# US 2018/0323898 A1 · Performing upper layer inspection of a flow based on a sampling rate > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0323898 A1 - Document ID: US20180323898A1 - Status: Published application - Kind: A1 - Application number: 15/584,625 - Filed: 2017-05-02 - Published: 2018-11-08 - Earliest claimed: 2017-05-02 - Assignees: Juniper Networks, Inc. - Applicants: Juniper Networks, Inc. - Inventors: Craig DODS - Web page: https://patentgrep.com/patent/US20180323898A1 ## CPC - H04L 1/002: {Algorithms with memory of the previous states, e.g. Markovian models} - H04L 47/127: by using congestion prediction - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 47/125: by balancing the load, e.g. traffic engineering - H04W 24/02: Arrangements for optimising operational condition - H04W 40/18: based on predicted events - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A device may receive a first portion of network traffic associated with a flow. The device may perform a first upper layer inspection of the first portion of network traffic associated with the flow. The device may identify a set of parameters of the flow based on performing the first upper layer inspection of the first portion of network traffic associated with the flow. The device may determine, based on the set of parameters, a sampling rate at which to perform a second upper layer inspection of a second portion of network traffic associated with the flow. The device may instruct a lower layer to use the sampling rate to provide the second portion of network traffic associated with the flow for the second upper layer inspection. The device may perform the second upper layer inspection of the second portion of network traffic associated with the flow based on receiving the second portion of network traffic associated with the flow from the lower layer. The device may perform an action with regard to the flow based on a result of performing the second upper layer inspection. ## Claims ### Claim 1 A device, comprising: one or more processors to: receive a first portion of network traffic associated with a flow; perform a first upper layer inspection of the first portion of network traffic associated with the flow; identify a set of parameters of the flow based on performing the first upper layer inspection of the first portion of network traffic associated with the flow; determine, based on the set of parameters, a sampling rate at which to perform a second upper layer inspection of a second portion of network traffic associated with the flow; instruct a lower layer to use the sampling rate to provide the second portion of network traffic associated with the flow for the second upper layer inspection; perform the second upper layer inspection of the second portion of network traffic associated with the flow based on receiving the second portion of network traffic associated with the flow from the lower layer; and perform an action with regard to the flow based on a result of performing the second upper layer inspection. ### Claim 2 (depends on 1) The device of claim 1, where the one or more processors are further to: identify an upper layer application associated with the flow after performing the first upper layer inspection of the first portion of network traffic associated with the flow; and where the one or more processors, when determining the sampling rate, are to: determine the sampling rate based on the upper layer application. ### Claim 3 (depends on 1) The device of claim 1, where the one or more processors are further to: identify an upper layer protocol associated with the flow after performing the first upper layer inspection of the first portion of network traffic associated with the flow; and where the one or more processors, when determining the sampling rate, are to: determine the sampling rate based on the upper layer protocol. ### Claim 4 (depends on 1) The device of claim 1, where the one or more processors are further to: identify a geolocation of a source device associated with the flow; and where the one or more processors, when determining the sampling rate, are to: determine the sampling rate based on the geolocation of the source device. ### Claim 5 (depends on 1) The device of claim 1, where the one or more processors are further to: determine another sampling rate at which to perform a third upper layer inspection of a third portion of network traffic associated with the flow, the other sampling rate being different than the sampling rate; instruct the lower layer to use the other sampling rate to provide the third portion of network traffic associated with the flow for the third upper layer inspection; and perform the third upper layer inspection of the third portion of network traffic associated with the flow based on receiving the third portion of network traffic associated with the flow from the lower layer. ### Claim 6 (depends on 1) The device of claim 1, where the one or more processors are further to: determine another sampling rate at which to perform a third upper layer inspection of a third portion of network traffic associated with the flow, the other sampling rate being different than the sampling rate, the second portion of network traffic being provided by a source device to a destination device associated with the flow, and the third portion of network traffic being provided by the destination device to the source device; instruct the lower layer to use the other sampling rate to provide the third portion of network traffic associated with the flow for the third upper layer inspection; and perform the third upper layer inspection of the third portion of network traffic associated with the flow based on receiving the third portion of network traffic associated with the flow from the lower layer. ### Claim 7 (depends on 1) The device of claim 1, where the first upper layer inspection and the second upper layer inspection are performed by an upper layer of a communication model, where the upper layer is higher in the communication model than the lower layer. ### Claim 8 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to: receive a first portion of network traffic associated with a flow; perform a first upper layer inspection of the first portion of network traffic associated with the flow; identify a set of parameters of the flow based on performing the first upper layer inspection of the first portion of network traffic associated with the flow; determine, based on the set of parameters, a sampling rate at which to perform a second upper layer inspection of a second portion of network traffic associated with the flow; instruct a lower layer to use the sampling rate to provide the second portion of network traffic associated with the flow for the second upper layer inspection; perform the second upper layer inspection of the second portion of network traffic associated with the flow based on receiving the second portion of network traffic associated with the flow from the lower layer; and perform an action with regard to the flow based on a result of performing the second upper layer inspection. