Detecting evasive network behaviors using machine learning

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• identify a client in a network having an associated traffic flow that was blocked by a firewall;
• obtain traffic telemetry data regarding one or more subsequent traffic flows associated with the identified client that are subsequent to the blocked flow;
• use a machine learning-based classifier to determine that the identified client is exhibiting evasive network behavior, based on the obtained traffic telemetry data;
• and
• initiate a mitigation action in the network, based on the determination that the identified client is exhibiting evasive network behavior.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a traffic analysis service in a network to execute a process comprising:

• identifying, by a traffic analysis service, a client in a network having an associated traffic flow that was blocked by a firewall;
• obtaining, by the traffic analysis service, traffic telemetry data regarding one or more subsequent traffic flows associated with the identified client that are subsequent to the blocked flow;
• using, by the traffic analysis service, a machine learning-based classifier to determine that the identified client is exhibiting evasive network behavior, based on the obtained traffic telemetry data;
• and
• initiating, by the traffic analysis service, a mitigation action in the network, based on the determination that the identified client is exhibiting evasive network behavior.