Network traffic rule identification

Patent metadata

Field	Value
Publication number	US-11575589-B2
Application number	US-202017110372-A
Country	US
Kind code	B2
Filing date	Dec 3, 2020
Priority date	Dec 3, 2020
Publication date	Feb 7, 2023
Grant date	Feb 7, 2023

Abstract

A computer implemented method for analyzing network connections includes identifying a connection of interest and a corresponding set of connection data. The method additionally includes generating one or more saliency maps corresponding to the connection of interest. The method additionally includes mapping the generated one or more saliency maps to underlying protocols and fields, and identifying one or more values corresponding to each of the underlying protocols and fields. The method additionally includes extracting general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields.

First claim

What is claimed is:

1. A computer implemented method for analyzing network connections, the method comprising:
identifying a connection of interest and a corresponding set of connection data;
generating one or more saliency maps representative of data transmitted via the connection of interest, wherein generating the one or more saliency maps comprises creating a map indicating emphasis directed towards one or more portions of the data transmitted via the connection of interest;
mapping the generated one or more saliency maps to underlying protocols and fields;
identifying one or more values corresponding to each of the underlying protocols and fields; and
extracting general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields.

2. The computer implemented method of claim 1 , wherein the corresponding set of connection data includes one or more byte streams.

3. The computer implemented method of claim 2 , wherein generating one or more saliency maps corresponding to the connection of interest includes generating one or more saliency maps corresponding to the one or more byte streams such that portions of the byte stream are highlighted according to the attention that is paid to them.

4. The computer implemented method of claim 3 , wherein mapping the generated one or more saliency maps to underlying protocols and fields includes mapping one or more portions of the byte stream to underlying fields or protocols impacted by the one or more portions of the byte stream.

5. The computer implemented method of claim 2 , wherein generating saliency maps corresponding to the connection of interest includes:
identifying a context corresponding to the received one or more byte streams;
analyzing the byte stream to determine importance levels corresponding to one or more values in the byte stream with respect to the identified context; and
assigning one or more weights to the values in the byte stream based on the determined importance levels.

6. The computer implemented method of claim 1 , further comprising generating general rules representing the extracted correspondences.

7. A computer program product for analyzing network connections, the computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising instructions to:
identify a connection of interest;
generate one or more saliency maps representative of data transmitted via the connection of interest, wherein generating one or more saliency maps comprises creating a map indicating emphasis directed towards one or more portions of the data transmitted via the connection of interest;
map the generated saliency maps to underlying protocols and fields;
identify one or more values corresponding to each of the underlying protocols and fields; and
extract general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields.

8. The computer program product of claim 7 , wherein the corresponding set of connection data includes one or more byte streams.

9. The computer program product of claim 8 , wherein instructions to generate one or more saliency maps corresponding to the connection of interest comprise instructions to generate one or more saliency maps corresponding to the one or more byte streams such that portions of the byte stream are highlighted according to the attention that is paid to them.

10. The computer program product of claim 9 , wherein instructions to map the generated one or more saliency maps to underlying protocols and fields comprise instructions to map one or more portions of the byte stream to underlying fields or protocols impacted by the one or more portions of the byte stream.

11. The computer program product of claim 8 , wherein instructions to generate saliency maps corresponding to the connection of interest comprise instructions to:
identify a context corresponding to the received one or more byte streams;
analyze the byte stream to determine importance levels corresponding to one or more values in the byte stream with respect to the identified context; and
assign one or more weights to the values in the byte stream based on the determined importance levels.

12. The computer program product of claim 7 , further comprising instructions to generate general rules representing the extracted correspondences.

13. A computer system for analyzing network connections, the computer system comprising:
one or more computer processors;
one or more computer-readable storage media;
program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising instructions to:
identify a connection of interest;
generate one or more saliency maps representative of data transmitted via the connection of interest, wherein generating one or more saliency comprises creating a map indicating emphasis directed towards one or more portions of the data transmitted via the connection of interest;
map the generated saliency maps to underlying protocols and fields;
identify one or more values corresponding to each of the underlying protocols and fields; and
extract general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields.

14. The computer system of claim 13 , wherein the corresponding set of connection data includes one or more byte streams.

15. The system of claim 14 , wherein instructions to generate one or more saliency maps corresponding to the connection of interest comprise instructions to generate one or more saliency maps corresponding to the one or more byte streams such that portions of the byte stream are highlighted according to the attention that is paid to them.

16. The computer system of claim 15 , wherein instructions to map the generated one or more saliency maps to underlying protocols and fields comprise instructions to map one or more portions of the byte stream to underlying fields or protocols impacted by the one or more portions of the byte stream.

17. The computer system of claim 13 , further comprising instructions to generate general rules representing the extracted correspondences.

Assignees

• IBM

Inventors

• Le Franck Vinh
• Chakraborty Supriyo

Classifications

• H04L43/026 Primary

  using flow identification · CPC title

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• H04L43/0811 Primary

  by checking connectivity · CPC title

• H04L41/14 Primary

  Network analysis or design · CPC title

• H04L43/18

  Protocol analysers · CPC title