Adaptive Network Traffic Classification Using Historical Context

• US 20090141634A1
• Filed: 12/02/2008
• Published: 06/04/2009
• Est. Priority Date: 12/04/2007
• Status: Active Grant

• Current Assignee: ExtraHop Networks, Incorporated
• Original Assignee: ExtraHop Networks, Incorporated
• Inventors: Mukerji, Arindum, Rothstein, Jesse Abraham
• Granted Patent: US 8,125,908 B2
• Time in Patent Office: Days
• US Class Current: 370/236
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/2483 involving identification of individual flows

Abstract

Adaptive network traffic classification using historical context. Network traffic may be monitored and classified by considering several attributes using packet filters, regular expressions, context-free grammars, rule sets, and/or protocol dissectors, among other means and by applying a variety of techniques such as signature matching and statistical analysis. Unlike static systems, the classification decisions may be reexamined from time to time or after subsequent processing determines that the traffic does not conform to the protocol specification corresponding to the classification decision. Historical context may be used to adjust the classification strategy for similar or related traffic.

Claims

1. A computer-implemented method, comprising:

a first computer system receiving first data over a network, wherein the first data is received from one or more packets from each of a plurality of connections;

the first computer system classifying the first data using one or more classification rules to produced classified data;

the first computer system determining if the classified data conforms to a protocol specification;

if the classified data does not conform to the protocol specification, the first computer system modifying the one or more classification rules such that later data with identifying characteristics similar to the first data are not classified in the same manner.

2. The method of claim 1, wherein said classifying the first data comprises determining one or more identifying characteristics of the first data.

3. The method of claim 2, wherein said classifying the first data comprises determining if previous data having the one or more identifying characteristics has been classified;

and

if the previous data has been classified, classifying the first data according to the classification of the previous data.

4. The method of claim 1, further comprising:

if the classified data conforms to the protocol specification, performing said receiving data, said classifying, and said determining a plurality of times.

5. The method of claim 1, wherein said modifying the one or more classification rules comprises deprioritizing the one or more classification rules.

6. A memory medium comprising program instructions, wherein the program instructions are executable to:

classify first data received over a network using one or more classification rules to produced classified data, wherein the first data is received from one or more packets from each of a plurality of connections;

determine if the classified data conforms to a protocol specification;

if the classified data does not conform to the protocol specification, modify modifying the one or more classification rules such that later data with identifying characteristics similar to the first data are not classified in the same manner.

7. The memory medium of claim 6, wherein in classifying the first data the program instructions are further executable to determine one or more identifying characteristics of the first data.

8. The memory medium of claim 7, wherein said classifying the first data comprises determining if previous data having the one or more identifying characteristics has been classified;

and

if the previous data has been classified, classifying the first data according to the classification of the previous data.

9. The memory medium of claim 6, wherein if the classified data conforms to the protocol specification, the program instructions are executable to perform said receiving data, said classifying, and said determining a plurality of times.

10. The memory medium of claim 6, wherein said modifying the one or more classification rules comprises deprioritizing the one or more classification rules.