Back to results
US 2014/0373148 A1Published application
Systems and methods for traffic classification
AssigneeDamballa, Inc.
InventorsTerry Lee NELMS, Andrew HOBSON, Joseph WARD
Life of this patent
Estimating the term…
Abstract
Systems and methods of classifying network traffic may monitor network traffic. Monitored traffic may be compared with a control protocol template (CPT). When a similarity between the monitored traffic and the CPT exceeds a match threshold, the monitored traffic may be associated with the CPT.
Claims56
A method of classifying network traffic comprising:
- performing processing associated with monitoring, with a domain identification module in communication with a processor circuit and a network, network traffic;
- performing processing associated with comparing, with a traffic classification module in communication with the processor circuit and the domain identification module, the network traffic with a control protocol template (CPT) stored in a database in communication with the domain identification module and the processor circuit;
- when a similarity between the monitored traffic and the CPT exceeds a match threshold, performing processing associated with associating, with the domain identification module, the monitored traffic with the CPT;
- and
- when the similarity between the monitored traffic and the CPT does not exceed the match threshold, performing processing associated with identifying, with the traffic classification module, the monitored traffic as having an unknown classification.
2 more elements
A method of classifying network traffic comprising:
- performing processing associated with monitoring, with a traffic classification module in communication with a processor circuit and a network, network traffic;
- performing processing associated with determining, with the traffic classification module, data indicating a uniqueness for at least one component of the network traffic;
- and
- performing processing associated with generating, with the traffic classification module, a match threshold associated with the at least one component of the network traffic, wherein a match threshold associated with one of the at least one components of the network traffic having a relatively high uniqueness is higher than a match threshold associated with one of the at least one components of the network traffic having a relatively low uniqueness.
1 more element
A method of comparing network traffic comprising:
- performing processing associated with comparing, with a malicious traffic comparison module in communication with a processor circuit and a network, malicious traffic of interest with historical malicious traffic data;
- performing processing associated with generating, with the malicious traffic comparison module, a report comprising the results of the comparison;
- and
- performing processing associated with identifying, with the malicious traffic comparison module, a binary associated with the historical malicious traffic data.
1 more element
A system for classifying network traffic comprising:
- a processor circuit;
- a database;
- a traffic classification module in communication with the processor circuit and a network and configured to:
- compare network traffic with a CPT stored in the database;
- perform processing associated with monitoring the network traffic;
- when a similarity between the monitored traffic and the CPT exceeds a match threshold, perform processing associated with associating the monitored traffic with the CPT;
- and
- when the similarity between the monitored traffic and the CPT does not exceed the match threshold, perform processing associated with identifying the monitored traffic as having an unknown classification.
5 more elements
A system for classifying network traffic comprising:
- a processor circuit;
- and
- a traffic classification module in communication with the processor circuit and a network, the traffic classification module being configured to:
- perform processing associated with monitoring network traffic;
- perform processing associated with determining data indicating a uniqueness for at least one component of the network traffic;
- and
- perform processing associated with generating a match threshold associated with the at least one component of the network traffic, wherein a match threshold associated with one of the at least one components of the network traffic having a relatively uniqueness is higher than a match threshold associated with one of the at least one components of the network traffic having a relatively low uniqueness.
4 more elements
A system for comparing network traffic comprising:
- a processor circuit;
- and
- a malicious traffic comparison module in communication with the processor circuit and a network, the malicious traffic comparison module being configured to:
- perform processing associated with comparing malicious traffic of interest with historical malicious traffic data;
- perform processing associated with generating a report comprising the results of the comparison;
- and
- perform processing associated with identifying a binary associated with the historical malicious traffic data.
4 more elements
Dependencies are inferred from the claim text.