Network traffic classification system
AssigneeRedberry Systems, Inc.
InventorsMadhavan BAKTHAVATCHALAM, Sandeep KHANNA, Varadarajan SRINIVASAN
Life of this patent
Estimating the term…
Abstract
This disclosure provides systems, methods and apparatuses for classifying traffic flow using a plurality of learning machines arranged in multiple hierarchical levels. A first learning machine may classify a first portion of the input stream as malicious based on a match with first classification rules, and a second learning machine may classify at least part of the first portion of the input stream as malicious based on a match with second classification rules. The at least part of the first portion of the input stream may be classified as malicious based on the matches in the first and second learning machines.
Claims30
A malware detection system, comprising:
- an input terminal coupled to an input stream;
- a plurality of learning machines, each learning machine including an input to receive one or more portions of the input stream and configured to classify the one or more respective portions of the input stream as malicious or benign based on a match or mismatch, respectively, between the one or more respective portions of the input stream and a corresponding set of classification rules;
- and
- a signal combiner including a plurality of inputs coupled to respective outputs of the plurality of learning machines and an output to provide results indicative of whether the input stream contains malware, the signal combiner configured to provide the results based on the classifications provided by at least some of the plurality of learning machines and one or more weighting factors.
The malware detection system of claim 11, wherein each weighting factor indicates a significance of the classification provided by a respective learning machine relative to the significances of the classifications provided by one or more other learning machines.
A method performed by a system including a plurality of learning machines, the method comprising:
- receiving an input stream;
- classifying, in each of the plurality of learning machines, one or more respective portions of the input stream as malicious or benign based on a match or mismatch, respectively, between the one or more respective portions of the input stream and a corresponding set of classification rules;
- and
- providing results indicative of whether the input stream contains malware based on the classifications provided by at least some of the plurality of learning machines and one or more weighting factors.
Dependencies are inferred from the claim text.