System, method, and computer program product to automate the flagging of obscure network flows as at least potentially unwanted
View Patent ↗A system, method, and computer program product are provided for flagging a network flow as at least potentially unwanted. In use, a network flow is identified as utilizing an unknown protocol. Further, the network flow is flagged as at least potentially unwanted.
1. A computer implemented method, comprising:
using a processor to identify a network flow as utilizing an unknown, potentially unwanted protocol by determining whether the network flow transfers at least a threshold amount of data and that the network flow is non-interactive; and
using a processor to flag the network flow that includes the unknown, potentially unwanted protocol; and
performing an action on the flagged network flow, wherein the action comprises at least one of applying a rate limit to the flagged network flow or performing an analysis on the flagged network flow.
2. The method of claim 1 , wherein the threshold amount of data is transferred in a single direction.
3. The method of claim 1 , wherein using a processor to identify a network flow as utilizing an unknown, potentially unwanted protocol further comprises determining that the network flow is excluded from a predetermined list of standard protocols.
4. The method of claim 3 , wherein the predetermined list of standard protocols is manually determined by a user.
5. The method of claim 3 , wherein the predetermined list of standard protocols is read from a configuration file.
6. The method of claim 1 , wherein using a processor to identify a network flow as utilizing an unknown, potentially unwanted protocol further comprises determining that the network flow includes an unidentified byte pattern.
7. The method of claim 1 , wherein using a processor to identify a network flow as utilizing an unknown, potentially unwanted protocol further comprises determining that the network flow includes non-ASCII characters.
8. The method of claim 1 , wherein the rate limit is applied for a predetermined time period.
9. The method of claim 1 , wherein the rate limit allows network traffic that is less than or equal to a predetermined rate to be sent while network traffic that exceeds the predetermined rate may be dropped or delayed.
10. The method of claim 9 , wherein the threshold amount of data transfer involves a burst of equal-sized packets that equal a path-maximum transfer unit (MTU) of a route.
11. The method of claim 10 , wherein a computer algorithm automatically calculates the path-MTU of the route.
12. The method of claim 1 , wherein applying a rate limit to the flagged network flow further comprises applying a priority to the flagged network flow.
13. The method of claim 12 , wherein the rate limit prioritizes the network flow that is flagged as potentially unwanted with a priority higher than flagged bad protocols and a priority lower than flagged good protocols.
14. The method of claim 1 , wherein the non-interactive flow includes at least a portion of a file transfer.
15. The method of claim 1 , wherein performing an analysis on the flagged network flow further comprises identifying a plurality of flagged network flows as originating from a single source.
16. The method of claim 1 , wherein performing an analysis on the flagged network flow further comprises identifying a plurality of flagged network flows as having a plurality of different destinations.
17. The method of claim 1 , wherein performing an analysis on the flagged network flow further comprises identifying a plurality of flagged network flows as occurring within a predefined time period.
18. The method of claim 1 , wherein the network flow is flagged utilizing 802.1P tagging of each network packet of the network flow.
19. The method of claim 1 , wherein the identifying includes determining whether a threshold portion of a beginning of the network flow includes a predetermined amount of non-printable characters.
20. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for identifying a network flow as utilizing an unknown, potentially unwanted protocol by determining whether the network flow transfers at least a threshold amount of data and that the network flow is non-interactive; and
computer code for flagging the network flow that includes the unknown, potentially unwanted; and
computer code for performing an action on the flagged network flow, wherein the action comprises at least one of applying a rate limit to the flagged network flow or performing an analysis on the flagged network flow.
21. A system, comprising:
a processor for identifying a network flow as utilizing an unknown, potentially unwanted protocol by determining whether the network flow transfers at least a threshold amount of data and that the network flow is non-interactive, the processor further adapted to flag the network flow that includes the unknown, potentially unwanted protocol and perform an action on the flagged network flow, wherein the action comprises at least one of applying a rate limit to the flagged network flow or performing an analysis of the flagged network flow.
22. The system of claim 21 , wherein the processor is coupled to memory via a bus.