System, method, and computer program product to automate the flagging of obscure flows as at least potentially unwanted
View Patent ↗A system, method, and computer program product are provided for flagging a network flow as at least potentially unwanted. In use, a network flow is identified as utilizing an unknown protocol. Further, the network flow is flagged as at least potentially unwanted.
1. A computer implemented method, comprising:
identifying, using a processor, a plurality of flagged network flows that utilize an unknown, potentially unwanted protocol, each flagged network flow having associated data;
determining, using the processor, that at least a predetermined amount of data associated with the plurality of flagged network flows originate from a single source;
determining, using the processor, the flagged network flows are associated with multiple different destinations;
identifying the single source as a peer-to-peer sharing node in response to the acts of determining; and
performing an action, based on the act of identifying, on at least some of the plurality of flagged network flows that originate from the peer-to-peer sharing node, wherein the action comprises at least applying a rate limit to the at least some of the plurality of flagged network flows.
2. The method of claim 1 , wherein the act of identifying the single source as a peer-to-peer sharing node further comprises determining whether data from the flagged network flows during a predefined time period meet a threshold.
3. The method of claim 1 , wherein the rate limit is applied for a predetermined time period.
4. The method of claim 1 , wherein the rate limit allows network traffic that is less than or equal to a predetermined rate to be sent while network traffic that exceeds the predetermined rate may be dropped or delayed.
5. The method of claim 4 , wherein the threshold amount of data transfer involves a burst of equal-sized packets that equal a path-maximum transfer unit (MTU) of a route.
6. The method of claim 5 , wherein a computer algorithm automatically calculates the path-MTU of the route.
7. The method of claim 1 , wherein the act of applying a rate limit to the flagged network flows further comprises applying a priority to the flagged network flows.
8. The method of claim 7 , wherein the rate limit prioritizes the network flow that is flagged as potentially unwanted with a priority higher than flagged bad protocols and a priority lower than flagged good protocols.
9. The method of claim 1 , wherein the act of identifying a plurality of flagged network flows comprises identifying a network flow as utilizing an unknown, potentially unwanted protocol by determining whether the network flow transfers at least a threshold amount of data and that the network flow is non-interactive.
10. The method of claim 9 , wherein the act of identifying a network flow as utilizing an unknown, potentially unwanted further comprises determining that the network flow is excluded from a predetermined list of standard protocols.
11. The method of claim 9 , wherein the act of identifying a network flow as utilizing an unknown, potentially unwanted further comprises determining that the network flow includes an unidentified byte pattern.
12. The method of claim 9 , wherein the act of identifying a network flow as utilizing an unknown, potentially unwanted further comprises determining that the network flow is excluded from a predetermined list of standard protocols.
13. The method of claim 12 , wherein the predetermined list of standard protocols is read from a configuration file.
14. The method of claim 9 , wherein the act of identifying a processor to identify a plurality of flagged network flows further comprises flagging the identified network.
15. The method of claim 14 , wherein the network flow is flagged utilizing 802.1P tagging of each network packet of the network flow.
16. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for identifying a plurality of flagged network flows that utilize an unknown, potentially unwanted protocol, each flagged network flow having associated data 1;
computer code for that at least a predetermined amount of data associated with the plurality of flagged network flows originate from a single source;
computer code for determining, using the processor, the flagged network flows are associated with multiple different destinations;
computer code for identifying the single source as a peer-to-peer sharing node in response to the acts of determining; and
computer code for performing an action, based on the act of identifying, on at least some of the plurality of flagged network flows that originate from the peer-to-peer sharing node, wherein the action comprises at least applying a rate limit to the at least some of the plurality of flagged network flows.
17. A non-transitory computer readable medium or media storing computer executable instructions for directing a processor to perform a method, the method comprising:
identifying, using a processor, a plurality of flagged network flows that utilize an unknown, potentially unwanted protocol, each flagged network flow having associated data;
determining, using the processor, that at least a predetermined amount of data associated with the plurality of flagged network flows originate from a single source;
determining, using the processor, the flagged network flows are associated with multiple different destinations;
identifying the single source as a peer-to-peer sharing node in response to the acts of determining; and
performing an action, based on the act of identifying, on at least some of the plurality of flagged network flows that originate from the peer-to-peer sharing node, wherein the action comprises at least applying a rate limit to the at least some of the plurality of flagged network flows.