Adapting classifier parameters for improved network traffic classification using distinct private training data sets

An apparatus, comprising:

• one or more network interfaces to communicate with a first network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive traffic flow information regarding a plurality of traffic flows in the first network;
• label the traffic flow information by associating classifier labels to the traffic flow information;
• receive a generic traffic classifier from a central device outside of the first network, wherein the generic traffic classifier was trained on the central device using a training data set that comprises labeled traffic flow information for a plurality of other networks and excludes the traffic flow information regarding the plurality of traffic flows in the first network where the device is located;
• acclimate the generic traffic classifier to the first network using the labeled traffic flow information, wherein acclimating includes adapting the generic classifier to be used in the first network by leveraging the labeled traffic flow information, the labeled traffic flow information comprising a second training data set that is from the first network and is not shared with the central device or the plurality of other networks;
• and
• use the acclimated generic traffic classifier to classify a traffic flow in the first network.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a first network to execute a process comprising:

• receiving, at the device, traffic flow information regarding a plurality of traffic flows in the first network;
• labeling, by the device, the traffic flow information by associating classifier labels to the traffic flow information;
• receiving, at the device, a generic traffic classifier from a central device outside of the first network, wherein the generic traffic classifier was trained on the central device using a training data set that comprises labeled traffic flow information for a plurality of other networks and excludes the traffic flow information regarding the plurality of traffic flows in the first network where the device is located;
• acclimating, by the device, the generic traffic classifier to the first network using the labeled traffic flow information, wherein acclimating includes adapting the generic classifier to be used in the first network by leveraging the labeled traffic flow information, the labeled traffic flow information comprising a second training data set that is from the first network and is not shared with the central device or the plurality of other networks;
• and
• using, by the device, the acclimated generic traffic classifier to classify a traffic flow in the first network.