# US 10,484,405 B2 · Packet capture for anomalous traffic flows > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,405 B2 - Document ID: US10484405B2 - Status: Granted - Kind: B2 - Application number: 14/603,978 - Filed: 2015-01-23 - Published: 2016-07-28 - Granted: 2019-11-19 - Earliest claimed: 2015-01-23 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Sukrit Dasgupta; Jean-Philippe Vasseur - Web page: https://patentgrep.com/patent/US10484405B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a first device in a network identifies an anomalous traffic flow in the network. The first device reports the anomalous traffic flow to a supervisory device in the network. The first device determines a quarantine policy for the anomalous traffic flow. The first device determines an action policy for the anomalous traffic flow. The first device applies the quarantine and action policies to one or more packets of the anomalous traffic flow. ## Claims ### Claim 1 A method comprising: identifying, by a first device in a network, an anomalous traffic flow in the network using a machine-learning model; reporting, by the first device, the anomalous traffic flow to a supervisory device in the network; dynamically determining, by the first device, a quarantine policy for the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis; dynamically determining, by the first device, an action policy for the anomalous traffic flow, wherein the action policy corresponds to how and if the packets of the anomalous flow are handled within the network and is determined based on at least a severity of the anomaly associated with the anomalous flow, wherein the first device receives the action policy from the supervisory device, in response to reporting the anomalous traffic flow to the supervisory device; proactively applying, by the first device, the quarantine and action policies to one or more packets of the anomalous traffic flow ,in response to identifying the anomalous traffic flow; and based on the quarantine policy and the action policy, sending packets to an attack detector. ### Claim 2 (depends on 1) The method as in claim 1, wherein determining the quarantine policy for the anomalous traffic flow comprises: receiving, at the first device, the quarantine policy from the supervisory device, in response to reporting the anomalous traffic flow to the supervisory device. ### Claim 3 (depends on 1) The method as in claim 1, wherein applying the quarantine policy to the one or more packets of the anomalous traffic flow comprises: providing, by the first device, a copy of the one or more packets of the anomalous traffic flow to a device for further analysis. ### Claim 4 (depends on 1) The method as in claim 1, wherein applying the quarantine policy to the one or more packets of the anomalous traffic flow comprises: sampling, by the first device, the one or more packets of the anomalous traffic flow; and providing, by the first device, the one or more sampled packets to a quarantine device. ### Claim 5 (depends on 1) The method as in claim 1, wherein applying the quarantine policy to the one or more packets of the anomalous traffic flow comprises: rerouting, by the first device, the one or more packets of the anomalous traffic flow to a quarantine device. ### Claim 6 (depends on 1) The method as in claim 1, wherein applying the quarantine policy to the one or more packets of the anomalous traffic flow comprises: buffering, at the first device, the one or more packets of the anomalous traffic flow; and providing, by the first device, the buffered one or more packets of the anomalous traffic flow to a quarantine device. ### Claim 7 (depends on 1) The method as in claim 1, wherein applying the action policy to the one or more packets of the anomalous traffic flow comprises at least one of: flagging the one or more packets as anomalous, dropping the one or more packets, lowering a priority associated with the one or more packets, or applying traffic shaping to the one or more packets. ### Claim 8 (depends on 1) The method as in claim 1, further comprising: receiving, at the first device, packet tracking criteria from the supervisory device; and applying, by the first device, the quarantine and action policies to the one or more packets of the anomalous traffic flow and to at least one packet outside of the anomalous traffic flow, based on the packet tracking criteria. ### Claim 9 A method comprising: receiving, at a device in a network, an indication of an anomalous traffic flow detected by a node in the network using a machine-learning model; storing, by the device, packets of the anomalous traffic flow with metadata indicative of at least one of: the anomaly type, severity, a packet capture duration, or an indication as to whether the packets were captured proactively by the node; dynamically determining, by the device, an action policy for the anomalous traffic flow, based on an anomaly type or severity associated with the anomalous traffic flow; dynamically determining, by the device, a quarantine policy for the anomalous traffic flow, based on the anomaly type or severity associated with the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis; providing, by the device, the action and quarantine policies to the node, wherein the provided quarantine policy and action policy cause the node to proactively apply the quarantine and action policies to one or more packets of the anomalous traffic flow, in response to receiving the indication of anomalous traffic flow; and based on quarantine policy and action policy, sending packets to an attack detector. ### Claim 10 (depends on 9) The method as in claim 9, wherein the provided action policy causes the node to at least one of: flag one or more packets of the anomalous traffic flow