# US 12,008,444 B2 · Unclassified traffic detection in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,444 B2 - Document ID: US12008444B2 - Status: Granted - Kind: B2 - Application number: 17/225,873 - Filed: 2021-04-08 - Published: 2021-12-23 - Granted: 2024-06-11 - Earliest claimed: 2020-06-19 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Priyanka Chandrashekar Bhat; Madhusoodhana Chari Sesha; Rashmi Vedi - Web page: https://patentgrep.com/patent/US12008444B2 ## CPC - G06N 20/00: Machine learning - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 18/23: Clustering techniques - G06F 18/23213: with fixed number of clusters, e.g. K-means clustering - G06F 18/24137: {Distances to cluster centroïds} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Examples include detection of unclassified traffic in a network. Some examples use an unsupervised machine learning mechanism for generating a first set of clusters of a first set of samples associated with a first set of time intervals, based at least in part on network traffic over a network, in a first predetermined period of time. Each sample associated with the respective time interval includes distribution of packets based on their packet lengths. In response to retrieving a second set of samples associated with a second set of time intervals, based at least in part on network traffic, a second set of clusters of the second set of samples is generated. It is determined whether one or more features of the second set of clusters vary as compared to one or more features of the first set of clusters of the first set of samples to detect unclassified traffic in the second set of samples. ## Claims ### Claim 1 A computer implemented method, comprising: retrieving, from a network device, a first set of samples associated with a first set of time intervals, based at least in part on network traffic over a network, for a first predetermined period of time, wherein each sample associated with a respective time interval comprises a distribution of packets based on packet lengths of the packets; generating, using an unsupervised machine learning mechanism, a first set of clusters of the first set of samples; determining a first one or more features from the first set of clusters; in response to retrieving a second set of samples associated with a second set of time intervals, based at least in part on the network traffic, for a second predetermined period of time, generating, using the unsupervised machine learning mechanism, a second set of clusters of the second set of samples; determining a second one or more features from the second set of clusters; determining whether the second one or more features determined from the second set of clusters vary as compared to the first one or more features determined from the first set of clusters to detect unclassified traffic in the network traffic; and upon detecting the unclassified traffic, performing a security action, wherein each sample of the first set of samples associated with the respective time interval comprises counts of packets having byte lengths for different packet byte length ranges. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein generating the first set of clusters of the first set of samples further comprises: deriving a set of training data for the unsupervised machine learning mechanism based on at least a portion of the first set of samples; and generating the first set of clusters of the first set of samples using the set of training data into the unsupervised machine learning mechanism. ### Claim 3 (depends on 1) The computer implemented method of claim 1, wherein the unsupervised machine learning mechanism comprises a k-means clustering algorithm and wherein generating the first set of clusters comprises performing, using the k-means clustering algorithm, k-means clustering of the first set of samples. ### Claim 4 (depends on 1) The computer implemented method of claim 1, wherein determining the first one or more features determined from the first set of clusters comprises determining a count of clusters, a position of centroid in each cluster or a distribution of samples in each cluster of the first set of clusters. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein determining whether the second one or more features determined from the second set of clusters vary as compared to the first one or more features determined from the first set of clusters comprises identifying variations in a count of clusters of the second set of clusters and a count of clusters of the first set of clusters, a position of a centroid of a cluster of the second set of clusters and a position of a centroid of a cluster in the first set of clusters or a distribution of samples in a cluster of the second set of clusters and a distribution of samples in a cluster of the first set of clusters. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: in response to periodically retrieving an additional set of samples associated with an additional set of time intervals, based at least in part on the network traffic over the network, for an additional predetermined period of time, generating, using the unsupervised machine learning mechanism, an additional set of clusters of the additional set of samples; and determining whether one or more features of the additional set of clusters vary as compared to the first one or more features determined from the first set of clusters to detect unclassified traffic in the network traffic. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the unclassified traffic comprises a potential security event occurred at the network. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein performing the security action comprises generating an alert. