Edge-based machine learning for encoding legitimate scanning

Patent metadata

Field	Value
Publication number	US-10243980-B2
Application number	US-201615205732-A
Country	US
Kind code	B2
Filing date	Jul 8, 2016
Priority date	Mar 24, 2016
Publication date	Mar 26, 2019
Grant date	Mar 26, 2019

Abstract

In one embodiment, a device in a network receives an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network. The device receives labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity. The device trains a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network. The device deploys the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.

First claim

What is claimed is:

1. A method comprising:
receiving, at a device in a network, an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network;
receiving, at the device, labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity;
training, by the device, a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network, wherein the trained classifier is configured to cause the first node to suppress anomalies detected by the anomaly detector that are classified by the classifier as being associated with legitimate scanning activity; and
deploying, by the device, the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.

2. The method as in claim 1 , wherein receiving the indication that the network anomaly is associated with scanning activity comprises:
receiving, at the device, the indication via a user interface, wherein the indication labels the associated scanning activity as being legitimate or illegitimate.

3. The method as in claim 2 , further comprising:
sending, by the device, a request to the first node for the traffic data associated with the detected anomaly; and
labeling, by the device, the traffic data based on the indication received via the user interface.

4. The method as in claim 1 , further comprising:
receiving, at the device, a notification of the detected anomaly from the first node; and
sending, by the device, data regarding the detected anomaly to a user interface for labeling.

5. The method as in claim 1 , further comprising:
deploying, by the device, the classifier to the first node and to one or more additional nodes in the network via a broadcast or multicast message.

6. The method as in claim 1 , further comprising:
receiving, at the device, a classification result from the first node that classifies a particular set of traffic data as associated with legitimate scanning activity; and
verifying, by the device, the legitimacy of the received classification result.

7. The method as in claim 6 , wherein verifying the legitimacy of the received classification result comprises:
providing, by the device, a sampling of traffic data to a user interface that were classified as associated with legitimate scanning activity; and
receiving, at the device, feedback from the user interface regarding the sampling.

8. The method as in claim 7 , further comprising:
retraining, by the device, the classifier based on the feedback indicating that at least a portion of the sampling was misclassified as associated with legitimate scanning activity.

9. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network;
receive labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate scanning activity;
train a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network, wherein the trained classifier is configured to cause the first node to suppress anomalies detected by the anomaly detector that are classified by the classifier as being associated with legitimate scanning activity; and
deploy the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.

10. The apparatus as in claim 9 , wherein the apparatus receives the indication that the network anomaly is associated with scanning activity by:
receiving the indication via a user interface, wherein the indication labels the associated scanning activity as being legitimate or illegitimate.

11. The apparatus as in claim 10 , wherein the process when executes is further operable to:
send a request to the first node for the traffic data associated with the detected anomaly; and
label the traffic data based on the indication received via the user interface.

12. The apparatus as in claim 9 , wherein the process when executed is further operable to:
receive a notification of the detected anomaly from the first node; and
send data regarding the detected anomaly to a user interface for labeling.

13. The apparatus as in claim 9 , wherein the process when executed is further operable to:
deploy the classifier to the first node and to one or more additional nodes in the network via a broadcast or multicast message.

14. The apparatus as in claim 9 , wherein the process when executed is further operable to:
receive a classification result from the first node that classifies a particular set of traffic data as associated with legitimate scanning activity; and
verify the legitimacy of the received classification result.

15. The apparatus as in claim 14 , wherein the apparatus verifies the legitimacy of the received classification result by:
providing a sampling of traffic data to a user interface that were classified as associated with legitimate scanning activity; and
receiving feedback from the user interface regarding the sampling.

16. The apparatus as in claim 15 , wherein the process when executed is further operable to:
retrain the classifier based on the feedback indicating that at least a portion of the sampling was misclassified as associated with legitimate scanning activity.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:
receiving an indication that a network anomaly detected by an anomaly detector of a first node in the network is associated with scanning activity in the network;
receiving, at the device, labeled traffic data associated with the detected anomaly that identifies whether the traffic data is associated with legitimate or illegitimate s scanning activity;
training, by the device, a machine learning-based classifier using the labeled traffic data to distinguish between legitimate and illegitimate scanning activity in the network, wherein the trained classifier is configured to cause the first node to suppress anomalies detected by the anomaly detector that are classified by the classifier as being associated with legitimate scanning activity; and
deploying, by the device, the trained classifier to the first node, to distinguish between legitimate and illegitimate scanning activity in the network.

18. The computer-readable medium as in claim 17 , wherein the process further comprises:
deploying, by the device, the classifier to the first node and to one or more additional nodes in the network via a broadcast or multicast message.

Assignees

• Cisco Tech Inc

Inventors

• Vasseur Jean-Philippe
• Mermoud Grégory
• Savalle Pierre-André
• Honoré Alexandre

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L45/08

  Learning-based routing, e.g. using neural networks or artificial intelligence · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title