Dynamic prioritization of network traffic based on reputation

• US 10,291,584 B2
• Filed: 03/28/2016
• Issued: 05/14/2019
• Est. Priority Date: 03/28/2016
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Koripella, Srinivas, Sirigiri, Anil Kumar Reddy
• Primary Examiner(s): Perungavoor, Venkat
• Application Number:
  US15/082,276
• Publication Number:
  US 20170279773A1
• Time in Patent Office: 1,142 Days
• Field of Search: None
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 47/2433 Allocation of priorities to traffic types
• CPC Class Codes: H04L 47/783 Distributed allocation of resources, e.g. bandwidth brokers
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A network device may determine a plurality of reputation indicators that indicate a measure of reputation associated with the flow. A first reputation indicator, of the plurality of reputation indicators, may be determined based on applying a first reputation analysis technique in association with the flow. A second reputation indicator, of the plurality of reputation indicators, may be determined based on applying a second reputation analysis technique in association with the flow. The second reputation analysis technique may be different from the first reputation analysis technique. The network device may determine a reputation score for the flow based on the plurality of reputation indicators. The network device may prioritize the flow based on the reputation score.

Claims

1. A network device, comprising:

a memory; and

one or more processors to;

receive network traffic associated with a flow;

determine a plurality of reputation indicators that indicate a measure of reputation associated with the flow,

a first reputation indicator, of the plurality of reputation indicators, being determined based on applying a first reputation analysis technique in association with the flow,

a second reputation indicator, of the plurality of reputation indicators, being determined based on a different device performing a second reputation analysis technique in association with the flow,

the different device being different from the network device, and

the second reputation analysis technique being different from the first reputation analysis technique;

determine a reputation score for the flow based on the plurality of reputation indicators; and

prioritize the flow based on the reputation score,

the one or more processors, when prioritizing the flow, being to;

allocate bandwidth to the flow based on the reputation score, or

cause the bandwidth to be allocated to the flow based on the reputation score.

2. The network device of claim 1,

where the first reputation analysis technique is performed by a first device to determine the first reputation indicator,

where the different device is a second device, and

where the second device is different from the first device.

3. The network device of claim 1,

where the one or more processors, when determining the plurality of reputation indicators, are to:

receive the second reputation indicator from the different device.

4. The network device of claim 1, where the network device performs the first reputation analysis technique.

5. The network device of claim 1,

where a first device performs the first reputation analysis technique to determine the first reputation indicator,

where the different device is a second device, and

where the one or more processors, when determining the plurality of reputation indicators, are to:

receive the first reputation indicator from the first device, and

receive the second reputation indicator from the second device.

6. The network device of claim 1, where the first reputation analysis technique or the second reputation analysis technique includes at least one of:

an attack detection technique that indicates a likelihood that the flow is associated with a network attack,

a malware detection technique that indicates a likelihood that the flow is associated with malware,

an application identification technique that indicates a consistency with which the flow is determined to be associated with a same application,

a web traffic analysis technique that indicates a measure of reputation of a website associated with the flow, or

a rule-based filtering technique that indicates a measure of reputation associated with the flow based on a stored rule that identifies flow information associated with the flow.

20. The network device of claim 1, where the flow is identified by at least one of:

a source network address,

a destination network address,

a source port identifier,

a destination port identifier, or

a protocol identifier.

7. A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors of a network device, cause the one or more processors to;

receive network traffic associated with a flow;

determine a plurality of reputation indicators that indicate a measure of reputation associated with the flow,

a first reputation indicator, of the plurality of reputation indicators, being determined based on a first reputation analysis technique applied to the flow by a first device,

a second reputation indicator, of the plurality of reputation indicators, being determined based on a second reputation analysis technique applied to the flow by a second device, and the second device being different from the first device and the network device;

determine a reputation score for the flow based on the plurality of reputation indicators; and

prioritize the flow based on the reputation score by;

allocating bandwidth to the flow based on the reputation score, or

causing the bandwidth to be allocated to the flow based on the reputation score.

8. The non-transitory computer-readable medium of claim 7, where the first reputation analysis technique is different from the second reputation analysis technique.

9. The non-transitory computer-readable medium of claim 7,

where the flow is a first flow and the reputation score is a first reputation score;

and

where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to;

determine a second reputation score for a second flow that is different from the first flow; and

assign different amounts of bandwidth to the first flow and the second flow based on the first reputation score and the second reputation score.

10. The non-transitory computer-readable medium of claim 9, where the different amounts of bandwidth assigned to the first flow and the second flow are based on a degree of difference between the first reputation score and the second reputation score.

11. The non-transitory computer-readable medium of claim 7, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

determine a set of reputation analysis techniques to be performed based on one or more attributes of the flow,

the set of reputation analysis techniques including the first reputation analysis technique and the second reputation analysis technique,

the first reputation analysis technique being different from the second reputation analysis technique.

12. The non-transitory computer-readable medium of claim 7, where the first reputation analysis technique includes one of:

an attack detection technique that indicates a likelihood that the flow is associated with a network attack,

a malware detection technique that indicates a likelihood that the flow is associated with malware,

an application identification technique that indicates a consistency with which the flow is determined to be associated with a same application,

a web traffic analysis technique that indicates a measure of reputation of a website associated with the flow, or

a rule-based filtering technique that indicates a measure of reputation associated with the flow based on a stored rule that identifies flow information associated with the flow; and

where the second reputation analysis technique includes a different one of;

the attack detection technique,

the malware detection technique,

the application identification technique,

the web traffic analysis technique, or

the rule-based filtering technique.

13. A method, comprising:

receiving, by a device, network traffic associated with a flow;

determining, by the device, reputation indicators that indicate a measure of reputation associated with the flow,

the reputation indicators including;

a first reputation indicator that is determined based on applying a first reputation analysis technique in association with the flow,

a second reputation indicator that is determined based on a different device performing a second reputation analysis technique in association with the flow, and

the different device being different from the device;

determining, by the device, a reputation score for the flow based on the reputation indicators; and

prioritizing, by the device, the flow by causing network bandwidth to be allocated to the flow based on the reputation score.

14. The method of claim 13, where the first reputation analysis technique or the second reputation analysis technique includes an attack detection technique that indicates a likelihood that the flow is associated with a network attack.

15. The method of claim 13, where the first reputation analysis technique or the second reputation analysis technique includes a malware detection technique that indicates a likelihood that the flow is associated with malware.

16. The method of claim 13, where the first reputation analysis technique or the second reputation analysis technique includes an application identification technique that indicates a consistency with which the flow is determined to be associated with a same application.

17. The method of claim 13, where the first reputation analysis technique or the second reputation analysis technique includes a web traffic analysis technique that indicates a measure of reputation of a website associated with the flow.

18. The method of claim 13, where the first reputation analysis technique or the second reputation analysis technique includes a rule-based filtering technique that indicates a measure of reputation associated with the flow based on a stored rule that identifies flow information associated with the flow.

19. The method of claim 13, further comprising:

updating the reputation score; and

adjusting the allocated network bandwidth based on the updated reputation score.