Multi-level learning for classifying traffic flows

• US 10,257,082 B2
• Filed: 02/06/2017
• Issued: 04/09/2019
• Est. Priority Date: 02/06/2017
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Silver Peak Systems Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Hughes, David Anthony
• Primary Examiner(s): Han, Clemence S
• Application Number:
  US15/425,798
• Publication Number:
  US 20180227223A1
• Time in Patent Office: 792 Days
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Disclosed herein are systems and methods for multi-level classification of data traffic flows. In exemplary embodiments of the present disclosure, flows can be classified based on information in a first packet. The classification is based on an inference that can be made by a network appliance from a learning algorithm regarding an application name and/or one or more application characteristic tags. Based on the inference, the network appliance can select an appropriate network path for the flow.

Claims

1. A method of selecting a network path for transmitting data across a network, the method comprising:

receiving at a first network appliance, a first packet of a first flow to be transmitted across a network;

extracting information from the first packet;

using an application inference engine influenced by a learning algorithm to infer at least one of an application name and one or more application tags for the first flow based on the extracted information;

selecting by the first network appliance, a network path based on the inferred at least one of application name and one or more application tags; and

transmitting the first flow by the first network appliance via the selected network path to a destination.

2. The method of claim 1, wherein the first packet comprises only header information.

3. The method of claim 1, wherein the destination is a second network appliance.

4. The method of claim 1, wherein the destination is a server associated with an application.

5. The method of claim 1, further comprising:

performing network address translation based on the selected network path to change at least one of a source network address and a source port in packets of the first flow.

6. A method of training an inference engine to identify at least one of an application and one or more application characteristics for a flow, the method comprising:

receiving at a first network appliance, a first packet of a first flow to be transmitted across a network, wherein the network comprises a plurality of network paths;

extracting information from the first packet;

using an application inference engine influenced by a learning algorithm to infer at least one of an application name and one or more application characteristic tags based on the extracted information from the first packet;

selecting by the first network appliance, a network path from the plurality of network paths in the network for transmitting the first flow, the network path selected based on at least one of the inferred application name and inferred one or more application characteristic tags; and

transmitting by the first network appliance, the first flow via the selected network path to a destination.

7. The method of claim 6, wherein the extracted information from the first packet comprises at least one of a source IP address, a destination IP address, a source port, a destination port, and a protocol.

8. The method of claim 6, wherein the one or more application characteristic tag comprises a traffic type.

9. The method of claim 6, wherein the application inference engine comprises a neural network.

10. The method of claim 6, further comprising:

receiving at least one subsequent packet for the first flow;

extracting information from the received at least one subsequent packet;

using an inspection engine to determine at least one of an application name and one or more application characteristic tags based on the extracted information from the received at least one subsequent packet; and

informing the application inference engine with additional information such that the information from the received at least one subsequent packet is associated with the determined application name and at least one application characteristic tags for a subsequent flow.

11. The method of claim 10, wherein the additional information confirms the inference.

12. The method of claim 10, wherein the additional information contradicts the inference.

13. The method of claim 10, wherein the extracted information from the received at least one subsequent packet comprises at least one of a source IP address, a destination IP address, a source port, a destination port, a protocol, a domain name, and application data.

14. The method of claim 10, wherein the extracted information from the received at least one subsequent packet is analyzed using deep packet inspection.

15. The method of claim 10, further comprising:

receiving at the network appliance, a first packet of a second flow to be transmitted across the network;

using the application inference engine to determine an application name and at least one tag associated with the second flow;

selecting by the network appliance, a preferred network path for the second flow based on the determined application name and at least one tag associated with the second flow; and

transmitting by the network appliance, the second flow via the preferred network path.

16. A system for inferring at least one of an application name and one or more application tags for a first packet of a flow, comprising:

a feature extraction engine comprising a processor and memory, configured to extract information from the first packet of the flow;

an inspection engine comprising the processor and the memory, configured to determine whether the extracted information is indicative of a known application name or one or more application tags; and

an inference engine comprising the processor and memory, configured to infer at least one of an application name and one or more known application tags for the first packet based on the extracted information.

17. The system of claim 16, wherein the inference engine uses a learning algorithm of a neural network.

18. The system of claim 16, wherein the extracted information from the first packet comprises at least one of a source IP address, a destination IP address, a source port, a destination port, and a protocol.

19. The system of claim 16, wherein the extracted information from the first packet comprises at least one of a source IP address, a destination IP address, a source port, a destination port, a protocol, a domain name, and application data.

20. The system of claim 16, wherein the one or more application tags comprises at least one of voice, video, and data.