Multi-level learning for classifying traffic flows from first packet data
Disclosed herein are systems and methods for multi-level classification of data traffic flows based on information in a first data packet for a data traffic flow. In exemplary embodiments of the present disclosure, a key can be generated to track data traffic flows by application names and data packet information or properties. Based on these keys, patterns can be discerned to infer data traffic information based on only the information in a first data packet. The determined patterns can be used to predict classifications of future traffic flows with similar key information. In this way, data traffic flows can be classified and steered in a network based on limited information available in a first data packet.
1. A method of selecting a network path for transmitting data across a network based on header information extracted from a first data packet of a data flow, the method comprising:
receiving at a first network appliance, a first data packet of a data flow to be transmitted across a network;
extracting information from a header of the first data packet of the data flow;
generating a key representing the extracted information from the header of the first data packet of the data flow, the key having one or more possible key values;
tracking information regarding the first network appliance and the one or more key values of the key;
verifying that the key is present in a data structure at the first network appliance, the data structure further including information extracted from data packets of another data flow, the another dataflow commencing before the data flow;
predicting an associated application name for the data flow based on the key;
verifying that the application prediction in the data structure at the first network appliance meets a confidence threshold;
based on the application prediction, building or updating the data structure to influence a learning algorithm for future inferences;
selecting, by the first network appliance, a network path based on the application prediction; and
transmitting the first data packet of the data flow by the first network appliance based on the selected network path.
2. The method of claim 1 , further comprising:
receiving a subsequent data packet of the data flow;
determining an application name from payload information of the subsequent data packet of the data flow;
verifying that the application prediction based on the first data packet was correct; and
updating confidence information in the data structure for the key associated with the extracted information from the header of the first data packet, wherein the confidence information comprises a counter.
3. The method of claim 1 , further comprising:
receiving a subsequent data packet of the data flow;
determining an application name from payload information of the subsequent data packet of the data flow;
determining that the application prediction based on the first data packet was incorrect; and
updating confidence information in the data structure for the key associated with the extracted information from the header of the first data packet.
4. The method of claim 1 , further comprising transforming the extracted information from the header of the first data packet prior to generating the key.
5. The method of claim 1 , further comprising transforming the generated key.
6. The method of claim 5 , wherein the transforming the generated key comprises hashing the generated key.
7. The method of claim 1 , further comprising: performing network address translation based on the selected network path to change at least one of a source network address, destination network address, destination port, and a source port in packets of the data flow.
8. A method for inferring an application name from header information extracted from a first data packet of a data flow, the method comprising:
receiving at a first network appliance, a first data packet of a data flow to be transmitted across a network;
extracting information from a header of the first data packet;
building a key from the extracted information, the key having one or more possible key values;
tracking information regarding the first network appliance and the one or more key values of the key;
determining that the key is present in one or more data structures at the first network appliance, the one or more data structures comprising information regarding keys and associated application names, the one or more data structures further including information extracted from data packets of another data flow, the another dataflow commencing before the data flow;
verifying that a prediction confidence level for an application name associated with the key that is present in the one or more data structures meets a confidence threshold;
predicting an application name for the first data packet of the data flow;
based on the prediction, building or updating the data structure to influence a learning algorithm for future inferences; and
determining a network path for transmission of the data flow based on the predicted application name.
9. The method of claim 8 , wherein the key is present in the one or more data structures as a hash value.
10. The method of claim 8 , wherein the confidence threshold is variable.
11. The method of claim 8 , further comprising:
receiving a subsequent data packet of the data flow;
determining an application name from payload information of the subsequent data packet of the data flow;
verifying that predicted application name based on the first data packet was correct; and
updating confidence information in the data structure for the key associated with the extracted information from the header of the first data packet.
12. The method of claim 8 , further comprising:
receiving a subsequent data packet of the data flow;
determining an application name from payload information of the subsequent data packet of the data flow;
determining that the predicted application name based on the first data packet was incorrect; and
updating confidence information in the data structure for the key associated with the extracted information from the header of the first data packet.
13. The method of claim 8 , wherein the extracted information from the header of the first data packet comprises at least one of source IP address, destination IP address, source port, destination port, and protocol.
14. The method of claim 8 , wherein the key string built from the extracted information comprises a source IP address and a destination IP address.
15. The method of claim 8 , wherein the key string built from the extracted information comprises a minimum value of a source port and a destination port.
16. The method of claim 8 , further comprising transforming the extracted information from the header of the first data packet prior to building the key.
17. The method of claim 1 , wherein the confidence threshold is variable.
18. The method of claim 1 , wherein the extracted information from the header of the first data packet comprises at least one of source IP address, destination IP address, source port, destination port, and protocol.
19. The method of claim 1 , wherein the key generated from the extracted information comprises a source IP address and a destination IP address.
20. The method of claim 1 , wherein the key generated from the header of the first data packet comprises at least one of source IP address, destination IP address, source port, destination port, and protocol.