System and method for efficient classification and processing of network traffic

• US 9,929,920 B2
• Filed: 01/06/2016
• Issued: 03/27/2018
• Est. Priority Date: 01/27/2011
• Status: Active Grant

• Current Assignee: Cognyte Technologies Israel Ltd. (Cognyte Software Ltd.)
• Original Assignee: Verint Systems Limited (Verint Systems Incorporated)
• Inventors: Altman, Yuval, Goldfarb, Eithan, Yaari, Gur, Frid, Naomi
• Primary Examiner(s): Salad, Abdullahi E
• Application Number:
  US14/989,075
• Publication Number:
  US 20160197796A1
• Time in Patent Office: 811 Days
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications

Abstract

Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Claims

1. A system for classifying flows of communication packets from a network, the system comprising:

a classification processor that receives unclassified input flows of communication packets from a front-end processor and assigns a classification to a given unclassified input flow that indicates whether the input flow is to be analyzed by a flow analysis processor,

wherein the classification is assigned by the classification processor based on less than 5% of the input packets of the given input flow,

wherein the classification processor assigns a first classification to a first unclassified input flow that indicates whether the first flow is to be analyzed by the flow analysis processor based on information produced in assigning a second classification to a second unclassified input flow, and

wherein the classification processor identifies a server-side address and a client-side address in the second input flow, and uses the identified server-side and client-side addresses in assignment of the first classification to the first input flow.

2. The system according to claim 1, wherein the front-end processor is configured to choose, for the given unclassified input flow, whether to forward the given input flow to the flow analysis processor, to forward the given input flow to the classification processor or to refrain from processing the given input flow, based on a respective classification of the given input flow that was specified by the classification processor.

3. The system according to claim 1, wherein the front-end processor is configured to maintain a list of active input flows and respective classifications of the active input flows, and to forward the input flows to the flow analysis processor based on the classifications of the input flows on the list.

4. The system according to claim 3, wherein the front-end processor is configured to forward the given input flow to the classification processor responsively to identifying in the list that the given input flow has not yet been classified, and to update the list with a respective classification of the given input flow that was produced by the classification processor.

5. The system according to claim 1, wherein the classification processor identifies an application that is served by a given input flow, and classifies the given input flow based on the identified application.

6. The system according to claim 1, wherein the at least one classification processor comprises multiple classification processors, and wherein the front-end processor is configured to distribute multiple input flows for classification among the classification processors.

7. A method for classifying flows of communication packets from a network, the method comprising:

receiving, by a classification processor, unclassified input flows of communication packets from a front-end processor; and

assigning a classification to a given unclassified input flow, by the classification processor, wherein the classification assigned determines whether the given input flow is to be analyzed by a flow analysis processor, wherein assigning a classification comprises assigning a first classification to a first unclassified input flow, by the classification processor, that indicates whether the first flow is to be analyzed by the flow analysis processor based on information produced in assigning a classification to a second unclassified input flow, wherein assigning the second classification to the second input flow comprises identifying a server-side address and a client-side address in the second input flow, and wherein assigning the first classification to the first input flow is performed using the identified server-side and client-side addresses.

8. The method according to claim 7, further comprising forwarding one or more input flows, which were classified by the classification processor as requiring analysis by the flow analysis processor, to the flow analysis processor so as to cause the flow analysis processor to analyze the requested flows, wherein forwarding the input flows comprises choosing, for a given input flow, whether to forward the given input flow to the flow analysis processor, to forward the given input flow to the classification processor or to refrain from processing the given input flow, based on a respective classification of the given input flow that was specified by the classification processor.

9. The method according to claim 7, further comprising forwarding one or more input flows, which were classified by the classification processor as requiring analysis by the flow analysis processor, to the flow analysis processor so as to cause the flow analysis processor to analyze the requested flows, wherein forwarding the input flows comprises maintaining a list of active input flows and respective classifications of the active input flows, and forwarding the input flows to the flow analysis processor based on the classifications of the input flows on the list.

10. The method according to claim 9, wherein forwarding the input flows comprises forwarding the given input flow to the classification processor responsively to identifying in the list that the given input flow has not yet been classified, and updating the list with a respective classification of the given input flow that was produced by the classification processor.

11. The method according to claim 7, and comprising, in the classification processor, identifying an application that is served by the given input flow and classifying the given input flow based on the identified application.

12. The method according to claim 7, and comprising operating multiple classification processors, wherein forwarding the at least one input flow comprises distributing multiple input flows for classification among the classification processors.