Treating Data Flows Differently Based on Level of Interest

A traffic manager module for a cyber threat defense system, comprising:

• a registration module configured to register a connection between one or more devices within a client network to transmit a series of one or more data packets;
• a classifier module configured to execute a comparison of features of the connection to a set of interest criteria to determine an interest level for the cyber threat defense system in the connection and to apply an interest classifier describing the interest level to the connection based on the comparison;
• a deep packet inspection engine configured to examine the one or more data packets of the connection for cyber threats if the interest classifier indicates interest;
• and a diverter configured to shunt the one or more data packets of the connection away from the deep packet inspection engine if the interest classifier indicates no interest.

A network, comprising:

• at least one firewall;
• at least one network switch;
• multiple computing devices operable by users of the network;
• a cyber-threat coordinator-component that includes
• a probe module configured to collect, from one or more probes deployed to one or more network devices, input data describing network-administrated activity executed by a network device,
• a cyber threat module configured to identify whether the input data correspond to a cyber threat to the network, and
• an analyzer module configured to flag a host-based agent for host-based traffic decryption;
• and
• a traffic manager module that includes
• a registration module configured to register a connection between one or more devices on the network to transfer a series of one or more data packets,
• a classifier module configured to execute a comparison of features of the connection to a set of interest criteria to determine an interest level for the cyber threat defense system in the connection and to apply an interest classifier describing the interest level to the connection based on the comparison,
• a deep packet inspection engine configured to examine the one or more data packets of the connection for cyber threats if the interest classifier indicates interest and to execute a host-based traffic decryption of the one or more data packets for the connection, and
• a diverter configured to shunt the one or more data packets of the connection away from the deep packet inspection engine if the interest classifier indicates no interest.