Real-time network application visibility classifier of encrypted traffic based on feature engineering
Systems and methods are provided for a light-weight model for traffic classification within a network fabric. A classification model is deployed onto an edge switch within a network fabric, the model enabling traffic classification using a set of statistical features derived from packet length information extracted from the IP header for a plurality of data packets within a received traffic flow. The statistical features comprise a number of unique packet lengths, a minimum packet length, a maximum packet length, a mean packet length, a standard deviation of the packet length, a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length. Based on the calculated values for the statistical features, the edge switch determines a traffic class for the received traffic flow and tags the traffic flow with an indication of the determined traffic class.
1. An edge switch comprising:
a processor;
a memory communicatively coupled to the processor and storing non-transitory machine-readable instructions that when executed by the processor cause the processor to:
receive a traffic flow over a network fabric;
identify packet length information from an Internet protocol (IP) header for a plurality of data packets in the received traffic flow;
determine a plurality of packet length-based and run length-based statistical features based on the identified packet length information;
determine a traffic class for the received traffic flow based on the determined packet length-based and run length-based statistical features; and
tag the received traffic flow with an indication of the determined traffic class,
wherein each traffic class of a plurality of traffic classes has a unique packet length pattern defined by an aggregated set of packet length-based and run length-based statistical features determined during a training phase, and
wherein the edge switch is disposed on a geographic boundary of the network fabric.
2. The edge switch of claim 1 , wherein a run length comprises a number of times a data packet having a respective packet length within the received traffic flow repeats consecutively within the received traffic flow.
3. The edge switch of claim 1 , wherein the packet length-based statistical features comprises a number of unique packet lengths, a maximum packet length, a minimum packet length, a mean packet length, and a standard deviation of the packet length, and wherein the run length-based statistical features comprises a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length.
4. The edge switch of claim 1 , wherein the edge switch is an access switch for a network fabric and is communicatively coupled to a plurality of end user devices.
5. The edge switch of claim 1 , wherein the plurality of data packets comprises a sample of data packets within the received traffic flow.
6. The edge switch of claim 5 , wherein the sample of data packets is determined based on a sampling rate.
7. The edge switch of claim 5 , wherein the sample of data packets is determined based on a time window.
8. The edge switch of claim 1 , wherein the plurality of data packets comprises all data packets within the received traffic flow.
9. The edge switch of claim 1 , wherein tagging the received traffic flow comprises associating metadata identifying the determined traffic class with the received traffic flow.
10. The edge switch of claim 1 , wherein tagging the received traffic flow comprises adding an indication to the IP header of each of the plurality of data packets.
11. A method comprising:
receiving, by a network fabric device, a traffic flow over a network fabric;
identifying, by the network fabric device, packet length information from an Internet protocol (IP) header for a plurality of data packets in the received traffic flow;
determining, by the network fabric device, a plurality of packet length-based and run length-based statistical features based on the identified packet length information;
determining, by the network fabric device, a traffic class for the received traffic flow based on the determined packet length-based and run length-based statistical features; and
tagging, by the network fabric device, the received traffic flow with an indication of the determined traffic class,
wherein each traffic class of a plurality of traffic classes has a unique packet length pattern defined by an aggregated set of packet length-based and run length-based statistical features determined during a training phase.
12. The method of claim 11 , wherein a run length comprises a number of times a data packet having a respective packet length within the received traffic flow repeats consecutively within the received traffic flow.
13. The method of claim 11 , wherein the packet length-based statistical features comprises a number of unique packet lengths, a maximum packet length, a minimum packet length, a mean packet length, and a standard deviation of the packet length, and wherein the run length-based statistical features comprises a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length.
14. The method of claim 11 , wherein the plurality of data packets comprises a sample of data packets within the received traffic flow.
15. The method of claim 14 , wherein the sample of data packets is determined based on a sampling rate.
16. The method of claim 14 , wherein the sample of data packets is determined based on a time window.
17. The method of claim 11 , wherein the plurality of data packets comprises all data packets within the received traffic flow.
18. The method of claim 11 , wherein tagging the received traffic flow comprises associating metadata identifying the determined traffic class with the received traffic flow.
19. The method of claim 11 , wherein tagging the received traffic flow comprises adding an indication to the IP header of each of the plurality of data packets.
20. A networking device comprising:
a processor;
a memory communicatively coupled to the processor and storing non-transitory machine-readable instructions that when executed by the processor cause the processor to:
receive a traffic flow over a network fabric;
identify packet length information from an Internet protocol (IP) header for a plurality of data packets in the received traffic flow;
determine a plurality of packet length-based and run length-based statistical features based on the identified packet length information;
determine a traffic class for the received traffic flow based on the determined packet length-based and run length-based statistical features; and
tag the received traffic flow with an indication of the determined traffic class,
wherein each traffic class of a plurality of traffic classes has a unique packet length pattern defined by an aggregated set of packet length-based and run length-based statistical features determined during a training phase, and
wherein the networking device is configured to perform traffic classification for a plurality of received traffic flows in real-time.