Adaptive internet of things edge device security

Abstract

In an example, there is disclosed an apparatus, including: a network interface to communicatively couple to an internet of thing (IoT) having at least one edge device; a gateway engine to provide gateway services to one or more edge devices via the network interface; and one or more logic devices, including at least one hardware logic device, providing an adaptive security engine to: compile a periodic device interaction summary (DIS) for the edge device; send the DIS to a cloud service; receive from the cloud service a DIS signature for the edge device; determine that one or more interactions from the edge device are suspicious; and act on the determining.

1 - 25 . (canceled) 
     
     
         26 . At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
 receive, from a gateway device in an internet of things (IoT) system, device interaction summary (DIS) data, wherein the IoT system comprises a plurality of edge devices, and the DIS data comprises information collected by the gateway device to describe a type of at least a particular one of the plurality of edge devices and activities of the edge device during a time period;   generate a DIS signature for the particular edge device based on the DIS data, wherein the DIS signature comprises a plurality of attributes associated with expected behavior of the particular edge device; and   serve the DIS signature for use by the gateway device to perform security services for the IoT systems.   
     
     
         27 . The storage medium of  claim 26 , wherein DIS data describes characteristics of the particular edge device observed over a period of time. 
     
     
         28 . The storage medium of  claim 27 , wherein the DIS signature is generated from a result of a machine learning algorithm using the DIS data as an input. 
     
     
         29 . The storage medium of  claim 26 , wherein the DIS signature is served over a secured communication channel between the gateway device and a remote computing system. 
     
     
         30 . The storage medium of  claim 26 , wherein serving the DIS signature comprises pushing the DIS signature to the gateway device over a network connection. 
     
     
         31 . The storage medium of  claim 26 , wherein the DIS signature comprises a defined structure comprising a plurality of fields. 
     
     
         32 . The storage medium of  claim 31 , wherein each of the plurality of fields contains information for a respective one of a plurality of classes of expected behavior of the particular edge device. 
     
     
         33 . The storage medium of  claim 32 , wherein the plurality of classes of expected behavior comprise a frequency-domain class, a periodicity class, a pattern of interaction class, a seasonal variation class, a time range of interaction class, and a related devices class. 
     
     
         34 . The storage medium of  claim 33 , wherein the expected behavior associated with the frequency-domain class comprises one of periodic, continuous, random, piecewise periodic, piecewise continuous, and piecewise random, seasonal periodic, seasonal continuous, or seasonal random. 
     
     
         35 . The storage medium of  claim 26 , wherein the DIS signature is cryptographically protected. 
     
     
         36 . A method comprising:
 receiving, from a gateway device in an internet of things (IoT) system, device interaction summary (DIS) data, wherein the IoT system comprises a plurality of edge devices, and the DIS data comprises information collected by the gateway device to describe a type of at least a particular one of the plurality of edge devices and activities of the edge device during a time period;   generating a DIS signature for the particular edge device based on the DIS data, wherein the DIS signature comprises a plurality of attributes associated with expected behavior of the particular edge device; and   serving the DIS signature for use by the gateway device to perform security services for the IoT systems.   
     
     
         37 . A system comprising:
 a processor;   memory; and   a communication module to connect, over a network, to a gateway device; and   a security engine executable by the processor to:
 receive, from the gateway device, device interaction summary (DIS) data, wherein the gateway device is in communication with a plurality of edge devices within an internet of things (IoT) system, and the DIS data comprises information collected by the gateway device to describe a type of at least a particular one of the plurality of edge devices and activities of the edge device during a time period; 
 generate a DIS signature for the particular edge device based on the DIS data, wherein the DIS signature comprises a plurality of attributes associated with expected behavior of the particular edge device; and 
 serve the DIS signature for use by the gateway device to perform security services for the IoT systems 
   
     
     
         38 . The system of  claim 37 , wherein the security engine is to provide cloud-based security analytics to the gateway device. 
     
     
         39 . The system of  claim 38 , wherein the security engine is to provide cloud-based security analytics to a plurality of gateway devices in a plurality of different IoT systems. 
     
     
         40 . The system of  claim 37 , further comprising the gateway device, wherein the gateway device is to use the DIS signature to compare observed behavior of the particular edge device with the DIS signature to identify anomalous behavior of the particular edge device. 
     
     
         41 . The system of  claim 40 , further comprising the plurality of edge devices. 
     
     
         42 . The system of  claim 37 , wherein the DIS signature comprises a defined structure comprising a plurality of fields. 
     
     
         43 . The system of  claim 42 , wherein each of the plurality of fields contains information for a respective one of a plurality of classes of expected behavior of the particular edge device. 
     
     
         44 . The system of  claim 43 , wherein the plurality of classes of expected behavior comprise a frequency-domain class, a periodicity class, a pattern of interaction class, a seasonal variation class, a time range of interaction class, and a related devices class. 
     
     
         45 . The system of  claim 44 , wherein the expected behavior associated with the frequency-domain class comprises one of periodic, continuous, random, piecewise periodic, piecewise continuous, and piecewise random, seasonal periodic, seasonal continuous, or seasonal random.