Using a machine learning classifier to assign a data retention priority for network forensics and retrospective detection
AssigneeCisco Technology, Inc.
InventorsDavid McGrew, Blake Harrell Anderson, K. Tirumaleswar Reddy, Prashanth Patil, Daniel G. Wing
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network receives traffic data regarding one or more traffic flows in the network. The device applies a machine learning classifier to the traffic data. The device determines a priority for the traffic data based in part on an output of the machine learning classifier. The output of the machine learning classifier comprises a probability of the traffic data belonging to a particular class. The device stores the traffic data for a period of time that is a function of the determined priority for the traffic data.
Claims17
A method, comprising:
- receiving, at a device in a network, traffic data regarding one or more traffic flows in the network;
- applying, by the device, a machine learning classifier to the traffic data;
- determining, by the device, a reputation score for an endpoint device or user profile associated with the traffic data;
- determining, by the device, a data retention priority for the traffic data based in part on an output of the machine learning classifier and the determined reputation score, wherein the output of the machine learning classifier comprises a probability of the traffic data belonging to a particular class;
- and
- storing, by the device, the traffic data for a period of time based on the determined data retention priority for the traffic data.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed operable to:
- receive traffic data regarding one or more traffic flows in the network;
- apply a machine learning classifier to the traffic data;
- determine a reputation score for an endpoint device or user profile associated with the traffic data,
- determine a data retention priority for the traffic data based in part on an output of the machine learning classifier and the determined reputation score, wherein the output of the machine learning classifier comprises a probability of the traffic data belonging to a particular class;
- and
- store the traffic data for a period of time that is a function of the determined data retention priority for the traffic data.
A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
- receiving traffic data regarding one or more traffic flows in the network;
- applying a machine learning classifier to the traffic data;
- determining a reputation score for one or more characteristics of the traffic data;
- determining a data retention priority for the traffic data based in part on an output of the machine learning classifier and the reputation score for the one or more characteristics of the traffic data, wherein the output of the machine learning classifier comprises a probability of the traffic data belonging to a particular class;
- and
- storing the traffic data for a period of time that is a function of the determined data retention priority for the traffic data.
Dependencies are inferred from the claim text.