Multi-level learning for classifying traffic flows on a first packet from DNS data

A method of selecting a network path for transmitting data across a network, the method comprising:

• intercepting, by a network appliance, a DNS response packet from a DNS server to a first computing device;
• extracting, by the network appliance, information from the DNS response packet, the extracted information comprising an IP address of the first computing device and a first proxy IP address for a first domain name;
• generating a first key representing the IP address of the first computing device and the first proxy IP address for the first domain name extracted from the DNS response packet;
• mapping the first key to the first domain name;
• receiving, at the network appliance, a first packet of a first flow to be transmitted across a network from the first computing device;
• extracting, by the network appliance, a source IP address and a destination IP address from a header of the first packet, the destination IP address in the first packet of the first flow from the first computing device being the same as the first proxy IP address for the first domain name;
• generating a second key representing the extracted information from the header of the first packet of the first flow from the first computing device;
• querying a data structure at the network appliance for a match to the second key;
• determining that the second key matches the first key present in the data structure at the network appliance;
• predicting an associated application name for the first flow based on the first domain name mapped to the matched first key;
• verifying that the predicted application in the data structure at the network appliance meets a predetermined confidence threshold;
• and
• selecting by the network appliance a network path based on the predicted application.

A system for inferring an application name for a first packet of a flow at a network appliance, the system comprising:

• a feature extraction engine at the network appliance configured to intercept a DNS response packet from a DNS server to a first computing device, extract from the DNS response packet an IP address of the first computing device and a first IP address for a first domain name, generate a first key representing the extracted information from the DNS response packet, map the first key to the first domain name, receive a first packet of a first flow from the first computing device to be transmitted across a network, extract the IP address of the first computing device and a destination IP address from a header of the first packet of the first flow received at the network appliance, generate a second key representing the extracted information from the header of the first packet;
• an inspection engine at the network appliance to query a data structure at the network appliance for a match to the second key, and determine whether the second key matches the first key present in the data structure;
• and
• an inference engine at the network appliance to infer an application name for the first packet based on the matched first key, the inference engine further in communication with the inspection engine.