# US 10,771,394 B2 · Multi-level learning for classifying traffic flows on a first packet from DNS data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,394 B2 - Document ID: US10771394B2 - Status: Granted - Kind: B2 - Application number: 16/375,852 - Filed: 2019-04-04 - Published: 2019-07-25 - Granted: 2020-09-08 - Earliest claimed: 2017-02-06 - Assignees: Silver Peak Systems, Inc. - Applicants: Silver Peak Systems, Inc. - Inventors: David Anthony Hughes - Web page: https://patentgrep.com/patent/US10771394B2 ## CPC - H04L 43/026: using flow identification - G06N 20/00: Machine learning - H04L 41/147: for predicting network behaviour - H04L 41/16: using machine learning or artificial intelligence - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/16: Threshold monitoring - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 45/72: {Routing based on the source address} - H04L 45/74: Address processing for routing - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Disclosed herein are systems and methods for multi-level classification of data traffic flows based on information in a first packet for a data traffic flow. In exemplary embodiments of the present disclosure, a key can be generated from intercepted DNS data to track data traffic flows by application names and source and destination IP addresses. Based on these keys, patterns can be discerned to infer data traffic information based on only the information in a first packet, such as source and destination IP address. The determined patterns can be used to predict classifications of future traffic flows with similar key information. In this way, data traffic flows can be classified and steered in a network based on limited information available in a first packet. ## Claims ### Claim 1 A method of selecting a network path for transmitting data across a network, the method comprising: intercepting, by a network appliance, a DNS response packet from a DNS server to a first computing device; extracting, by the network appliance, information from the DNS response packet, the extracted information comprising an IP address of the first computing device and a first IP address for a first domain name; generating a first key representing the IP address of the first computing device and the first IP address for the first domain name extracted from the DNS response packet; mapping the first key to the first domain name; receiving, at the network appliance, a first packet of a first flow to be transmitted across a network from the first computing device; extracting, by the network appliance, the IP address of the first computing device and a destination IP address from a header of the first packet; generating a second key representing the extracted information from the header of the first packet of the first flow from the first computing device; querying a data structure at the network appliance for a match to the second key; determining that the second key matches the first key present in the data structure; predicting an associated application name for the first flow based on the first domain name mapped to the matched first key; verifying that the predicted application in the data structure at the network appliance meets a predetermined confidence threshold; and selecting by the network appliance a network path based on the predicted application. ### Claim 2 (depends on 1) The method of claim 1, wherein the first packet of the first flow is a TCP syn packet. ### Claim 3 (depends on 1) The method of claim 1, further comprising transmitting the first packet of the first flow by the network appliance via the selected network path. ### Claim 4 (depends on 1) The method of claim 1, further comprising: intercepting a second DNS response packet from the DNS server to the first computing device; extracting, by the network appliance, information from the second DNS response packet, the extracted information comprising the IP address of the first computing device and a second IP address for the first domain name; and updating the first key to represent the extracted information from the second DNS response packet. ### Claim 5 (depends on 1) The method of claim 1, further comprising: intercepting a second DNS response packet from the DNS server to the first computing device; extracting, by the network appliance, information from the second DNS response packet, the extracted information comprising the IP address of the first computing device, a first IP address, and a second domain name, wherein the first IP address corresponds to the second domain name; and updating the first key to represent the extracted information from the second DNS response packet. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving, at the network appliance, a first packet of a first flow to be transmitted across the network from a second computing device; extracting, by the network appliance, an IP address of the second computing device and a destination IP address from a header of the first packet of the first flow from the second computing device; generating a third key representing the extracted information from the header of the first packet of the first flow from the second computing device; querying a data structure at the network appliance for a match to the third key; determining that the third key matches a first IP address associated with a second domain name, the second domain name being different from the first domain name associated with the first IP address; and predicting an associated application name for the first flow from the second computing device based on the second domain name associated with the matched third key, the associated application name for the first flow from the second computing device being different than the associated application name for the first flow from the first computing device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving a subsequent data packet of the first flow; determining an application name from payload information of the subsequent data packet of the first flow; verifying that the predicted application based on the first packet was correct; and updating confidence information in the data structure for the key associated with the extracted information from the header of the first packet, wherein the confidence information comprises a counter. