Verifying network attack detector effectiveness

Patent metadata

Field	Value
Publication number	US-9686312-B2
Application number	US-201414338852-A
Country	US
Kind code	B2
Filing date	Jul 23, 2014
Priority date	Jul 23, 2014
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

In one embodiment, a device receives a classifier tracking request from a coordinator device that specifies a classifier verification time period. During the classifier verification time period, the device classifies a set of network traffic that includes traffic observed by the device and attack traffic specified by the coordinator device. The device generates classification results based on the classified set of network traffic and provides the classification results to the coordinator device.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a device in a network, a classifier tracking request from a coordinator device that specifies a classifier verification time period, wherein the classifier verification time period is a scheduled time period at which a validation test is performed;
performing the validation test by:
classifying, by the device and during the classifier verification time period, a set of network traffic that includes traffic observed by the device and attack traffic specified by the coordinator device;
generating, by the device, classification results based on the classified set of network traffic; and
providing, by the device, the classification results to the coordinator device, the classification results used by the coordinator device to identify whether or not performance of an attack detector of the device is above a specified performance threshold for detecting an attack,
wherein the attack traffic and the observed traffic are received from one or more other devices in the network, and wherein the coordinator device instructs the one or more other devices to send the attack traffic at a low priority.

2. The method as in claim 1 , wherein classifying the set of network traffic comprises:
receiving an instruction from the coordinator device that specifies the attack traffic to be classified; and
mixing the attack traffic with the traffic observed by the device to form the set of network traffic.

3. The method as in claim 2 , wherein the instruction from the coordinator device includes the attack traffic.

4. The method as in claim 2 , further comprising:
retrieving, from a local memory of the device, the attack traffic in response to receiving the instruction from the coordinator device.

5. The method as in claim 2 , further comprising:
classifying the traffic observed by the device as a separate process from classifying the set of network traffic that includes the traffic observed by the device and the attack traffic.

6. The method as in claim 1 , further comprising:
modeling, by the device, network traffic patterns of traffic flowing through the device;
detecting, by the device, a traffic pattern change using the modeled network traffic patterns; and, in response,
requesting, from the coordinator device, coordination of an attack classifier verification test.

7. The method as in claim 1 , wherein the coordinator device uses the classification results to determine performance indices for the device.

8. An apparatus, comprising:
one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive a classifier tracking request from a coordinator device that specifies a classifier verification time period, wherein the classifier verification time period is a scheduled time period at which a validation test is performed;
classify, during the classifier verification time period, a set of network traffic that includes traffic observed by the device and attack traffic specified by the coordinator device;
generate classification results based on the classified set of network traffic; and
provide the classification results to the coordinator device, the classification results used by the coordinator device to identify whether or not performance of an attack detector of the apparatus is above a specified performance threshold for detecting an attack,
wherein the attack traffic and the observed traffic are received from one or more other devices in the network, and wherein the coordinator device instructs the one or more other devices to send the attack traffic at a low priority.

9. The apparatus as in claim 8 , wherein the set of network traffic is classified by:
receiving an instruction from the coordinator device that specifies the attack traffic to be classified; and
mixing the attack traffic with the traffic observed by the device to form the set of network traffic.

10. The apparatus as in claim 9 , wherein the instruction from the coordinator device includes the attack traffic.

11. The apparatus as in claim 9 , wherein the process when executed is further operable to:
retrieve, from the memory, the attack traffic in response to receiving the instruction from the coordinator device.

12. The apparatus as in claim 9 , wherein the process when executed is further operable to:
classify the traffic observed by the device as a separate process from classifying the set of network traffic that includes the traffic observed by the device and the attack traffic.

13. The apparatus as in claim 8 , wherein the process when executed is further operable to:
model network traffic patterns of traffic flowing through the device;
detect a traffic pattern change using the modeled network traffic patterns; and, in response,
request, from the coordinator device, coordination of an attack classifier verification test.

14. The apparatus as in claim 8 , wherein the coordinator device uses the classification results to determine performance indices for the device.

Assignees

• Cisco Tech Inc

Inventors

• Di Pietro Andrea
• Vasseur Jean-Philippe
• Cruz Mota Javier

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L67/1002

  Electricity · mapped topic

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1458 Primary

  Denial of Service · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title