Network traffic classification system
AssigneeRedberry Systems, Inc.
InventorsMadhavan Bakthavatchalam, Sandeep Khanna, Varadarajan Srinivasan
Life of this patent
Estimating the term…
Abstract
This disclosure provides systems, methods and apparatuses for classifying traffic flow using a plurality of learning machines arranged in multiple hierarchical levels. A first learning machine may classify a first portion of the input stream as malicious based on a match with first classification rules, and a second learning machine may classify at least part of the first portion of the input stream as malicious based on a match with second classification rules. The at least part of the first portion of the input stream may be classified as malicious based on the matches in the first and second learning machines.
Claims36
A method performed by a system including a plurality of learning machines, the method comprising:
- receiving an input stream in a first learning machine;
- classifying, in the first learning machine, a first portion of the input stream as malicious based on a match between the first portion of the input stream and a first set of classification rules and classifying a second portion of the input stream as benign based on an absence of a match between the second portion of the input stream and the first set of classification rules;
- providing, in response to the first learning machine classifying the first portion of the input stream as malicious, the first portion of the input stream from the first learning machine to a second learning machine;
- classifying, in the second learning machine, at least part of the first portion of the input stream as malicious based on a match between the at least part of the first portion of the input stream and a second set of classification rules;
- and
- determining that the at least part of the first portion of the input stream contains malware based on the match in the first learning machine and the match in the second learning machine.
A malware detection system, comprising:
- a first learning machine including an input to receive an input stream, the first learning machine configured to classify a first portion of the input stream as malicious based on a match between the first portion and a first set of classification rules and to classify a second portion of the input stream as benign based on an absence of a match between the second portion of the input stream and the first set of classification rules;
- a second learning machine including an input to receive the first portion of the input stream from the first learning machine in response to the first learning machine classifying the first portion of the input stream as malicious, the second learning machine configured to classify at least part of the first portion of the input stream as malicious based on a match between the at least part of the first portion and a second set of classification rules;
- and
- logic configured to determine that the at least part of the first portion of the input stream contains malware based on the match in the first learning machine and the match in the second learning machine.
Dependencies are inferred from the claim text.