Behavioral classification of network data flows

Patent metadata

Field	Value
Publication number	US-10187353-B2
Application number	US-201113151141-A
Country	US
Kind code	B2
Filing date	Jun 1, 2011
Priority date	Jun 2, 2010
Publication date	Jan 22, 2019
Grant date	Jan 22, 2019

Abstract

Methods, apparatuses and systems facilitating enhanced classification of network traffic based on observed flow-based and/or host-based behaviors.

First claim

What is claimed is:

1. A method for facilitating classification of data flows, comprising:
monitoring data flows associated with hosts, wherein each data flow comprises a plurality of related packets;
determining at least one behavioral index value for each of the hosts based on observed behaviors of the hosts as expressed in at least one of the data flows, wherein the at least one behavioral index value comprises at least one of:
a port diversity index value that indicates a probability that a given host maintains connections with a larger quantity of different ports than a baseline host; and
a peer diversity index value that indicates a probability that a first host connects to a higher number of different hosts than a baseline host;

classifying a first data flow for the first host based on the at least one behavioral index value for the first host;
identifying a new data flow associated with the first host;
in response to the new data flow, if the at least one behavioral index value for the first host comprises a first port diversity index value, updating the first port diversity index value, comprising:
comparing a server port number associated with the new data flow to a list of server port numbers associated with the first host, including determining whether the server port number is included or not included in the list of server port numbers;
responsive to determining that the server port number is not included in the list of server port numbers, incrementing the first port diversity index value for the first host;
responsive to determining that the server port number is included in the list of server port numbers, decrementing the first port diversity index value for the first host;

in response to the new data flow, if the at least one behavioral index value for the first host comprises a first peer diversity index value, updating the first peer diversity index value, comprising:
comparing a second host address associated with the new data flow to a list of host addresses associated with the first host, including determining whether the second host address is included or not included in the list of host addresses;
responsive to determining that the second host address is not included in the list of host addresses, incrementing the first peer diversity index value for the first host; and
responsive to determining that the second host address is included in the list of host addresses, decrementing the first peer diversity index value for the first host;

updating the classification of the first data flow for the first host based on at least one of the updated first port diversity index value and the updated first peer diversity index value; and
implementing a policy on the first data flow based on the updated classification of the first data flow, wherein implementing the policy comprises changing a configuration or operation of a first network device.

2. The method of claim 1 further comprising classifying one or more of the data flows into a behavior group of a plurality of behavioral groups based on respective behavioral index values associated with the data flows.

3. The method of claim 1 wherein the at least one behavioral index value for the first host comprises the port diversity index value.

4. The method of claim 1 further comprising:
replacing an oldest entry in the list of server port numbers with the server port number of the new data flow, when the server port number of the new data flow is not included in the list of server port numbers.

5. The method of claim 1 wherein the at least one behavioral index value for the first host comprises the peer diversity index value.

6. The method of claim 1 wherein the at least one behavioral index value comprises a host behavior index, and wherein the method further comprises:
classifying a third data flow associated with a third host into one of a predefined set of classifications; and
adjusting a behavioral index value for the third host associated with the third data flow based on the classification of the third data flow.

7. The method of claim 1 wherein the policy comprises at least one of:
bandwidth utilization control;
a partition;
a redirection policy; and
a security policy.

8. An apparatus comprising:
one or more network interfaces,
a memory;
one or more processors;
a behavioral traffic classification module comprising computer-executable instructions stored on a computer readable medium, the instructions readable by the one or more processors, the instructions, when read and executed, for causing the one or more processors to:
monitor data flows associated with hosts, wherein each data flow comprises a plurality of related packets;
determine at least one behavioral index value for each of the hosts based on observed behaviors of the hosts as expressed in at least one of the data flows, wherein the at least one behavioral index value comprises at least one of:
a port diversity index value that indicates a probability that a given host maintains connections with a larger quantity of different ports than a baseline host; and
a peer diversity index value that indicates a probability that a first host connects to a higher number of different hosts than a baseline host;

classify a first data flow for the first host based on the at least one behavioral index value for the first host;
identify a new data flow associated with the first host;
in response to the new data flow, if the at least one behavioral index value for the first host comprises a first port diversity index value, update the first port diversity index value, comprising:
compare a server port number associated with the new data flow to a list of server port numbers associated with the first host, including instructions to determine whether the server port number is included or not included in the list of server port numbers;
responsive to the instructions to determine that the server port number is not included in the list of server port numbers, increment the first port diversity index value for the first host;
responsive to the instructions to determine that the first server port number is included in the list of server port numbers, decrement the first port diversity index value for the first host;

in response to the new data flow, if the at least one behavioral index value for the first host comprises a first peer diversity index value, update the first peer diversity index value, comprising:
compare a second host address associated with the new data flow to a list of host addresses associated with the first host, including instructions to determine whether the second host address is included or not included in the list of host addresses;
responsive to the instructions to determine that the second host address is not included in the list of host addresses, increment the first peer diversity index value for the first host; and
responsive to the instructions to determine that the second host address is included in the list of host addresses, decrement the first peer diversity index value for the first host;

update the classification of the first data flow for the first host based on at least one of the updated first port diversity index value and the updated first peer diversity index value; and
implement a policy on the first data flow based on the updated classification of the first data flow, wherein implementing the policy comprises changing a configuration or operation of a first network device.

9. The apparatus of claim 8 further comprising computer-executable instructions for causing the one or more processors to classify one or more of the data flows into a behavior group of a plurality of behavioral groups based on respective behavior

Assignees

• Muppala Suresh Babu
• Riddle Guy
• Hankins Scott Andrew
• Symantec Corp

Inventors

• Muppala Suresh Babu
• Riddle Guy
• Hankins Scott Andrew

Classifications

• H04L47/2441

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title

• H04L29/06897

  Electricity · mapped topic

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/18 Primary

  Protocol analysers · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title