as anomalous, drop the one or more packets of the anomalous traffic flow, or lower a priority associated with the one or more packets of the anomalous traffic flow. ### Claim 11 (depends on 9) The method as in claim 9, wherein the provided quarantine policy causes the node to at least one of: provide sampled copies of packets of the anomalous traffic flow to the device, provide copies of all packets of the anomalous traffic flow to the device, reroute packets of the anomalous traffic flow to the device. ### Claim 12 (depends on 9) The method as in claim 9, further comprising: providing, by the device, the indication of the anomalous traffic flow to a user interface; and receiving, at the device, the action and quarantine policies from the user interface, in response to providing the indication of the anomalous traffic flow to the user interface. ### Claim 13 (depends on 9) The method as in claim 9, further comprising: receiving, at the device, a query request for the packets of the anomalous traffic flow from a user interface; and providing, by the device, data regarding the packets to the user interface based on the query request. ### Claim 14 (depends on 13) The method as in claim 13, wherein the query request requests one of: a raw representation of all stored packets of the anomalous traffic flow, a subset of the stored packets that contain payloads, or a subset of the stored packets that are control packets. ### Claim 15 (depends on 13) The method as in claim 13, wherein the data regarding the packets includes data regarding at least one packet of the anomalous traffic flow captured in real time. ### Claim 16 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute a process; and a memory configured to store the process executable by the processor, the process when executed operable to: identify an anomalous traffic flow in the network using a machine-learning model; report the anomalous traffic flow to a supervisory device in the network; dynamically determine a quarantine policy for the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis; dynamically determine an action policy for the anomalous traffic flow, wherein the action policy corresponds to how and if the packets of the anomalous flow are handled within the network and is determined based on at least a severity of the anomaly associated with the anomalous flow, wherein the first device receives the action policy from the supervisory device, in response to reporting the anomalous traffic flow to the supervisory device; proactively apply the quarantine and action policies to one or more packets of the anomalous traffic flow, in response to identifying the anomalous traffic flow; and based on quarantine policy and action policy, sending packets to an attack detector. ### Claim 17 (depends on 16) The apparatus as in claim 16, wherein the apparatus applies the quarantine policy to the one or more packets of the anomalous traffic flow by at least one of: rerouting the one or more packets to a quarantine device in the network, providing a copy of the one or more packets to a device for further analysis, or providing a buffered set of packets of the anomalous traffic flow to the quarantine device. ### Claim 18 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute a process; and a memory configured to store the process executable by the processor, the process when executed operable to: receive an indication of an anomalous traffic flow detected by a node in the network using a machine-learning model; store packets of the anomalous traffic flow with metadata indicative of at least one of: the anomaly type, severity, a packet capture duration, or an indication as to whether the packets were captured proactively by the node; dynamically determine an action policy for the anomalous traffic flow, based on an anomaly type or severity associated with the anomalous traffic flow; dynamically determine a quarantine policy for the anomalous traffic flow, based on the anomaly type or severity associated with the anomalous traffic flow, wherein the quarantine policy corresponds to a methodology through which packets of the anomalous flow are captured for further analysis; provide the action and quarantine policies to the node, wherein the provided action policy and quarantine policy cause the node to proactively apply the action and quarantine policies to one or more packets of the anomalous traffic flow, in response to receiving the indication of anomalous traffic flow; and based on quarantine policy and action policy, sending packets to an attack detector. ### Claim 19 (depends on 18) The apparatus as in claim 18, wherein the provided action policy causes the node to at least one of: flag one or more packets of the anomalous traffic flow as anomalous, drop the one or more packets of the anomalous traffic flow, lower a priority associated with the one or more packets of the anomalous traffic flow, or apply traffic shaping to the anomalous traffic flow, and wherein the provided quarantine policy causes the node to at least one of: provide sampled copies of packets of the anomalous traffic flow to the device, provide copies of all packets of the anomalous traffic flow to the device, reroute packets of the anomalous traffic flow to the device. ### Claim 20 (depends on 18) The apparatus as in claim 18, wherein the process when executed is further operable to: receive a query request for the packets of the anomalous traffic flow from a user interface; and provide data regarding the packets to the user interface based on the query request, wherein the query request requests one of: a raw representation of all stored packets of the anomalous traffic flow, a subset of the stored packets that contain payloads, or a subset of the stored packets that are control packets.