Machine learning-based traffic classification using compressed network telemetry data
AssigneeCisco Technology, Inc.
InventorsDavid McGrew, Blake Harrell Anderson
Life of this patent
Estimating the term…
Abstract
In one embodiment, a device in a network receives telemetry data regarding a traffic flow in the network. One or more features in the telemetry data are individually compressed. The device extracts the one or more individually compressed features from the received telemetry data. The device performs a lookup of one or more classifier inputs from an index of classifier inputs using the one or more individually compressed features from the received telemetry data. The device classifies the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier.
Claims20
A method comprising:
- receiving, at a device in a network, telemetry data regarding a traffic flow in the network, wherein each of a plurality of features in the telemetry data are individually compressed so that a separate data compression context is maintained for each of the plurality of features in the telemetry data;
- extracting, by the device, the plurality of individually compressed features from the received telemetry data;
- performing, by the device, a lookup of one or more classifier inputs from an index of classifier inputs using at least one of the plurality of individually compressed features from the received telemetry data;
- and
- classifying, by the device, the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier.
An apparatus, comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the one or more network interfaces and configured to execute a process;
- and
- a memory configured to store the process executable by the processor, the process when executed configured to:
- receive telemetry data regarding a traffic flow in the network, wherein each of a plurality of features in the telemetry data are individually compressed so that a separate data compression context is maintained for each of the plurality of features in the telemetry data;
- extract the plurality of individually compressed features from the received telemetry data;
- perform a lookup of one or more classifier inputs from an index of classifier inputs using at least one of the plurality of individually compressed features from the received telemetry data;
- and
- classify the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier.
A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
- receiving, at the device, telemetry data regarding a traffic flow in the network, wherein each of a plurality of features in the telemetry data are individually compressed so that a separate data compression context is maintained for each of the plurality of features in the telemetry data;
- extracting, by the device, the plurality of individually compressed features from the received telemetry data;
- performing, by the device, a lookup of one or more classifier inputs from an index of classifier inputs using at least one of the plurality of individually compressed features from the received telemetry data;
- and
- classifying, by the device, the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier.
Dependencies are inferred from the claim text.