cluster of devices containing at least one device whose communication is similar to the communication found in step 220. To do this, at step 230a, the detected connections are compared with the known ones. If similar relationships are found, then at step 231a, the device is placed into device clusters whose devices have similar relationships. Obviously, a device can fall into different clusters at the same time, because:

• links can be compared not only by vectors, but also by individual characteristics (distance is measured not in space, but in projection);

• the device usually has more than one link.

After a device has been added to the device cluster, it is necessary to update the environment profile associated with the cluster, this occurs at step 251. In a special case (for example, to identify devices belonging to the same household), before performing clustering, it is necessary to determine the type of detected connection (step 221) by network membership (home, public, etc.) and look for similar ones among known connections of the same type. In another special case, the problem of assigning to a household can be solved differently, for this, the type of detected connections is not determined, but the clusters must be preliminarily marked (classified), for example, clusters of devices are allocated, grouped based on the similarity of connections, the type of connection for which is the same. Those. the cluster unites devices with similar connections, the vectors of which are similar in at least one of the characteristics (in the example, at least in the connection type). Clusters can be marked by any method known from the prior art, used in machine learning with the "involvement" of a teacher.

If no similar associations are found in the comparison at step 230a, a new device cluster is created at step 232 and a new environment profile is associated with it at step 250.

At step 210, not only the environmental characteristics are collected, but also the characteristics of the device, based on the characteristics of the environment, the characteristics of the device and additional sources, at block 222, a profile of the user of the device is generated. The generated user profile is compared at step 240a with the user profiles of other devices in the cluster. This is done in order to find devices used by the same user. If a similar device user profile is found among the devices in the cluster, then the devices for which the profile was generated in step 222 are assigned to a sub-cluster containing a device with a similar user profile. When the profile is similar to the user profiles of devices from different sub-clusters, the device is assigned to a sub-cluster with the profiles of device users that are most similar (closer to the cluster core, more similarity, etc.). In another special case, the device is placed in all sub-clusters containing devices with similar user profiles, this is done on the basis that this device can be used by several users. If no similar profiles are found at block 242, a new subcluster is created, this may indicate that an unknown user has appeared in the environment. After updating the subclusters in step 241 or creating a new subcluster in step 242, the extended profile associated with the cluster needs to be updated at step 261.

FIG. 4a-4e show an example of the implementation of the method of assigning an unknown device to a cluster. In an example 110v / 110g device with client 120 installed (not shown). Required for devices 110 of FIG. 4a, identify the clusters of households to which devices and device users belong.

The client 120 collects information characterizing the device (hereinafter referred to as device characteristics) and information characterizing the device's environment (hereinafter referred to as the characteristics of the device environment) on devices, this information can be collected over a period of time, for example, a week. Further, as shown in FIG. 4b, based on the collected characteristics, connections 300 between devices and the environment of devices are detected, access points 310 in a particular case act as elements of such an environment. Based on the collected information about connections, they are typed (FIG. 4c), in this example, connections are identified within the following types of networks:

• local private (home) network - 300a;

• local public network - 300b.

Since it is necessary to determine devices within one household, then from all formed links, links are selected that have the type - local private (home) network (link characteristic type of link = local private (home) network). In order to discover the clusters of households to which the devices belong, the discovered device associations are compared with the known device associations from the device clusters (HomeID1 and HomeID2) shown in FIG. 3d. In this example, relationships are considered similar if at least one of the characteristics of the detected relationship (in addition to the characteristic type of relationship) is identical or similar to a similar characteristic of another relationship. In an example, such communication characteristics can be:

• MAC address of the access point (characteristics must be identical);

• access point name - SSID (characteristics must be identical);

• duration of connection (characteristics should be similar or exceed some threshold value of the reference communication characteristics).

The comparison results are shown in FIG. 4d. For the 110b device, similar connections were found for devices from the HomeID1 cluster, so this device is referred to this cluster. For device 110g, no similar links were found among the known links for devices of the clusters HomeID1 and HomeID2, so a new cluster HomeID3 is created.

Further (Fig. 4e), using the collected information about the devices and the user profiles of these devices, the users of the 110v / 110g devices are determined (similar user profiles are searched among the known ones). For device 110b, a similar user profile was found (user profile with UserID2) and this device was assigned to the UserID2 subcluster, for 110g, a similar profile was not found and a new UserID6 subcluster was created for it. Thus, the extended cluster of devices HomeID1 is updated, in accordance with which the extended environment profile HomeID1 is updated, and an extended cluster HomeID3 is created, in accordance with which the extended environment profile HomeID3 is created.

