Multiple sourced classification
Systems, methods, and related technologies for improving classification use multiple classification resources. Network traffic from a network may be accessed and an entity may be selected. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. A first classification result of the entity based on accessing one or more local profiles is determined by a processing device. In response to the first classification result meeting a condition, one or more values associated with one or more properties associated with the entity may be sent (e.g., to a cloud based classification resource). A second classification result may be received. The second classification result may be determined based one accessing at least one remote profile. At least one of the first classification result or the second classification result may be stored.
1. A method comprising:
accessing network traffic from a network;
selecting an entity;
determining one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
determining, by a processing device, a first classification result of the entity based on accessing one or more local profiles;
in response to the first classification result meeting a condition, sending the one or more values associated with one or more properties associated with the entity;
receiving a second classification result, wherein the second classification result is determined based on accessing at least one remote profile; and
storing at least one of the first classification result or the second classification result.
2. The method of claim 1 , wherein the condition comprises at least one of being unclassified, a confidence associated with the first classification result being below a confidence threshold, or a granularity associated with the first classification being below a granularity threshold.
3. The method of claim 1 further comprising:
performing an action based on at least one of the first classification result or the second classification result.
4. The method of claim 1 , wherein the sending comprises sending the one or more values associated with one or more properties associated with the entity to at least one of a cloud resource or a cloud classification engine.
5. The method of claim 1 further comprising:
in response to the first classification result being a classification of the entity, determining whether a profile associated with the first classification result is the latest profile available.
6. The method of claim 5 further comprising:
in response to the first classification result being a classification of the entity and the profile associated with the first classification result being the latest profile available, determining whether the first classification result is above at least one of a granularity threshold or a confidence threshold.
7. The method of claim 1 , wherein the second classification result is based on at least one of a proximity based classification or a machine learning based classification.
8. The method of claim 1 , wherein the one or more local profiles comprise a plurality of profiles selected based on popularity.
9. The method of claim 1 further comprising:
receiving a selection of at least one of a vertical or a profile package; and
accessing the one or more profiles based on at least one of the vertical or the profile package.
10. The method of claim 1 , wherein the sending of the one or more values associated with the entity further comprises encoding the one or more values associated with the entity.
11. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
access network traffic from a network;
select an entity;
determine one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
determine, by a processing device, a first classification result of the entity based on accessing one or more local profiles;
in response to the first classification result meeting a condition, send the one or more values associated with one or more properties associated with the entity;
receive a second classification result, wherein the second classification result is determined based on accessing at least one remote profile; and
store at least one of the first classification result or the second classification result.
12. The system of claim 11 , wherein the condition comprises at least one of being unclassified, a confidence associated with the first classification result being below a confidence threshold, or a granularity associated with the first classification being below a granularity threshold.
13. The system of claim 11 , the processing device further to:
perform an action based on at least one of the first classification result or the second classification result.
14. The system of claim 11 , wherein to send, the processing device to send the one or more values associated with one or more properties associated with the entity to at least one of a cloud resource or a cloud classification engine.
15. The system of claim 11 , the processing device further to:
in response to the first classification result being a classification of the entity, determine whether a profile associated with the first classification result is the latest profile available.
16. The system of claim 15 , the processing device further to:
in response to the first classification result being a classification of the entity and the profile associated with the first classification result being the latest profile available, determine whether the first classification result is above at least one of a granularity threshold or a confidence threshold.
17. The system of claim 11 , wherein the second classification result is based on at least one of a proximity based classification or a machine learning based classification.
18. The system of claim 11 , wherein the one or more local profiles comprise a plurality of profiles selected based on at least one of popularity, a vertical, or a profile package.
19. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
access network traffic from a network;
select an entity;
determine one or more values associated with one or more properties associated with the entity, wherein the one or more values are accessed from the network traffic;
determine, by the processing device, a first classification result of the entity based on accessing one or more local profiles;
in response to the first classification result meeting a condition, send the one or more values associated with one or more properties associated with the entity;
receive a second classification result, wherein the second classification result is determined based on accessing at least one remote profile; and
store at least one of the first classification result or the second classification result.
20. The non-transitory computer readable medium of claim 19 , wherein the condition comprises at least one of being unclassified, a confidence associated with the first classification result being below a confidence threshold, or a granularity associated with the first classification being below a granularity threshold.