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: identify a uniform resource locator associated with the first portion of network traffic based on performing the first upper layer inspection; and where the one or more instructions, that cause the one or more processors to determine the sampling rate, cause the one or more processors to: determine the sampling rate based on the uniform resource locator associated with the first portion of network traffic. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: identify an application associated with the flow based on performing the first upper layer inspection; and where the one or more instructions, that cause the one or more processors to determine the sampling rate, cause the one or more processors to: determine the sampling rate based on the application. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: input the set of parameters into a model to obtain an output of the model, the model having been trained on training data using a machine learning technique; and where the one or more instructions, that cause the one or more processors to determine the sampling rate, cause the one or more processors to: determine the sampling rate based on the output of the model. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: identify an application layer protocol associated with the flow based on performing the first upper layer inspection; and where the one or more instructions, that cause the one or more processors to determine the sampling rate, cause the one or more processors to: determine the sampling rate based on the application layer protocol. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, where the sampling rate is associated with a direction of the flow; and where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: determine another sampling rate, associated with another direction of the flow, at which to perform a third upper layer inspection of a third portion of network traffic associated with the flow; instruct the lower layer to use the other sampling rate to provide the third portion of network traffic associated with the flow for the third upper layer inspection; and perform the third upper layer inspection of the third portion of network traffic associated with the flow based on receiving the third portion of network traffic associated with the flow from the lower layer. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: determine another sampling rate at which to perform a third upper layer inspection of a third portion of network traffic associated with the flow; determine that a condition is satisfied; instruct, based on the condition being satisfied, the lower layer to use the other sampling rate to provide the third portion of network traffic associated with the flow for the third upper layer inspection; and perform the third upper layer inspection of the third portion of network traffic associated with the flow based on receiving the third portion of network traffic associated with the flow from the lower layer. ### Claim 15 A method, comprising: receiving, by a device, network traffic associated with a flow; identifying, by the device, a set of parameters associated with the flow; determining, by the device, a sampling rate at which to perform an upper layer inspection of a portion of network traffic associated with the flow based on the set of parameters; providing, by the device, an instruction to a lower layer to use the sampling rate to provide the portion of network traffic associated with the flow for the upper layer inspection; performing, by the device, the upper layer inspection of the portion of network traffic associated with the flow based on receiving the portion of network traffic associated with the flow from the lower layer; and performing, by the device, an action with regard to the flow based on a result of performing the upper layer inspection of the portion of network traffic associated with the flow. ### Claim 16 (depends on 15) The method of claim 15, further comprising: identifying a geolocation of a destination device associated with the flow; and where determining the sampling rate comprises: determining the sampling rate based on the geolocation of the destination device. ### Claim 17 (depends on 15) The method of claim 15, further comprising: determining another sampling rate at which to perform another upper layer inspection of another portion of network traffic associated with the flow, the other sampling rate being different than the sampling rate; instructing the lower layer to use the other sampling rate to provide the other portion of network traffic associated with the flow for the other upper layer inspection; and performing the other upper layer inspection of the other portion of network traffic associated with the flow based on receiving the other portion of network traffic associated with the flow from the lower layer. ### Claim 18 (depends on 15) The method of claim 15, further comprising: identifying an application layer protocol associated with the flow; and where determining the sampling rate comprises: determining the sampling rate based on the application layer protocol. ### Claim 19 (depends on 15) The method of claim 15, further comprising: determining that a condition is satisfied; instructing the lower layer to use another sampling rate to provide another portion of network traffic associated with the flow for another upper layer inspection based on the condition being satisfied; and performing the other upper layer inspection of the other portion of network traffic associated with the flow based on receiving the other portion of network traffic associated with the flow from the lower layer. ### Claim 20 (depends on 15) The method of claim 15, further comprising: performing an initial upper layer inspection of an initial portion of network traffic associated with the flow; and where identifying the set of parameters comprises: identifying the set of parameters based on performing the initial upper layer inspection of the initial portion of network traffic associated with the flow.