Network traffic identification using machine learning
Systems and methods include obtaining historical data of traffic for a plurality of locations for a cloud service; labeling the historical data as one of human and server based on a plurality of features; and utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server. The steps can further include utilizing the trained machine learning model to classify unauthenticated traffic, for the cloud service, from a specific location or a specific IP address.
1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
obtaining historical data of traffic for a plurality of locations for a cloud service;
labeling the historical data as one of human and server based on a plurality of features;
utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server;
monitoring traffic and labeling the monitored traffic as originating from any of authenticated users and unauthenticated locations, wherein the traffic is labeled as originating from an unauthenticated location based on the traffic being tunneled via a tunnel originating from a location, the tunnel including all traffic from the location and not identifying each user or server within the location; and
utilizing the trained machine learning model to classify traffic originating from the unauthenticated locations, wherein the traffic originating from the unauthenticated locations is given a server score.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the steps include
utilizing the trained machine learning model to assign a server score to a specific location of the plurality of locations; and
responsive to the specific location being assigned an intermediate server score from the trained machine learning model, utilizing the machine learning model to perform a more granular analysis comprising analyzing individual Internet Protocol (IP) addresses associated with the specific location.
3. The non-transitory computer-readable storage medium of claim 2 , wherein the trained machine learning model classifies the traffic labeled as originating from unauthenticated locations as a split between human and server for an entire location.
4. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of features include social networking traffic being labeled as human.
5. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of features include daily activity with activity around a day being labeled as server and activity within business hours being labeled as human.
6. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of features include number of days active with activity every day being labeled as server and activity only during business days being labeled as human.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of features include number of unique hostnames visited by the traffic where less unique hostnames are labeled as server and more unique hostnames are labeled as human.
8. The non-transitory computer-readable storage medium of claim 1 , wherein the plurality of features include distinct applications visited by the traffic where traffic visiting less distinct applications are labeled as server and traffic visiting more distinct applications are labeled as human.
9. The non-transitory computer-readable storage medium of claim 1 , wherein the machine learning model utilizes Gradient-boosted decision trees.
10. The non-transitory computer-readable storage medium of claim 1 , wherein the steps include
utilizing the trained machine learning model to assign a server score to one or more specific IP addresses associated with a location of the plurality of locations.
11. A method comprising the steps of:
obtaining historical data of traffic for a plurality of locations for a cloud service;
labeling the historical data as one of human and server based on a plurality of features;
utilizing the labeled historical data to train a machine learning model to classify traffic as one of human and server;
monitoring traffic and labeling the monitored traffic as originating from any of authenticated users and unauthenticated locations, wherein the traffic is labeled as originating from an unauthenticated location based on the traffic being tunneled via a tunnel originating from a location, the tunnel including all traffic from the location and not identifying each user or server within the location; and
utilizing the trained machine learning model to classify traffic originating from the unauthenticated locations, wherein the traffic originating from the unauthenticated locations is given a server score.
12. The method of claim 11 , wherein the steps include
utilizing the trained machine learning model to assign a server score to a specific location of the plurality of locations; and
responsive to the specific location being assigned an intermediate server score from the trained machine learning model, utilizing the machine learning model to perform a more granular analysis comprising analyzing individual Internet Protocol (IP) addresses associated with the specific location.
13. The method of claim 12 , wherein the trained machine learning model classifies the traffic labeled as originating from unauthenticated locations as a split between human and server for an entire location.
14. The method of claim 11 , wherein the plurality of features include social networking traffic being labeled as human.
15. The method of claim 11 , wherein the plurality of features include daily activity with activity around a day being labeled as server and activity within business hours being labeled as human.
16. The method of claim 11 , wherein the plurality of features include number of days active with activity every day being labeled as server and activity only during business days being labeled as human.
17. The method of claim 11 , wherein the plurality of features include number of unique hostnames visited by the traffic where less unique hostnames are labeled as server and more unique hostnames are labeled as human.
18. The method of claim 11 , wherein the plurality of features include distinct applications visited by the traffic where traffic visiting less distinct applications are labeled as server and traffic visiting more distinct applications are labeled as human.
19. The method of claim 11 , wherein the machine learning model utilizes Gradient-boosted decision trees.
20. The method of claim 11 , wherein the steps include
utilizing the trained machine learning model to assign a server score to one or more specific IP addresses associated with a location of the plurality of locations.