FIG. 5 depicts a method 500 for detecting connections between clusters, on the basis of which, for example, connected households and influencers (from the English influencer) are detected - users through whom and whose devices it is possible to distribute, including security solutions and enhance complex protection households, which is the first step towards building an immune system network. In a first step 200a, pre-formed device clusters are obtained. Clusters can be formed by method 200 or any other method known in the art. In step 200a, at least two clusters are obtained, from which in step 201b at least one device is selected, in particular all devices are selected. At 205, their associations are obtained for the selected devices. If the clusters were formed by method 200, then the connections for the devices are stored in the linkbase 150 and retrieval consists in a query to the linkbase. If device linkages have not been previously discovered, or if an update of the device linkage characteristics is required, then steps 210 and 220 described earlier are performed to obtain the links. The obtained connections are compared with each other, while the connections of devices from different clusters are compared, the connections of devices from the same cluster are not compared with each other. If the links are similar, then the clusters are considered linked, so at step 233 a link between the clusters is detected and at step 270 an inter-cluster link profile is generated. Environment profiles describing clusters between which a relationship is found are also associated (block 252). Inter-cluster communication profile, contains information about the connection, for example, which clusters are connected, what is the strength of the connection (determined by the degree of similarity obtained at step 230a, the number of similar connections, their type and the number of devices with similar connections), what types of connections are similar, how long the existence of similar connections, etc. Depending on the nature of the similarity, for example, when the comparison reveals the identity of the links, the subclusters are also recognized as related, so at step 243, the relationship between the subclusters is found. If the subclusters are not created, they are created, for this, steps 222, 240, 241, 242 are performed. After discovery in the communication step 243, the corresponding extended environment profiles are also associated, this happens in step 262, all changes are reflected in the inter-cluster communication profile in step 270 If the clusters contain devices from one household, then the presence of a connection between the clusters indicates that the households are connected, and if it was possible to connect the subclusters, then it was possible to find potential agents of influence - persons from one household who have an influence on the persons of another household. In a particular case, this must be taken into account when building a protection system and protecting a household.

FIG. 5a and FIG. 5b shows an example of a method for detecting connections between clusters. FIG. 5a shows clusters HomeID1 and HomeID2 pre-formed by method 200. From these clusters are selected by device, such devices are 110b and 110d. Links are obtained for the selected devices. These links are links:

• for device 110b: 300a '(two connections), 300b', 300v ', 300g'

• for 110d device: 300a ', 300v', 300g '.

The resulting device connections are compared with each other, for example, the connection 300a 'of the device 110b is compared with the connection 300a' of the device 110b. Relationships of only one type are compared with each other, while the characteristics are selected by which the relationships are compared. For example, 300a links are compared in terms of SSID and MAC address of the access point, and 300g links are compared in all available characteristics. Obviously, since the comparison of links of type 300a is carried out by the name and address of the access point, and devices 110b and 110d were connected to the access point from the HomeID2 cluster (there is a connection with the access point), then these links are recognized as similar in these characteristics. The devices also have links 300g ', since the links were discovered when the devices were connected to each other in the GSM network, the link 300g' of the device 110b is identical to the link 300g 'of the device 110b. No similarities were found between the other links based on the characteristics selected. The intercomparison may continue further, and it is possible that similar relationships will still be found in other devices in the cluster. The presence of similar links allows us to speak about the presence of a link 301 between the clusters HomeID1 and HomeID2, and the presence of identical links allows linking sub-clusters, in the example, sub-clusters combine devices of one user, therefore, in Fig. 5b, a link 302 is created between users, and the extended environment profiles are linked accordingly. When a connection between clusters is found, the profile of an inter-cluster connection is filled in, where they indicate on the basis of what types of connections and the similarity of what characteristics the connection between the clusters was found. If necessary, and depending on the purposes for which the search for connections between clusters was carried out, the inter-cluster communication profile specifies the characteristics of devices whose connections are similar and the characteristics of users of these devices (their profiles).

The household environment profile allows you to use adaptive protection and quickly respond to emerging threats. Clients 120 that are installed on devices 110 allow communication characteristics and device characteristics to be changed in order to make the threat impossible and protect the household. For similar purposes, not only household profiles are used.

