Systems and Methods for Network Traffic Classification and Filtering via Fingerprinting and Machine Learning

A method implemented at an application gateway within a computing services environment, the method comprising:

• receiving a plurality of application-layer request messages at a communication interface, the plurality of application-layer request messages being directed to a domain accessible via the computing services environment;
• determining fingerprint information based on an application-layer request message of the plurality of application-layer request messages, the fingerprint information including a locality-based fingerprint determined based on a locality-sensitive hashing function that maps similar input values to similar output values, the fingerprint information including a entropy-based fingerprint sensitive to an amount of information stored in data;
• retrieving one or more predetermined filter fingerprint values of a plurality of predetermined filter fingerprint values stored in a fingerprint database;
• and
• blocking the application-layer request message from being transmitted to a request destination upon determining that the fingerprint information matches a predetermined filter fingerprint value of the plurality of predetermined filter fingerprint values.

One or more non-transitory computer readable media having instructions stored thereon for performing a method implemented at an application gateway within a computing services environment, the method comprising:

• receiving a plurality of application-layer request messages at a communication interface, the plurality of application-layer request messages being directed to a domain accessible via the computing services environment;
• determining fingerprint information based on an application-layer request message of the plurality of application-layer request messages, the fingerprint information including a locality-based fingerprint determined based on a locality-sensitive hashing function that maps similar input values to similar output values, the fingerprint information including a entropy-based fingerprint sensitive to an amount of information stored in data;
• retrieving one or more predetermined filter fingerprint values of a plurality of predetermined filter fingerprint values stored in a fingerprint database;
• and
• blocking the application-layer request message from being transmitted to a request destination upon determining that the fingerprint information matches a predetermined filter fingerprint value of the plurality of predetermined filter fingerprint values.