Cascade-based classification of network devices using multi-scale bags of network words

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more operations;
• and
• a memory configured to store a process that is executable by the processor, the process when executed configured to:
• train, using feature vectors that represent how frequently one or more traffic features were observed in a network during different time windows among a plurality of time windows, a cascade of machine learning classifiers to label one or more devices in the network with a device type;
• receive traffic features of traffic associated with a particular device in the network;
• use the cascade of machine learning classifiers to assign a device type label to the particular device based on the traffic features of the traffic associated with the particular device;
• and
• initiate, based on the device type label assigned to the particular device, enforcement of a network policy regarding the particular device.

A tangible, non-transitory, computer-readable medium that stores program instructions that cause a device classification service to execute a process comprising:

• training, by the device classification service and using feature vectors that represent how frequently one or more traffic features were observed in a network during different time windows among a plurality of time windows, a cascade of machine learning classifiers to label one or more devices in the network with a device type;
• receiving, at the device classification service, traffic features of traffic associated with a particular device in the network;
• using, by the device classification service, the cascade of machine learning classifiers to assign a device type label to the particular device based on the traffic features of the traffic associated with the particular device;
• and
• initiating, by the device classification service and based on the device type label assigned to the particular device, enforcement of a network policy regarding the particular device.