Utilizing machine learning models for network traffic categorization

Patent metadata

Field	Value
Publication number	US-12284094-B2
Application number	US-202218147489-A
Country	US
Kind code	B2
Filing date	Dec 28, 2022
Priority date	Dec 28, 2022
Publication date	Apr 22, 2025
Grant date	Apr 22, 2025

Abstract

A device may receive network traffic data that includes network traffic packet sizes, and may transform the network traffic data into transformed data. The device may process the transformed data, with a machine learning model, to generate an embedding, and may obtain a similarity metric for the embedding. The device may create a graph with nodes and edges based on the embedding and the similarity metric, and may process the graph, with a community detection model, to identify network traffic categories for the network traffic data. The device may perform one or more actions based on the network traffic categories.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a device, network traffic data that includes network traffic packet sizes;
transforming, by the device, the network traffic data into transformed data;
processing, by the device, the transformed data, with a machine learning model, to generate an embedding;
obtaining, by the device, a similarity metric for the embedding;
creating, by the device, a graph with nodes and edges based on the embedding and the similarity metric;
processing, by the device, the graph, with a community detection model, to identify network traffic categories for the network traffic data,
wherein processing the graph to identify the network traffic categories for the network traffic data comprises:
processing the graph to determine a quantity of the network traffic categories automatically from the network traffic data and without prior selection of the quantity of the network traffic categories; and

performing, by the device, one or more actions based on the network traffic categories.

2. The method of claim 1 , wherein transforming the network traffic data into the transformed data comprises:
transforming the network traffic data into a format capable of being processed by the machine learning model.

3. The method of claim 1 , wherein processing the transformed data, with the machine learning model, to generate the embedding comprises:
processing the transformed data, with a machine learning model as representation learning, to generate the embedding.

4. The method of claim 1 , wherein processing the transformed data, with the machine learning model, to generate the embedding comprises:
processing the transformed data, with the machine learning model, to identify information for categorizing the network traffic data without prior knowledge of the network traffic categories.

5. The method of claim 1 , wherein obtaining the similarity metric for the embedding comprises:
obtaining a correlation coefficient as the similarity metric for the embedding.

6. The method of claim 5 , wherein creating the graph with the nodes and the edges based on the embedding and the correlation coefficient comprises:
converting the embedding into the nodes of the graph; and
defining the edges between the nodes of the graph based on the correlation coefficient.

7. The method of claim 1 , wherein performing the one or more actions comprises:
determining and implementing a network traffic policy for each of the network traffic categories.

8. A device, comprising:
one or more memories; and
one or more processors to:
receive network traffic data that includes network traffic packet sizes;
transform the network traffic data into transformed data;
process the transformed data, with a machine learning model, to generate an embedding;
determine a correlation coefficient for the embedding;
create a graph with nodes and edges based on the embedding and the correlation coefficient;
process the graph, with a community detection model, to identify network traffic categories for the network traffic data,
wherein the one or more processors, to process the graph, with the community detection model, to identify the network traffic categories for the network traffic data, are to:
process the graph to determine a quantity of the network traffic categories automatically from the network traffic data and without prior selection of the quantity of the network traffic categories; and

perform one or more actions based on the network traffic categories.

9. The device of claim 8 , wherein the one or more processors, to create the graph with the nodes and the edges based on the embedding and the correlation coefficient, are to:
convert the embedding into the nodes of the graph; and
define the edges between the nodes of the graph based on the correlation coefficient.

10. The device of claim 8 , wherein the one or more processors, to process the graph, with the community detection model, to identify the network traffic categories for the network traffic data, are to:
process the graph, with the community detection model, to determine a quantity of the network traffic categories automatically from the network traffic data.

11. The device of claim 8 , wherein the one or more processors, to perform the one or more actions, are to one or more of:
provide the network traffic categories for display; or
retrain one or more of the machine learning model or the community detection model based on the network traffic categories.

12. The device of claim 8 , wherein the one or more processors, to perform the one or more actions, are to one or more of:
determine and implement a network traffic policy based on the network traffic categories; or
determine and implement a network traffic policy for each of the network traffic categories.

13. The device of claim 8 , wherein the one or more processors, to perform the one or more actions, are to:
determine policies for network devices based on the network traffic categories; and
cause the policies to be implemented by the network devices.

14. The device of claim 8 , wherein the one or more processors, to process the transformed data to generate the embedding, are to one or more of:
process the transformed data to identify information for categorizing the network traffic data without prior knowledge of the network traffic categories.

15. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
receive network traffic data that includes network traffic packet sizes;
transform the network traffic data into transformed data;
process the transformed data, with a machine learning model, to generate embedding;
obtain a similarity metric correlation coefficient for the embedding;
convert the embedding into nodes of a graph;
define edges between the nodes of the graph based on the similarity metric correlation coefficient;
process the graph, with a community detection model, to identify a quantity of network traffic categories automatically for the network traffic data without prior selection of the quantity of the network traffic categories; and
perform one or more actions based on the network traffic categories.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the device to transform the network traffic data into the transformed data, cause the device to:
transform the network traffic data into a format capable of being processed by the machine learning model.

17. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the device to process the transformed data, with the machine learning model, to generate the embedding, cause the device to:
process the transformed data, with a machine learning model as representation learning, to generate the embedding.

18. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the device to process the transformed data, with the machine learning model, to generate the embedding, cause the device to:
process the transformed data, with the machine learning model, to identify information for categorizing the network traffic data without prior knowledge of the network traffic categories.

19. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause

Assignees

• Juniper Networks Inc

Inventors

• Patankar Ajit Krishna
• Agrawal Kaushik Adesh
• Han Kihwan
• Purkayastha Monimoy Deb
• Melampy Patrick John
• Timmons Patrick

Classifications

• H04L47/27

  Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets · CPC title

• H04N21/643

  Communication protocols {(network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP], H04L65/65)} · CPC title

• H04L43/0882

  Utilisation of link capacity · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title