System and method for classifying traffic flows using language processing

1 . A method for classifying traffic flows on a computer network, the method comprising:

determining sender information associated with a traffic flow;

determining Whols data associated with the sender information, from a Whols database;

determining online information associated with the Whols data, comprising:

searching an online search provider or online information source, not associated with the Whols database, with the Whols data;

determining the online information from text information related to a domain name and HTML meta data of search results from the online search provider;

parsing the online information for keywords, wherein a natural language model is configured to determine a frequency of keywords associated with a category of application type of the traffic flow, wherein the natural language model combines computational linguistics with machine learning;

extracting at least one known traffic signature from the traffic flow; and

classifying the traffic flow as an application type based on the keywords or natural language description and the extracted traffic signature.

2 . The method of claim 1 wherein parsing the online information comprises:

using a natural language model to infer the application type based on the keywords or text from the online information and a writer's intent and sentiment of the text.

3 . The method of claim 1 wherein the sender information comprises at least one of IP Address, hostname or Server Name Indication (SNI).

4 . The method of claim 1 wherein determining online information associated with the Whols data comprises querying an online Whols database.

5 . The method of claim 1 wherein determining online information associated with the Whols data comprises:

creating a URL with the Whols data or hostname;

determining whether the created URL is an active online website; and

determining online information from the website.

6 . The method of claim 1 wherein the traffic flow is a torrent flow and the online information is an infohash associated with the traffic flow.

7 . The method of claim 1 further comprising using the natural language module to determine URL metadata as part of the online information.

8 . The method of claim 1 further comprising parsing the HTML code to provide an indication of the primary traffic category of the website.

9 . The method of claim 1 further comprising using convolutional neural networks in addition to the natural language module.

10 . The method of claim 1 where the keywords infer or imply a particular application category or type.

11 . The system of claim 1 wherein the language module comprises convolutional neural networks.

12 . A system for classifying traffic flows on a computer network, the system comprising at least one processor configured to execute instructions stored in a memory component wherein the instructions provide for modules comprising:

a Whols module configured to determine sender information associated with a traffic flow and determine Whols data associated with the sender information from a Whols database;

a search request and response module configured to determine online information associated with the Whols data, wherein determining the online information comprises:

searching an online search provider or online information source, not associated with the Whols database, with the Whols data; and

determining the online information from text information related to a domain name and HTML meta data of search results from the online search provider;

a language model configured to parse the online information for keywords, wherein the language model is configured to determine a frequency of keywords associated with a category of application type of the traffic flow, wherein the natural language model combines computational linguistics with machine learning; and

a Service and Category recognizer configured to extract at least one known traffic signature from the traffic flow and classify the traffic flow as an application type based on the keywords or natural language descriptions and the extracted traffic signature.

13 . The system of claim 12 wherein the language model parses the online information using a natural language model to infer the application type based on the keywords from a writer's intent and sentiment of the text.

14 . The system of claim 12 wherein the sender information comprises at least one of IP Address, hostname or Server Name Indication (SNI).

15 . The system of claim 12 wherein the Whols module is configured to query an online Whols database.

16 . The system of claim 12 further comprising a URL module configured to create a URL with the Whols data or hostname.

17 . The system of claim 16 wherein the URL module is further configured to:

determine whether the created URL is an active online website; and

determine online information from the website.

18 . The system of claim 12 further comprising a torrent module configured to determine an info hash found with the traffic flow, when the traffic flow is a torrent flow.

19 . The system of claim 12 wherein the language module is further configured to determine URL metadata as part of the online information.

20 . The system of claim 12 wherein the language module is further configured to parse the HTML code to provide an indication of the primary traffic category of the website.