System 100 means real devices, systems, components, a group of components implemented using hardware such as an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA) ) or, for example, in the form of a combination of software and hardware, such as a microprocessor system and a set of software instructions, as well as on neurosynaptic chips, the functionality of these modules can be implemented exclusively by hardware, as well as a combination, where part of the functionality is implemented in software, and part in hardware. In some implementations, the tools may be executed on a processor of a general purpose computer (eg, as depicted in FIG. 6). Databases can be implemented in all possible ways and contained both on one physical medium, and on different ones, located both locally and remotely.

FIG. 6 shows an example of a general-purpose computer system, a personal computer or server 20, comprising a central processing unit 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processing unit 21. The system bus 23 is implemented as any bus structure known from the prior art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interfacing with any other bus architecture. System memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains basic procedures that transfer information between the elements of the personal computer 20, for example, at the time of loading the operating room. systems using ROM 24.

The personal computer 20, in turn, contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31, such as CD-ROM, DVD -ROM and other optical media. The hard disk 27, the magnetic disk drive 28, and the optical drive 30 are connected to the system bus 23 via the hard disk interface 32, the magnetic disk interface 33, and the optical drive interface 34, respectively. Drives and corresponding computer storage media are non-volatile storage media for computer instructions, data structures, program modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that other types of computer storage media 56 are possible that are capable of storing data in a computer readable form (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36, where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38 and program data 39. The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40, manipulator " mouse "42). Other input devices may be used (not shown): microphone, joystick, game console, scanner, etc. Such input devices are conventionally connected to the computer system 20 through a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, etc. ...

The personal computer 20 is capable of operating in a networked environment using a network connection with other or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the entity. the personal computer 20 shown in FIG. 6. There may also be other devices on a computer network, such as routers, network stations, peer-to-peer devices, or other network nodes.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, personal computer 20 is connected to local network 50 via a network adapter or network interface 51. When using networks, personal computer 20 may use a modem 54 or other means of providing communication with a wide area network, such as the Internet. Modem 54, which is an internal or external device, is connected to the system bus 23 via a serial port 46. It should be noted that the network connections are only exemplary and are not required to reflect the exact configuration of the network, i. E. in fact, there are other ways of establishing a connection by technical means of communication of one computer with another.

In conclusion, it should be noted that the information given in the description are examples and do not limit the scope of the present invention defined by the claims. One skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (27)

1. A method of forming clusters of devices, in which: a) collect information characterizing unknown devices (hereinafter, device characteristics), and information characterizing the environment of unknown devices (hereinafter, device environment characteristics); b) based on the collected characteristics for each of the unknown devices, at least one connection between the device and the environment of the device is detected; c) forming a communication profile for the detected communication based on the collected characteristics of the device and the environment, where the communication profile contains the characteristics of the connection and interaction between the selected device and other devices; d) select links for clustering; e) combine unknown devices into at least one cluster based on the similarity of the selected links, where the similarity of the links is determined based on the similarity of the communication profile. 2. The method of claim 1, further comprising classifying the cluster based on links that are similar to the devices in the cluster. 3. The method according to claim 1, according to which the characteristics of the device are at least: • hardware characteristics of the device; • characteristics of the device software; • characteristics of network traffic generated by the device. 4. The method according to claim 1, wherein at least: • computer networks to which the device is connected; • other devices to which the device is connected. 5. The method according to claim 4, further comprising determining the type of network to which the device is connected. 6. The method according to claim 1, wherein the characteristics of the environment of the device are at least: • characteristics of the networks to which the device is connected, including the type of network; • services operating on computer networks with which the device exchanges data; • other devices to which the device is connected; • services running on devices to which the device is connected. 7. The method of claim 1, wherein a user profile of the device is generated based on the collected characteristics of the device and the environment. 8. The method of claim 7, wherein the devices of the cluster of devices with similar profiles are combined into a sub-cluster. 9. The method of claim 1, wherein the communication is described by communication characteristics that include at least environmental characteristics. 10. The method of claim 8, wherein the link is considered similar if at least one characteristic of the detected link of one device is similar to the characteristic of the detected link of another device. 11. The method according to claims 6 and 8, wherein the type of network determines the type of communication. 12. The method of claim 10, wherein one type of link is selected for clustering. 13. The method according to claim 12, wherein the network type is selected for clustering — local private (home) network.

Images