Packet capture for anomalous traffic flows

A method comprising:

• receiving, at a device in a network, an indication of an anomalous traffic flow detected by a node in the network using a machine-learning model;
• storing, by the device, packets of the anomalous traffic flow with metadata indicative of at least one of:
• the anomaly type, severity, a packet capture duration, or an indication as to whether the packets were captured proactively by the node;
• dynamically determining, by the device, an action policy for the anomalous traffic flow, based on an anomaly type or severity associated with the anomalous traffic flow;
• dynamically determining, by the device, a quarantine policy for the anomalous traffic flow, based on the anomaly type or severity associated with the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis;
• providing, by the device, the action and quarantine policies to the node,
• wherein the provided quarantine policy and action policy cause the node to proactively apply the quarantine and action policies to one or more packets of the anomalous traffic flow, in response to receiving the indication of anomalous traffic flow;
• and
• based on quarantine policy and action policy, sending packets to an attack detector.

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute a process;
• and
• a memory configured to store the process executable by the processor, the process when executed operable to:
• identify an anomalous traffic flow in the network using a machine-learning model;
• report the anomalous traffic flow to a supervisory device in the network;
• dynamically determine a quarantine policy for the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis;
• dynamically determine an action policy for the anomalous traffic flow, wherein the action policy corresponds to how and if the packets of the anomalous flow are handled within the network and is determined based on at least a severity of the anomaly associated with the anomalous flow, wherein the first device receives the action policy from the supervisory device, in response to reporting the anomalous traffic flow to the supervisory device;
• proactively apply the quarantine and action policies to one or more packets of the anomalous traffic flow, in response to identifying the anomalous traffic flow;
• and
• based on quarantine policy and action policy, sending packets to an attack detector.

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute a process;
• and
• a memory configured to store the process executable by the processor, the process when executed operable to:
• receive an indication of an anomalous traffic flow detected by a node in the network using a machine-learning model;
• store packets of the anomalous traffic flow with metadata indicative of at least one of:
• the anomaly type, severity, a packet capture duration, or an indication as to whether the packets were captured proactively by the node;
• dynamically determine an action policy for the anomalous traffic flow, based on an anomaly type or severity associated with the anomalous traffic flow;
• dynamically determine a quarantine policy for the anomalous traffic flow, based on the anomaly type or severity associated with the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis;
• provide the action and quarantine policies to the node, wherein the provided action policy and quarantine policy cause the node to proactively apply the action and quarantine policies to one or more packets of the anomalous traffic flow, in response to receiving the indication of anomalous traffic flow;
• and
• based on quarantine policy and action policy, sending packets to an attack detector.