# US 12,192,076 B2 · Network traffic identification using machine learning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,076 B2 - Document ID: US12192076B2 - Status: Granted - Kind: B2 - Application number: 17/567,310 - Filed: 2022-01-03 - Published: 2023-05-18 - Granted: 2025-01-07 - Earliest claimed: 2021-11-18 - Assignees: Zscaler, Inc. - Applicants: Zscaler, Inc. - Inventors: Alexander Frazier; Dianhuan Lin; Amir Levy; Amanda Carter; Piyush Gour - Web page: https://patentgrep.com/patent/US12192076B2 ## CPC - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 41/16: using machine learning or artificial intelligence - H04L 43/062: related to network traffic - H04L 47/2483: involving identification of individual flows - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods include obtaining historical data of traffic for a plurality of locations for a cloud service; labeling the historical data as one of human and server based on a plurality of features; and utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server. The steps can further include utilizing the trained machine learning model to classify unauthenticated traffic, for the cloud service, from a specific location or a specific IP address. ## Claims ### Claim 1 A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of: obtaining historical data of traffic for a plurality of locations for a cloud service; labeling the historical data as one of human and server based on a plurality of features; utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server; monitoring traffic and labeling the monitored traffic as originating from any of authenticated users and unauthenticated locations, wherein the traffic is labeled as originating from an unauthenticated location based on the traffic being tunneled via a tunnel originating from a location, the tunnel including all traffic from the location and not identifying each user or server within the location; and utilizing the trained machine learning model to classify traffic originating from the unauthenticated locations, wherein the traffic originating from the unauthenticated locations is given a server score. ### Claim 2 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the steps include utilizing the trained machine learning model to assign a server score to a specific location of the plurality of locations; and responsive to the specific location being assigned an intermediate server score from the trained machine learning model, utilizing the machine learning model to perform a more granular analysis comprising analyzing individual Internet Protocol (IP) addresses associated with the specific location. ### Claim 3 (depends on 2) The non-transitory computer-readable storage medium of claim 2, wherein the trained machine learning model classifies the traffic labeled as originating from unauthenticated locations as a split between human and server for an entire location. ### Claim 4 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the plurality of features include social networking traffic being labeled as human. ### Claim 5 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the plurality of features include daily activity with activity around a day being labeled as server and activity within business hours being labeled as human. ### Claim 6 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the plurality of features include number of days active with activity every day being labeled as server and activity only during business days being labeled as human. ### Claim 7 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the plurality of features include number of unique hostnames visited by the traffic where less unique hostnames are labeled as server and more unique hostnames are labeled as human. ### Claim 8 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the plurality of features include distinct applications visited by the traffic where traffic visiting less distinct applications are labeled as server and traffic visiting more distinct applications are labeled as human. ### Claim 9 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the machine learning model utilizes Gradient-boosted decision trees. ### Claim 10 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the steps include utilizing the trained machine learning model to assign a server score to one or more specific IP addresses associated with a location of the plurality of locations. ### Claim 11 A method comprising the steps of: obtaining historical data of traffic for a plurality of locations for a cloud service; labeling the historical data as one of human and server based on a plurality of features; utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server; monitoring traffic and labeling the monitored traffic as originating from any of authenticated users and unauthenticated locations, wherein the traffic is labeled as originating from an unauthenticated location based on the traffic being tunneled via a tunnel originating from a location, the tunnel including all traffic from the location and not identifying each user or server within the location; and utilizing the trained machine learning model to classify traffic originating from the unauthenticated locations, wherein the traffic originating from the unauthenticated locations is given a server score. ### Claim 12 (depends on 11) The method of claim 11, wherein the steps include utilizing the trained machine learning model to assign a server score to a specific location of the plurality of locations; and responsive to the specific location being assigned an intermediate server score from the trained machine learning model, utilizing the machine learning model to perform a more granular analysis comprising analyzing individual Internet Protocol (IP) addresses associated with the specific location. ### Claim 13 (depends on 12) The method of claim 12, wherein the trained machine learning model classifies the traffic labeled as originating from unauthenticated locations as a split between human and server for an entire location. ### Claim 14 (depends on 11) The method of claim 11, wherein the plurality of features include social networking traffic being labeled as human. ### Claim 15 (depends on 11) The method of claim 11, wherein the plurality of features include daily activity with activity around a day being labeled as server and activity within business hours being labeled as human. ### Claim 16 (depends on 11) The method of claim 11, wherein the plurality of features include number of days active with activity every day being labeled as server and activity only during business days being labeled as human. ### Claim 17 (depends on 11) The method of claim 11, wherein the plurality of features include number of unique hostnames visited by the traffic where less unique hostnames are labeled as server and more unique hostnames are labeled as human. ### Claim 18 (depends on 11) The method of claim 11, wherein the plurality of features include distinct applications visited by the traffic where traffic visiting less distinct applications are labeled as server and traffic visiting more distinct applications are labeled as human. ### Claim 19 (depends on 11) The method of claim 11, wherein the machine learning model utilizes Gradient-boosted decision trees. ### Claim 20 (depends on 11) The method of claim 11, wherein the steps include utilizing the trained machine learning model to assign a server score to one or more specific IP addresses associated with a location of the plurality of locations.