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein performing the security action comprises stopping the network traffic. ### Claim 10 A network device comprising: a processing circuitry; and a memory communicatively coupled to the processing circuitry and storing non-transitory machine-readable instructions that when executed cause the processing circuitry to: retrieve, from a network device, a first set of samples associated with a first set of time intervals, based at least in part on network traffic over a network, for a first predetermined period of time, wherein each sample associated with a respective time interval comprises a distribution of packets based on packet lengths of the packets; generate, using an unsupervised machine learning mechanism, a first set of clusters of the first set of samples; determine a first one or more features from the first set of clusters; in response to retrieving a second set of samples associated with a second set of time intervals, based at least in part on the network traffic, for a second predetermined period of time, generating, using the unsupervised machine learning mechanism, a second set of clusters of the second set of samples; determine a second one or more features from the second set of clusters; determine whether the second one or more features determined from the second set of clusters vary as compared to the first one or more features determined from the first set of clusters to detect unclassified traffic in the network traffic; and upon detecting the unclassified traffic, perform a security action, wherein each sample of the first set of samples associated with the respective time interval comprises counts of packets having byte lengths for different packet byte length ranges. ### Claim 11 (depends on 10) The network device of claim 10, wherein the instructions to generate the first set of clusters comprises instructions that cause the processing circuitry to: derive a set of training data for the unsupervised machine learning mechanism based on at least a portion of the first set of samples; and generate the first set of clusters of the first set of samples by inputting the set of training data into the unsupervised machine learning mechanism. ### Claim 12 (depends on 10) The network device of claim 10, wherein the unsupervised machine learning mechanism comprises a k-means clustering algorithm, and wherein the instructions to generate the first set of clusters comprises instructions that cause the processing circuitry to perform, using the k-means clustering algorithm, k-means clustering of the first set of samples. ### Claim 13 (depends on 10) The network device of claim 10, wherein each sample of the first set of samples associated with the respective time interval comprises counts of packets in different packet length ranges. ### Claim 14 (depends on 10) The network device of claim 10, wherein the instructions to determine the first one or more features from the first set of clusters comprises instructions that cause the processing circuitry to determine a count of clusters, a position of centroid in each cluster or a distribution of samples in each cluster of the first set of clusters. ### Claim 15 (depends on 14) The network device of claim 14, wherein the instructions to determine whether the second one or more features determined from the second set of clusters vary as compared to the first one or more features determined from of the first set of clusters comprises instructions that cause the processing circuitry to identify variations in a count of clusters of the second set of clusters and a count of clusters of the first set of clusters, a position of a centroid of a cluster of the second set of clusters and a position of a centroid of a cluster in the first set of clusters or a distribution of samples in a cluster of the second set of clusters and a distribution of samples in a cluster of the first set of clusters. ### Claim 16 (depends on 10) The network device of claim 10, wherein the instructions further comprise instructions that cause the processing circuitry to: in response to periodically retrieving an additional set of samples associated with an additional set of time intervals, based at least in part on the network traffic over the network, for an additional predetermined period of time, generate, using the unsupervised machine learning mechanism, an additional set of clusters of the additional set of samples; and determine whether one or more features of the additional set of clusters vary as compared to the first one or more features of the first set of clusters to detect unclassified traffic in the network traffic. ### Claim 17 (depends on 10) The network device of claim 10, wherein the instructions to perform the security action comprises instructions to generate an alert. ### Claim 18 (depends on 10) The network device of claim 10, wherein the instructions to perform the security action comprises instructions to stop the network traffic to a port of the network device. ### Claim 19 A non-transitory machine-readable storage medium comprising machine-readable instructions executable by a processing circuitry to cause the processing circuitry to: retrieve, from a network device, a first set of samples associated with a first set of time intervals, based at least in part on network traffic over a network, for a first predetermined period of time, wherein each sample associated with a respective time interval comprises a distribution of packets based on packet lengths of the packets; generate, using an unsupervised machine learning mechanism, a first set of clusters of the first set of samples; determine a first one or more features from the first set of clusters; in response to retrieving a second set of samples associated with a second set of time intervals, based at least in part on the network traffic, for a second predetermined period of time, generating, using the unsupervised machine learning mechanism, a second set of clusters of the second set of samples; and determine a second one or more features from the second set of clusters; determine whether the second one or more features determined from the second set of clusters vary as compared to the first one or more features determined from the first set of clusters to detect unclassified traffic in the network traffic, wherein each sample of the first set of samples associated with the respective time interval comprises counts of packets having byte lengths for different packet byte length ranges. ### Claim 20 (depends on 1) The computer implemented method of claim 1, wherein counting of packets having byte lengths within different packet byte length ranges comprises: determining a plurality of packet byte length ranges; and counting numbers of packets having byte lengths for each packet byte length range of the plurality of packet byte length ranges.