System and method for generating filters based on analyzed flow data

A computer program product for generating filters based on analyzed network flows, comprising:

• code that separates data into different network flows;
• code that creates an aggregate network flow summary for one or more of said network flows;
• code that selects one or more network flows for analysis;
• code that sends said selected aggregate network flow summaries to a flow analyzer at the network device;
• code that analyzes said selected network flows by reviewing said aggregate network flow summaries;
• code that detects potentially harmful network flows;
• code that automatically generates or refines a filter based on said analyzed network flow summary to prevent packets corresponding to said detected potentially harmful network flows from passing through the network device;
• code that selects a new aggregate network flow summary to analyze and send the selected aggregate network flow summary to the flow analyzer for analysis;
• and
• a computer-readable storage for storing the codes executable by a processor.

A system for automatically generating filters based on data entering a network device, comprising:

• a netflow device operable to receive streams of packets, separate said streams, and create a summary record containing information on each of said streams;
• a flow analyzer located at the network device and operable to receive said summary records from said netflow device and analyze said summary records and identify potentially harmful network flows;
• and
• a filter generator operable to generate or refine a filter based on analyzed summary records to prevent packets corresponding to said identified potentially harmful network flows from passing through the network device, wherein said netflow device is operable to create a new summary record containing information on a stream of data associated with said generated or refined filter.

A method for generating filters for network flow, comprising:

• receiving data at a network device;
• classifying network flows based on one or more packets received at the network device;
• analyzing one or more of said network flows;
• generating a filter for one or more of said network flows;
• processing each of said network flows according to a corresponding policy;
• selecting a class of network flows to analyze;
• analyzing said selected class of network flows;
• and
• refining said filter for said selected class of network flows, wherein refining said filter comprises modifying the classification of network flows.

An apparatus for generating filters based on analyzed network flows, the apparatus comprising:

• one or more processors;
• and
• a memory that stores instructions to be executed by said one or more processors, said instructions comprising:
• code that creates separate aggregate network flow summaries for each of said network flows;
• code that sends at least one of said aggregate network flow summaries to a flow analyzer at the network device;
• code that analyzes said at least one aggregate network flow summary to detect characteristics of potentially harmful network flows;
• code that generates or refines a filter based on said analyzed aggregate network flow summary to prevent packets corresponding to detected potentially harmful network flows from passing through said network device;
• and
• code that selects a new aggregate network flow summary to analyze and sending the selected aggregate network flow summary to the flow analyzer for analysis, wherein the new aggregate flow summary corresponds to a network flow associated with the generated or refined filter.