On-box behavior-based traffic classification
AssigneeCisco Technology, Inc.
InventorsMichael Joseph Stepanek, Costas Kleopa, David McGrew, Blake Harrell Anderson, Saravanan Radhakrishnan
Life of this patent
Estimating the term…
Abstract
In one embodiment, a networking device in a network detects an traffic flow conveyed in the network via the networking device. The networking device generates flow data for the traffic flow. The networking device performs a classification of the traffic flow using the flow data as input to a machine learning-based classifier. The networking device performs a mediation action based on the classification of the traffic flow.
Claims27
A method comprising:
- proxying, at a networking device in a network, an encrypted connection between first and second endpoints, wherein the encrypted connection comprises a traffic flow conveyed in the network via the networking device, wherein the traffic flow is encrypted;
- generating, by the networking device, behavioral flow data for the traffic flow;
- performing, by the networking device, a classification of the traffic flow using the behavioral flow data as an input to a classifier that includes one or more classifier parameters generated using machine learning;
- and
- performing a first mediation action based upon the classification of the traffic flow, wherein the first mediation action comprises:
- decrypting the traffic flow, and
- evaluating whether the decrypted traffic flow is related to malware.
An apparatus comprising:
- one or more network interfaces to communicate with a network;
- a processor coupled to the one or more network interfaces and configured to execute one or more processes;
- and
- a memory configured to store a process executable by the processor, the process when executed operable to:
- proxy an encrypted connection between first and second endpoints, wherein the encrypted connection comprises a traffic flow conveyed in the network via a networking device, wherein the traffic flow is encrypted;
- generate behavioral flow data for the traffic flow;
- perform a classification of the traffic flow using the behavioral flow data as an input to a classifier that includes one or more classifier parameters generated using machine learning;
- and
- perform a first mediation action based upon the classification of the traffic flow, wherein the first mediation action comprises:
- decrypting the traffic flow, and
- evaluate whether the decrypted traffic flow is related to malware.
A tangible, non-transitory, computer-readable medium that stores program instructions causing a networking device in a network to execute a process comprising:
- proxying, at the networking device, an encrypted connection between first and second endpoints, wherein the encrypted connection comprises a traffic flow conveyed in the network via the networking device, wherein the traffic flow is encrypted;
- generating, by the networking device, behavioral flow data for the traffic flow;
- performing, by the networking device, a classification of the traffic flow using the behavioral flow data as an input to a classifier that includes one or more classifier parameters generated using machine learning;
- and
- performing a first mediation action based upon the classification of the traffic flow, wherein the first mediation action comprises:
- decrypting the traffic flow, and
- evaluating whether the decrypted traffic flow is related to malware.
Dependencies are inferred from the claim text.