# US 11,310,205 B2 · Detecting evasive network behaviors using machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,205 B2 - Document ID: US11310205B2 - Status: Granted - Kind: B2 - Application number: 16/288,628 - Filed: 2019-02-28 - Published: 2020-09-03 - Granted: 2022-04-19 - Earliest claimed: 2019-02-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Constantinos Kleopa; Michael Joseph Stepanek; Silviu Dorin Minut; Carter Ryan Waxman - Web page: https://patentgrep.com/patent/US11310205B2 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - G06N 20/00: Machine learning - H04L 41/16: using machine learning or artificial intelligence - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2475: for supporting traffic characterised by the type of applications - H04L 47/2483: involving identification of individual flows - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1458: {Denial of Service} - H04L 43/026: using flow identification - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract In one embodiment, a traffic analysis service identifies a client in a network having an associated traffic flow that was blocked by a firewall. The traffic analysis service obtains traffic telemetry data regarding one or more subsequent traffic flows associated with the identified client that are subsequent to the blocked flow. The traffic analysis service uses a machine learning-based classifier to determine that the identified client is exhibiting evasive network behavior, based on the obtained traffic telemetry data. The traffic analysis service initiates a mitigation action in the network, based on the determination that the identified client is exhibiting evasive network behavior. ## Claims ### Claim 1 A method comprising: identifying, by a traffic analysis service, a client in a network having an associated traffic flow that was blocked by a firewall; obtaining, by the traffic analysis service, traffic telemetry data regarding one or more subsequent traffic flows associated with the identified client that are subsequent to the blocked flow; using, by the traffic analysis service, a machine learning-based classifier to determine that the identified client is exhibiting evasive network behavior, based on the obtained traffic telemetry data; and initiating, by the traffic analysis service, a mitigation action in the network, based on the determination that the identified client is exhibiting evasive network behavior. ### Claim 2 (depends on 1) The method as in claim 1, wherein the mitigation action comprises one of: blocking network traffic associated with the client or sending an alert regarding the evasive network behavior to a user interface. ### Claim 3 (depends on 1) The method as in claim 1, wherein identifying the client in the network comprises: receiving a notification from the firewall that the traffic flow associated with the client was blocked by the firewall. ### Claim 4 (depends on 1) The method as in claim 1, wherein the traffic telemetry data is indicative of a change of destination addresses or ports of the one or more subsequent traffic flows from that of the blocked flow. ### Claim 5 (depends on 1) The method as in claim 1, further comprising: training, by the traffic analysis service, the machine learning-based classifier using a training dataset comprising telemetry data regarding traffic flows generated by malware. ### Claim 6 (depends on 1) The method as in claim 1, wherein the traffic telemetry data is indicative of a change of traffic protocol of the one or more subsequent traffic flows from that of the blocked flow. ### Claim 7 (depends on 6) The method as in claim 6, wherein the traffic telemetry data is further indicative of a time span associated with the change of protocol. ### Claim 8 (depends on 6) The method as in claim 6, wherein the traffic protocol of the one or more subsequent traffic flows is one of: the HyperText Transfer Protocol (HTTP), the HTTP Secure (HTTPS) protocol, the Secure Shell (SSH) protocol, or the Network Time Protocol (NTP). ### Claim 9 (depends on 1) The method as in claim 1, wherein the traffic telemetry data is further indicative of a protocol field used by the one or more subsequent traffic flows. ### Claim 10 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: identify a client in a network having an associated traffic flow that was blocked by a firewall; obtain traffic telemetry data regarding one or more subsequent traffic flows associated with the identified client that are subsequent to the blocked flow; use a machine learning-based classifier to determine that the identified client is exhibiting evasive network behavior, based on the obtained traffic telemetry data; and initiate a mitigation action in the network, based on the determination that the identified client is exhibiting evasive network behavior. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein the mitigation action comprises one of: blocking network traffic associated with the client or sending an alert regarding the evasive network behavior to a user interface. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein identifying the client in the network comprises: receiving a notification from the firewall that the traffic flow associated with the client was blocked by the firewall. ### Claim 13 (depends on 10) The apparatus as in claim 10, wherein the traffic telemetry data is indicative of a change of destination addresses or ports of the one or more subsequent traffic flows from that of the blocked flow. ### Claim 14 (depends on 10) The apparatus as in claim 10, wherein process when executed is further configured to: train the machine learning-based classifier using a training dataset comprising telemetry data regarding traffic flows generated by malware. ### Claim 15 (depends on 10) The apparatus as in claim 10, wherein the traffic telemetry data is indicative of a change of traffic protocol of the one or more subsequent traffic flows from that of the blocked flow. ### Claim 16 (depends on 15) The apparatus as in claim 15, wherein the traffic telemetry data is further indicative of a time span associated with the change of protocol. ### Claim 17 (depends on 15) The apparatus as in claim 15, wherein the traffic protocol of the one or more subsequent traffic flows is one of: the HyperText Transfer Protocol (HTTP), the HTTP Secure (HTTPS) protocol, the Secure Shell (SSH) protocol, or the Network Time Protocol (NTP). ### Claim 18 (depends on 15) The apparatus as in claim 15, wherein the traffic telemetry data is further indicative of a protocol field used by the one or more subsequent traffic flows. ### Claim 19 A tangible, non-transitory, computer-readable medium storing program instructions that cause a traffic analysis service in a network to execute a process comprising: identifying, by a traffic analysis service, a client in a network having an associated traffic flow that was blocked by a firewall; obtaining, by the traffic analysis service, traffic telemetry data regarding one or more subsequent traffic flows associated with the identified client that are subsequent to the blocked flow; using, by the traffic analysis service, a machine learning-based classifier to determine that the identified client is exhibiting evasive network behavior, based on the obtained traffic telemetry data; and initiating, by the traffic analysis service, a mitigation action in the network, based on the determination that the identified client is exhibiting evasive network behavior. ### Claim 20 (depends on 19) The computer-readable medium as in claim 19, wherein the traffic telemetry data is indicative of a change of traffic protocol of the one or more subsequent traffic flows from that of the blocked flow.