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving a subsequent data packet of the first flow; determining an application name from payload information of the subsequent data packet of the first flow; determining that the predicted application based on the first packet was incorrect; and updating confidence information in the data structure for the key associated with the extracted information from the header of the first packet. ### Claim 9 (depends on 1) The method of claim 1, further comprising transforming the extracted information from the header of the first packet prior to generating the second key. ### Claim 10 (depends on 1) The method of claim 1, further comprising transforming the generated second key. ### Claim 11 (depends on 1) The method of claim 1, further comprising: performing network address translation based on the selected network path to change at least one of a source network address, destination network address, destination port, and a source port in packets of the first flow. ### Claim 12 A method of selecting a network path for transmitting data across a network, the method comprising: intercepting, by a network appliance, a DNS response packet from a DNS server to a first computing device; extracting, by the network appliance, information from the DNS response packet, the extracted information comprising an IP address of the first computing device and a first proxy IP address for a first domain name; generating a first key representing the IP address of the first computing device and the first proxy IP address for the first domain name extracted from the DNS response packet; mapping the first key to the first domain name; receiving, at the network appliance, a first packet of a first flow to be transmitted across a network from the first computing device; extracting, by the network appliance, a source IP address and a destination IP address from a header of the first packet, the destination IP address in the first packet of the first flow from the first computing device being the same as the first proxy IP address for the first domain name; generating a second key representing the extracted information from the header of the first packet of the first flow from the first computing device; querying a data structure at the network appliance for a match to the second key; determining that the second key matches the first key present in the data structure at the network appliance; predicting an associated application name for the first flow based on the first domain name mapped to the matched first key; verifying that the predicted application in the data structure at the network appliance meets a predetermined confidence threshold; and selecting by the network appliance a network path based on the predicted application. ### Claim 13 (depends on 12) The method of claim 12, further comprising: transmitting the first packet of the first flow by the network appliance, via the selected network path. ### Claim 14 (depends on 12) The method of claim 12, further comprising: intercepting a second DNS response from the DNS server to the first computing device; extracting, by the network appliance, information from the second DNS response packet, the extracted information comprising the IP address of the first computing device, the first proxy IP address, and a second domain name, wherein the first proxy IP address corresponds to the second domain name; and updating the first key to represent the extracted information from the second DNS response packet. ### Claim 15 (depends on 12) The method of claim 12, wherein the confidence threshold is variable. ### Claim 16 (depends on 12) The method of claim 12, further comprising: receiving a subsequent data packet of the first flow; determining an application name from payload information of the subsequent data packet of the first flow; verifying that the predicted application name based on the first packet was correct; and updating confidence information in the data structure for the key associated with the extracted information from the header of the first packet. ### Claim 17 (depends on 12) The method of claim 12, further comprising: receiving a subsequent data packet of the first flow; determining an application name from payload information of the subsequent data packet of the first flow; determining that the predicted application name based on the first packet was incorrect; and updating confidence information in the data structure for the key associated with the extracted information from the header of the first packet. ### Claim 18 A system for inferring an application name for a first packet of a flow at a network appliance, the system comprising: a feature extraction engine at the network appliance configured to intercept a DNS response packet from a DNS server to a first computing device, extract from the DNS response packet an IP address of the first computing device and a first IP address for a first domain name, generate a first key representing the extracted information from the DNS response packet, map the first key to the first domain name, receive a first packet of a first flow from the first computing device to be transmitted across a network, extract the IP address of the first computing device and a destination IP address from a header of the first packet of the first flow received at the network appliance, generate a second key representing the extracted information from the header of the first packet; an inspection engine at the network appliance to query a data structure at the network appliance for a match to the second key, and determine whether the second key matches the first key present in the data structure; and an inference engine at the network appliance to infer an application name for the first packet based on the matched first key, the inference engine further in communication with the inspection engine. ### Claim 19 (depends on 18) The system of claim 18, wherein the inference engine uses a learning algorithm of a neural network to infer the application for the first packet. ### Claim 20 (depends on 18) The system of claim 18, wherein at least one of a plurality of data structures further comprises one or more application tags associated with the inferred application name and key string. ### Claim 21 (depends on 18) The system of claim 18, wherein the inspection engine further determines whether the extracted information is indicative of a known application name with a predetermined level of confidence.