Dynamic deep packet inspection for anomaly detection

Patent metadata

Field	Value
Publication number	US-2017099310-A1
Application number	US-201514874594-A
Country	US
Kind code	A1
Filing date	Oct 5, 2015
Priority date	Oct 5, 2015
Publication date	Apr 6, 2017
Grant date	—

Abstract

In one embodiment, a device in a network captures a first set of packets based on first packet capture criterion. The captured first set of packets is provided for deep packet inspection and anomaly detection. The device receives a second packet capture criterion that differs from the first packet capture criterion. The device captures a second set of packets based on the second packet capture criterion. The device provides the captured second set of packets for deep packet inspection and anomaly detection. The anomaly detection of the captured first and second sets of packets is performed by a machine learning-based anomaly detector configured to generate anomaly detection results based in part on one or more traffic metrics gathered from the network and based further in part on deep packet inspection results of packets captured in the network.

First claim

What is claimed is:

1 . A method, comprising:
capturing, by a device in a network, a first set of packets based on first packet capture criterion; providing the captured first set of packets for deep packet inspection and anomaly detection; receiving, at the device, a second packet capture criterion, wherein the second packet capture criterion differs from the first packet capture criterion; capturing, by the device, a second set of packets based on the second packet capture criterion; and providing the captured second set of packets for deep packet inspection and anomaly detection, wherein the anomaly detection of the captured first and second sets of packets is performed by a machine learning-based anomaly detector configured to generate anomaly detection results based in part on one or more traffic metrics gathered from the network and based further in part on deep packet inspection results of packets captured in the network.

2 . The method as in claim 1 , further comprising:
generating, by the device, first deep packet inspection results by performing deep packet inspection on the first set of packets; and generating, by the device, a first anomaly detection result by using the first deep packet inspection results as input to the attack detector.

3 . The method as in claim 2 , further comprising:
providing, by the device, the first anomaly detection result to a packet capture controller, wherein the second packet capture criteria is received from the packet capture controller and generated by the packet capture controller based on the first anomaly detection result.

4 . The method as in claim 1 , wherein the first or second packet capture criterion comprises at least one of: one or more network address prefixes, one or more network address ranges, one or more ports, access control list information, one or more interfaces, a time period during which packets are to be captured, or one or more applications associated with traffic in the network.

5 . The method as in claim 1 , wherein the machine learning-based anomaly detector analyzes deep packet inspection results associated with the first set of captured packets using a first anomaly detection model, and wherein the machine learning-based anomaly detector analyzes deep packet inspection results associated with the second set of captured packets using a second anomaly detection model.

6 . The method as in claim 1 , further comprising:
providing, by the device, the captured first and second sets of packets to an intrusion protection system (IPS) device, wherein the IPS device is configured to use a signature-based strategy to detect network intrusions.

7 . The method as in claim 1 , wherein providing the captured first and second sets of packets for deep packet inspection and anomaly detection comprises:
providing, by the device, the captured first and second sets of packets to a second device in the network, wherein the second device in the network executes the machine learning-based anomaly detector.

8 . A method, comprising:
receiving, at a device in a network, an anomaly detection result from a machine learning-based anomaly detector, wherein the anomaly detection result is based in part on one or more traffic metrics and based in part on deep packet inspection results for a first set of packets captured based on a first packet capture criterion; determining, by the device, a second packet capture criterion, wherein the second packet capture criterion differs from the first packet capture criterion; and causing, by the device and using the second packet capture criterion, a second set of packets to be captured for deep packet inspection and results of the deep packet inspection of the second set of packets to be used as input to the machine learning-based anomaly detector.

9 . The method as in claim 8 , wherein the second packet capture criterion is determined based in part on the received anomaly detection result or based on input received from a user interface.

10 . The method as in claim 9 , wherein the second packet capture criterion is determined based further in part on resources available in the network.

11 . The method as in claim 8 , wherein the machine learning-based anomaly detector is configured to analyze the deep packet inspection results for the first set of packets using a first anomaly detection model, and wherein the machine learning-based anomaly detector is configured to analyze the results of the deep packet inspection of the second set of packets using a second anomaly detection model.

12 . The method as in claim 8 , wherein the determined second packet capture criterion comprises at least one of: one or more network address prefixes, one or more network address ranges, one or more ports, access control list information, one or more interfaces, or one or more applications associated with traffic in the network.

13 . An apparatus, comprising:
one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and adapted to execute one or more processes; and s a memory configured to store a process executable by the processor, the process when executed configured to:
capture a first set of packets based on first packet capture criterion;
provide the captured first set of packets for deep packet inspection and anomaly detection;
receive a second packet capture criterion, wherein the second packet capture criterion differs from the first packet capture criterion;
capture a second set of packets based on the second packet capture criterion; and
provide the captured second set of packets for deep packet inspection and is anomaly detection, wherein the anomaly detection of the captured first and second sets of packets is performed by a machine learning-based anomaly detector configured to generate anomaly detection results based in part on one or more traffic metrics gathered from the network and based further in part on deep packet inspection results of packets captured in the network.

14 . The apparatus as in claim 13 , wherein the process when executed is further configured to:
generate first deep packet inspection results by performing deep packet inspection on the first set of packets; and generate a first anomaly detection result by using the first deep packet inspection results as input to the attack detector.

15 . The apparatus as in claim 13 , wherein the first or second packet capture criterion comprises at least one of: one or more network address prefixes, one or more network address ranges, one or more ports, access control list information, one or more interfaces, one or more applications associated with traffic in the network, or data indicative of when packets matching the packet capture criterion are to be captured.

16 . The apparatus as in claim 13 , wherein the process when executed is further configured to:
provide the captured first and second sets of packets to an intrusion protection system (IPS) device, wherein the IPS device is configured to use a signature-based strategy to detect network intrusions; or provide the captured first and second sets of packets to a second device in the network, wherein the second device in the network executes the machine learning-based anomaly detector.

17 . An apparatus, comprising:
one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and adapted to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to

Assignees

• Cisco Tech Inc

Inventors

• Di Pietro Andrea
• Vasseur Jean-Philippe
• Cruz Mota Javier

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title