Network traffic identification using machine learning
AssigneeZscaler, Inc.
InventorsAlexander Frazier, Dianhuan Lin, Amir Levy, Amanda Carter, Piyush Gour
Life of this patent
Estimating the term…
Abstract
Systems and methods include obtaining historical data of traffic for a plurality of locations for a cloud service; labeling the historical data as one of human and server based on a plurality of features; and utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server. The steps can further include utilizing the trained machine learning model to classify unauthenticated traffic, for the cloud service, from a specific location or a specific IP address.
Claims20
A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
- obtaining historical data of traffic for a plurality of locations for a cloud service;
- labeling the historical data as one of human and server based on a plurality of features;
- utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server;
- monitoring traffic and labeling the monitored traffic as originating from any of authenticated users and unauthenticated locations, wherein the traffic is labeled as originating from an unauthenticated location based on the traffic being tunneled via a tunnel originating from a location, the tunnel including all traffic from the location and not identifying each user or server within the location;
- and
- utilizing the trained machine learning model to classify traffic originating from the unauthenticated locations, wherein the traffic originating from the unauthenticated locations is given a server score.
A method comprising the steps of:
- obtaining historical data of traffic for a plurality of locations for a cloud service;
- labeling the historical data as one of human and server based on a plurality of features;
- utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server;
- monitoring traffic and labeling the monitored traffic as originating from any of authenticated users and unauthenticated locations, wherein the traffic is labeled as originating from an unauthenticated location based on the traffic being tunneled via a tunnel originating from a location, the tunnel including all traffic from the location and not identifying each user or server within the location;
- and
- utilizing the trained machine learning model to classify traffic originating from the unauthenticated locations, wherein the traffic originating from the unauthenticated locations is given a server score.
Dependencies are inferred from the claim text.