# US 10,375,090 B2 · Machine learning-based traffic classification using compressed network telemetry data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,090 B2 - Document ID: US10375090B2 - Status: Granted - Kind: B2 - Application number: 15/469,716 - Filed: 2017-03-27 - Published: 2018-09-27 - Granted: 2019-08-06 - Earliest claimed: 2017-03-27 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: David McGrew; Blake Harrell Anderson - Web page: https://patentgrep.com/patent/US10375090B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06N 20/00: Machine learning - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a device in a network receives telemetry data regarding a traffic flow in the network. One or more features in the telemetry data are individually compressed. The device extracts the one or more individually compressed features from the received telemetry data. The device performs a lookup of one or more classifier inputs from an index of classifier inputs using the one or more individually compressed features from the received telemetry data. The device classifies the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier. ## Claims ### Claim 1 A method comprising: receiving, at a device in a network, telemetry data regarding a traffic flow in the network, wherein each of a plurality of features in the telemetry data are individually compressed so that a separate data compression context is maintained for each of the plurality of features in the telemetry data; extracting, by the device, the plurality of individually compressed features from the received telemetry data; performing, by the device, a lookup of one or more classifier inputs from an index of classifier inputs using at least one of the plurality of individually compressed features from the received telemetry data; and classifying, by the device, the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier. ### Claim 2 (depends on 1) The method as in claim 1, wherein classifying the traffic flow comprises: determining, by the device, an application associated with the traffic flow. ### Claim 3 (depends on 1) The method as in claim 1, wherein classifying the traffic flow comprises: determining, by the device, whether the traffic flow is associated with malware. ### Claim 4 (depends on 1) The method as in claim 1, wherein the plurality of individually compressed features in the telemetry data comprises at least one of: sequence of packet lengths and time (SPLT) data regarding the traffic flow, sequence of application lengths and time (SALT) data regarding the traffic flow, byte distribution (BD) data regarding the traffic flow, a ciphersuite, or a Transport Layer Security (TLS) extension. ### Claim 5 (depends on 1) The method as in claim 1, wherein the received telemetry data comprises a NetFlow or Internet Protocol Flow Information Export (IPFIX) record. ### Claim 6 (depends on 1) The method as in claim 1, wherein a particular one of the individually compressed one or more features in the telemetry data references a previously observed feature in the network. ### Claim 7 (depends on 1) The method as in claim 1, wherein a particular one of the individually compressed one or more features in the telemetry data is compressed using Lempel-Ziv compression. ### Claim 8 (depends on 1) The method as in claim 1, wherein the machine learning-based classifier comprises a random forest classifier or a regression-based classifier. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute a process; and a memory configured to store the process executable by the processor, the process when executed configured to: receive telemetry data regarding a traffic flow in the network, wherein each of a plurality of features in the telemetry data are individually compressed so that a separate data compression context is maintained for each of the plurality of features in the telemetry data; extract the plurality of individually compressed features from the received telemetry data; perform a lookup of one or more classifier inputs from an index of classifier inputs using at least one of the plurality of individually compressed features from the received telemetry data; and classify the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the apparatus classifies the traffic flow by: determining an application associated with the traffic flow. ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus classifies the traffic flow by: determining whether the traffic flow is associated with malware. ### Claim 12 (depends on 9) The apparatus as in claim 9, wherein the plurality of individually compressed features in the telemetry data comprises at least one of: sequence of packet lengths and time (SPLT) data regarding the traffic flow, sequence of application lengths and time (SALT) data regarding the traffic flow, byte distribution (BD) data regarding the traffic flow, a ciphersuite, or a Transport Layer Security (TLS) extension. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the received telemetry data comprises a NetFlow or Internet Protocol Flow Information Export (IPFIX) record. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein a particular one of the individually compressed one or more features in the telemetry data references a previously observed feature in the network. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein a particular one of the individually compressed one or more features in the telemetry data is compressed using Lempel-Ziv compression. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the machine learning-based classifier comprises a random forest classifier or a regression-based classifier. ### Claim 17 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising: receiving, at the device, telemetry data regarding a traffic flow in the network, wherein each of a plurality of features in the telemetry data are individually compressed so that a separate data compression context is maintained for each of the plurality of features in the telemetry data; extracting, by the device, the plurality of individually compressed features from the received telemetry data; performing, by the device, a lookup of one or more classifier inputs from an index of classifier inputs using at least one of the plurality of individually compressed features from the received telemetry data; and classifying, by the device, the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier. ### Claim 18 (depends on 17) The computer-readable medium as in claim 17, wherein classifying the traffic flow comprises: determining, by the device, an application associated with the traffic flow or whether the traffic flow is associated with malware. ### Claim 19 (depends on 17) The computer-readable medium as in claim 17, wherein the plurality individually compressed features in the telemetry data comprises at least one of: sequence of packet lengths and time (SPLT) data regarding the traffic flow, sequence of application lengths and time (SALT) data regarding the traffic flow, byte distribution (BD) data regarding the traffic flow, a ciphersuite, or a Transport Layer Security (TLS) extension. ### Claim 20 (depends on 17) The computer-readable medium as in claim 17, wherein the received telemetry data comprises a NetFlow or Internet Protocol Flow Information Export (IPFIX) record.