Network traffic pattern based machine readable instruction identification
AssigneeTrend Micro Incorporated
InventorsVaibhav Chhabra, Josiah Dede Hagen, Brandon Niemczyk
Life of this patent
Estimating the term…
Abstract
According to an example, network traffic pattern based identification may include analyzing each packet of a plurality of packets that are outgoing from and/or incoming to an entity to respectively determine features within a sequence of outgoing packets and/or a sequence of incoming packets of the plurality of packets. Network traffic pattern based identification may further include analyzing the determined features by respectively using an outgoing packet classification model and/or an incoming packet classification model, and classifying, based on the analysis of the features.
Claims11
A method for network traffic pattern based machine readable instruction identification, the method comprising:
- analyzing, by a computer system comprising a physical processor, each packet of a plurality of packets that are at least one of outgoing from and incoming to an entity to respectively determine features within at least one of a sequence of outgoing packets and a sequence of incoming packets of the plurality of packets;
- analyzing, by the computer system comprising the physical processor, the determined features by respectively using at least one of an outgoing packet classification model and an incoming packet classification model;
- classifying, by the computer system comprising the physical processor, based on transitions of values of the determined features within at least one of the sequence of outgoing packets and the sequence of incoming packets of the plurality of packets and based on probabilities that the determined features will transition from one particular value to another particular value, a set of machine readable instructions that is associated with the determined features as a type of machine readable instructions from a plurality of types of machine readable instructions;
- and
- determining, based on the classification of the set of machine readable instructions, whether to implement corrective measures related to the set of machine readable instructions.
A network traffic pattern based application identification system comprising:
- at least one processor;
- and
- a memory storing machine readable instructions that when executed by the at least one processor cause the at least one processor to:
- analyze each packet of a plurality of packets that are at least one of outgoing from and incoming to an entity to respectively detect transitions of communication protocols from one particular communication protocol to another particular communication protocol within at least one of a sequence of outgoing packets and a sequence of incoming packets of the plurality of packets;
- analyze the detected transitions of the communication protocols by respectively using at least one of an outgoing packet classification model and an incoming packet classification model to determine a probability for each transition of the detected transitions of the communication protocols;
- classify, based on the determined probability for each transition of the detected transitions of the communication protocols, an application that is associated with the detected transitions of the communication protocols as a type of application from a plurality of types of applications that include an authorized application and an unauthorized application;
- and
- determine, based on the classification of the application, whether to implement corrective measures related to the application.
A non-transitory computer readable medium having stored thereon machine readable instructions to provide network traffic pattern based application identification, the machine readable instructions, when executed, cause at least one processor to:
- analyze each packet of a plurality of packets that are at least one of outgoing from and incoming to an entity to respectively detect transitions of communication protocols from one particular communication protocol to another particular communication protocol within at least one of a sequence of outgoing packets and a sequence of incoming packets of the plurality of packets;
- analyze the detected transitions of the communication protocols by respectively using at least one of an outgoing packet classification model and an incoming packet classification model to determine a probability for each transition of the detected transitions of the communication protocols;
- classify, based on the determined probability for each transition of the detected transitions of the communication protocols, an application that is associated with the detected transitions of the communication protocols as a type of application from a plurality of types of applications that include an authorized application and an unauthorized application;
- and
- determine, based on the classification of the application, whether to implement corrective measures related to the application.
Dependencies are inferred from the claim text.