Device profiling for isolation networks

• US 10,212,182 B2
• Filed: 04/12/2017
• Issued: 02/19/2019
• Est. Priority Date: 10/14/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wetterwald, Patrick, Thubert, Pascal, Vasseur, Jean-Philippe, Levy-Abegnoli, Eric
• Primary Examiner(s): Zaidi, Syed A
• Application Number:
  US15/485,680
• Publication Number:
  US 20180109551A1
• Time in Patent Office: 678 Days
• Field of Search: 726 1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

In one embodiment, a server instructs one or more networking devices in a local area network (LAN) to form virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to the server. The server receives the redirected traffic associated with the particular node. The server determines a node profile for the particular node based in part on an analysis of the redirected traffic. The server configures the particular node based on the determined node profile for the particular node.

Claims

1. A method comprising:

instructing, by a server, one or more networking devices in a local area network (LAN) to form a virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to the server;

receiving, at the server, the redirected traffic associated with the particular node;

determining, by the server, a node profile for the particular node based in part on an analysis of the redirected traffic; and

configuring, by the server, the particular node based on the determined node profile for the particular node.

2. The method of claim 1, further comprising:

receiving, at the server, a set of node behavioral rules; and

applying, by the server, the set of node behavioral rules to the redirected traffic from the particular node, to determine the node profile for the particular node.

3. The method of claim 1 further comprising:

receiving, at the server, a machine learning-based node behavioral model; and

applying, by the server, behavioral model to the redirected traffic from the particular node, to determine the node profile for the particular node.

4. The method of claim 3, wherein the machine learning-based node behavioral model comprises a traffic classifier.

5. The method of claim 1, wherein determining the node profile for the particular node based in part on the analysis of the redirected traffic comprises:

training, by the server, a machine learning-based node behavioral model using traffic from one or more other nodes; and

analyzing, by the server, the redirected traffic from the particular node using the trained node behavioral model.

6. The method of claim 5, wherein the node behavioral model is trained using the traffic from the one or more other nodes after boot of the one or more other nodes.

7. The method of claim 1, wherein analyzing the redirected traffic from the particular node using the trained node behavioral model comprises:

deploying, by the server, a node behavioral model to a networking device in the LAN, wherein the networking device uses the node behavioral model to analyze traffic associated with the particular node that is not redirected to the server.

8. An apparatus comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to;

instruct one or more networking devices in a local area network (LAN) to form a virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to the apparatus;

receive the redirected traffic associated with the particular node;

determine a node profile for the particular node based in part on an analysis of the redirected traffic; and

configure the particular node based on the determined node profile for the particular node.

9. The apparatus as in claim 8, wherein the process when executed is further configured to:

receive a set of node behavioral rules; and

apply the set of node behavioral rules to the redirected traffic from the particular node, to determine the node profile for the particular node.

10. The apparatus as in claim 8, wherein the process when executed is further configured to:

receive a machine learning-based node behavioral model; and

applying, by the server, behavioral model to the redirected traffic from the particular node, to determine the node profile for the particular node.

11. The apparatus as in claim 10, wherein the process when executed is further configured to:

detect a deviation in a behavior of the node based on the redirected traffic and on the determined node profile for the node.

12. The apparatus as in claim 10, wherein the apparatus determines the node profile for the particular node based in part on the analysis of the redirected traffic by:

training a machine learning-based node behavioral model using traffic from one or more other nodes; and

analyzing the redirected traffic from the particular node using the trained node behavioral model.

13. The apparatus as in claim 12, wherein the node behavioral model is trained using the traffic from the one or more other nodes after boot of the one or more other nodes.

14. The apparatus as in claim 10, wherein the apparatus analyzes the redirected traffic from the particular node using the trained node behavioral model by:

deploying a node behavioral model to a networking device in the LAN, wherein the networking device uses the node behavioral model to analyze traffic associated with the particular node that is not redirected to the apparatus.

15. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a network, cause a server to perform a process comprising:

instructing, by the server, one or more networking devices in a local area network (LAN) to form a virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to the server;

receiving, at the server, the redirected traffic associated with the particular node;

determining, by the server, a node profile for the particular node based in part on an analysis of the redirected traffic; and

configuring, by the server, the particular node based on the determined node profile for the particular node.

16. The computer-readable medium as in claim 15, wherein the process further comprises:

receiving, at the server, a set of node behavioral rules; and

applying, by the server, the set of node behavioral rules to the redirected traffic from the particular node, to determine the node profile for the particular node.

17. The computer-readable medium as in claim 15, wherein the process further comprises:

receiving, at the server, a machine learning-based node behavioral model; and

applying, by the server, behavioral model to the redirected traffic from the particular node, to determine the node profile for the particular node.

18. The computer-readable medium as in claim 15, wherein analyzing the redirected traffic from the particular node using the trained node behavioral model comprises:

deploying, by the server, a node behavioral model to a networking device in the LAN, wherein the networking device uses the node behavioral model to analyze traffic associated with the particular node that is not redirected to the server.

19. The computer-readable medium as in claim 15, wherein determining the node profile for the particular node based in part on the analysis of the redirected traffic comprises:

training, by the server, a machine learning-based node behavioral model using traffic from one or more other nodes; and

analyzing, by the server, the redirected traffic from the particular node using the trained node behavioral model.

20. The computer-readable medium as in claim 19, wherein the node behavioral model is trained using the traffic from the one or more other nodes after boot of the one or more other nodes.