Classification techniques for encrypted network traffic
View Patent ↗Methods, apparatuses and systems directed to detecting network applications whose data flows have been encrypted. The present invention extends beyond analysis of explicitly presented packet attributes of data flows and holistically analyzes the behavior of host or end systems as expressed in related data flows against a statistical behavioral model to classify the data flows.
1. A method comprising:
receiving, at a network device, a data flow associated with a host;
accessing a memory maintaining a data structure comprising one or more count values for the host, wherein each of the count values correspond to a number of events detected over a time interval and wherein each event corresponding to a count value exhibits a correlation to a network application;
determining a flow affinity value by multiplying each count value by a correlation value corresponding to the count value to yield a component product and summing the component products for each count value to yield the flow affinity value; and
classifying the data flow as the network application based on a comparison of the flow affinity value to a threshold flow affinity value.
2. The method of claim 1 further comprising modifying the threshold flow affinity value over time based on analysis of network traffic observed at the network device.
3. The method of claim 1 further comprising modifying the correlation values corresponding to the one or more count values over time based on analysis of network traffic observed at the network device.
4. The method of claim 1 wherein one of the one or more count values corresponds to a number of service discovery data flows associated with the host.
5. The method of claim 1 wherein one of the one or more count values corresponds to a number of unresolved transport layer connection attempts associated with the host.
6. The method of claim 1 wherein one of the one or more count values corresponds to a number of control message data flows associated with the host.
7. The method of claim 1 wherein one of the one or more count values corresponds to a number of data flows associated with the host that have been classified according to a separate classification framework.
8. The method of claim 1 further comprising incrementing one or more of the count values for the host as events are detected; and
at periodic intervals:
storing the current count values in a data structure as previous values for use in the accessing and determining steps; and
resetting the one or more count values.
9. A method, comprising:
receiving, at a network device, a data flow associated with a host;
applying a first classification framework to classify the data flow based on attributes of individual packets of the data flow that are readily discoverable or unconcealed by encryption;
if the data flow is not classified into a network application by applying the first classification framework, then applying a second classification framework, wherein the second classification framework comprises
accessing a memory maintaining a data structure comprising one or more count values for the host, wherein each of the count values correspond to a number of events detected over a time interval and wherein each event corresponding to a count value exhibits a correlation to a network application;
determining a flow affinity value by multiplying each count value by a correlation value corresponding to the count value to yield a component product and summing the component products for each count value to yield the flow affinity value; and
classifying the data flow as the network application based on a comparison of the flow affinity value to a threshold flow affinity value.
10. The method of claim 9 further comprising modifying the threshold flow affinity value over time based on analysis of network traffic observed at the network device.
11. The method of claim 9 further comprising modifying the correlation values corresponding to the one or more count values over time based on analysis of network traffic observed at the network device.
12. The method of claim 9 further comprising modifying the correlation values corresponding to the one or more count values and the threshold flow affinity value over time based on analysis of network traffic observed at the network device.
13. An apparatus, comprising:
one or more network interfaces,
a memory;
one or more processors;
one or more code modules comprising computer-executable instructions stored on a computer readable medium, the instructions readable by the one or more processors, the instructions, when and executed, for causing the one or more processors to:
receive a data flow associated with a host;
access the memory maintaining a data structure comprising one or more count values for the host, wherein each of the count values correspond to a number of events detected over a time interval and wherein each event corresponding to a count value exhibits a correlation to a network application;
determine a flow affinity value by multiplying each count value by a correlation value corresponding to the count value to yield a component product and summing the component products for each count value to yield the flow affinity value; and
classify the data flow as the network application based on a comparison of the flow affinity value to a threshold flow affinity value.
14. The apparatus of claim 13 further comprising computer-executable instructions for causing the one or more processors to
modify the threshold flow affinity value over time based on analysis of network traffic observed at the network device.
15. The apparatus of claim 13 further comprising computer-executable instructions for causing the one or more processors to
modify the correlation values corresponding to the one or more count values over time based on analysis of network traffic observed at the network device.
16. The apparatus of claim 13 wherein one of the one or more count values corresponds to a number of service discovery data flows associated with the host.
17. The apparatus of claim 13 wherein one of the one or more count values corresponds to a number of unresolved transport layer connection attempts associated with the host.
18. The apparatus of claim 13 wherein one of the one or more count values corresponds to a number of control message data flows associated with the host.
19. The apparatus of claim 13 wherein one of the one or more count values corresponds to a number of data flows associated with the host that have been classified according to a separate classification framework.
20. The apparatus of claim 13 further comprising computer-executable instructions for causing the one or more processors to
increment one or more of the count values for the host as events are detected; and
at periodic intervals:
store the current count values in a data structure as previous values for use in the accessing and determining steps; and
reset the one or more count values.