Behavioral white labeling

Patent metadata

Field	Value
Publication number	US-9900342-B2
Application number	US-201414338582-A
Country	US
Kind code	B2
Filing date	Jul 23, 2014
Priority date	Jul 23, 2014
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

In one embodiment, a traffic model manager node receives data flows in a network and determines a degree to which the received data flows conform to one or more traffic models classifying particular types of data flows as non-malicious. If the degree to which the received data flows conform to the one or more traffic models is sufficient, the traffic model manager node characterizes the received data flows as non-malicious. Otherwise, the traffic model manager node provides the received data flows to a denial of service (DoS) attack detector in the network to allow the received data flows to be scanned for potential attacks.

First claim

What is claimed is:

1. A method, comprising:
receiving a data flow at a traffic model manager node in a network;
determining, by the traffic model manager node, a degree to which the received data flow conforms to one or more traffic models classifying particular types of data flows as non-malicious;
when the degree to which the received data flow conforms to the one or more traffic models is above a threshold,
characterizing, by the traffic model manager node, the received data flow as non-malicious, and
white labeling the received data flow that is characterized as non-malicious, wherein white labeled data flows cause the received data flow characterized as non-malicious to bypass a Denial of Service (DoS) attack detector executing on another network device in the network, and wherein the white labeled data flows are not scanned by the DoS attack detector; and

when the degree to which the received data flow conforms to the one or more traffic models is below the threshold, forwarding, from the traffic model manager node, the received data flow to the DoS attack detector on another network device in the network, wherein the DoS attack detector scans the received data flow for potential attacks.

2. The method as in claim 1 , wherein the degree to which the received data flow conforms to the one or more traffic models is sufficient when the degree exceeds a predetermined threshold amount.

3. The method as in claim 1 , wherein the degree to which the received data flow conforms to the one or more traffic models is sufficient when a source of the received data flow corresponds to a source from which previous data flows have been characterized as non-malicious.

4. The method as in claim 1 , wherein whether the degree to which the received data flow conforms to the one or more traffic models is sufficient is dependent on a determination made by a machine learning classifier.

5. The method as in claim 1 , further comprising:
when a particular data flow is characterized as non-malicious based on the one or more traffic models, characterizing, by the traffic model manager node, all future occurrences of the particular data flow as non-malicious.

6. The method as in claim 1 , further comprising:
when a particular data flow is characterized as non-malicious based on the one or more traffic models, characterizing, by the traffic model manager node, future occurrences of the particular data flow as non-malicious for a predetermined period of time.

7. The method as in claim 1 , further comprising:
receiving, at the traffic model manager node, an indication from a machine learning traffic modeler to install the one or more traffic models.

8. The method as in claim 1 , further comprising:
when characterizing the received data flow as non-malicious, sending, from the traffic model manager node, a message to a centralized management node indicating that the received data flow has been characterized as non-malicious.

9. The method as in claim 8 , wherein the message further indicates other sample data flows that have been characterized as non-malicious.

10. The method as in claim 1 , wherein the one or more traffic models classify particular types of data flows as non-malicious based on data flow attributes including one or more of: a source address, a destination address, a source port, a destination port, a uniform resource identifier (URI), a payload field, a flow label field, or an application type.

11. The method as in claim 1 , wherein the one or more traffic models are computed according to external requests to classify data flows having a particular attribute as non-malicious.

12. The method as in claim 1 , wherein the one or more traffic models are computed by a machine learning traffic modeler.

13. An apparatus, comprising:
one or more network interfaces to communicate with a network as a traffic model manager node;
a processor coupled to the one or more network interfaces and configured to execute a process; and
a memory configured to store program instructions which include the process executable by the processor, the process comprising:
receiving a data flow in the network;
determining a degree to which the received data flow conforms to one or more traffic models classifying particular types of data flows as non-malicious;
when the degree to which the received data flow conforms to the one or more traffic models is above a threshold,
characterizing the received data flow as non-malicious, and
white labeling the received data flow that is characterized as non-malicious, wherein white labeled data flows cause the received data flow characterized as non-malicious to bypass a Denial of Service (DoS) attack detector executing on another network device in the network, and wherein the white labeled data flows are not scanned by the DoS attack detector; and

when the degree to which the received data flow conforms to the one or more traffic models is below the threshold, forward the received data flow to the DoS attack detector on another network device in the network, wherein the DoS attack detector scans the received data flow for potential attacks.

14. The apparatus as in claim 13 , wherein the degree to which the received data flow conforms to the one or more traffic models is sufficient when the degree exceeds a predetermined threshold amount.

15. The apparatus as in claim 13 , wherein the degree to which the received data flow conforms to the one or more traffic models is sufficient when a source of the received data flows corresponds to a source from which previous data flows have been characterized as non-malicious.

16. The apparatus as in claim 13 , wherein whether the degree to which the received data flow conforms to the one or more traffic models is sufficient is dependent on a determination made by a machine learning classifier.

17. The apparatus as in claim 13 , wherein the process further comprises:
when a particular data flow is characterized as non-malicious based on the one or more traffic models, characterizing all future occurrences of the particular data flow as non-malicious.

18. The apparatus as in claim 13 , wherein the process further comprises:
when a particular data flow is characterized as non-malicious based on the one or more traffic models, characterizing future occurrences of the particular data flow as non-malicious for a predetermined period of time.

19. The apparatus as in claim 13 , wherein the process further comprises:
receiving an indication from a machine learning traffic modeler to install the one or more traffic models.

20. The apparatus as in claim 13 , wherein the process further comprises:
when characterizing the received data flow as non-malicious, sending a message to a centralized management node indicating that the received data flow has been characterized as non-malicious.

21. The apparatus as in claim 20 , wherein the message further indicates other sample data flows that have been characterized as non-malicious.

22. The apparatus as in claim 13 , wherein the one or more traffic models classify particular types of data flows as non-malicious based on data flow attributes including one or more of: a source address, a destination address, a source port, a destination port, a uniform resource identifier (URI), a payload field, a flow label field, or an application type.

23. The apparatus as in claim 13 , wherein the one or more traffic models are computed according to external requests to

Assignees

• Cisco Tech Inc

Inventors

• Cruz Mota Javier
• Vasseur Jean Philippe
• Di Pietro Andrea

Classifications

• H04L63/1458 Primary

  Denial of Service · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title