On-box behavior-based traffic classification
In one embodiment, a networking device in a network detects an traffic flow conveyed in the network via the networking device. The networking device generates flow data for the traffic flow. The networking device performs a classification of the traffic flow using the flow data as input to a machine learning-based classifier. The networking device performs a mediation action based on the classification of the traffic flow.
1. A method, comprising:
detecting, at a networking device in a network, an encrypted traffic flow conveyed in the network via the networking device;
generating, by the networking device, behavioral flow data for the encrypted traffic flow, the behavioral flow data comprising one or more of: Transport Layer Security (TLS)-based metadata regarding the encrypted traffic flow and Secure Socket Layer (SSL)-based metadata regarding the encrypted traffic flow;
selecting, by the networking device, a machine learning-based classifier among a plurality of machine learning-based classifiers hosted by the networking device based on one or more characteristics of the encrypted traffic flow; and
performing, by the networking device, a classification of the encrypted traffic flow using the behavioral flow data as input to the machine learning-based classifier that is selected by the networking device.
2. The method as in claim 1 , further comprising:
receiving, at the networking device, an adjustment to the machine learning-based classifier from a supervisory device that provides supervisory control over the network.
3. The method as in claim 1 , wherein the machine learning-based classifier is configured to assess a maliciousness of the encrypted traffic flow.
4. The method as in claim 1 , wherein the networking device selects the machine learning-based classifier based in part on a number of bytes or packets of the encrypted traffic flow.
5. The method as in claim 1 , further comprising:
performing, by the networking device, a mediation action when the classification of the encrypted traffic flow indicates that the encrypted traffic flow is suspicious or malicious.
6. The method as in claim 5 , wherein the mediation action comprises at least one of generating an alert and blocking the encrypted traffic flow.
7. The method as in claim 1 , wherein the networking device is a switch or a router through which the encrypted traffic flow flows.
8. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the one or more processes when executed operable to:
detect an encrypted traffic flow conveyed in the network via the apparatus;
generate behavioral flow data for the encrypted traffic flow, the behavioral flow data comprising one or more of: Transport Layer Security (TLS)-based metadata regarding the encrypted traffic flow and Secure Socket Layer (SSL)-based metadata regarding the encrypted traffic flow;
select a machine learning-based classifier among a plurality of machine learning-based classifiers hosted by the apparatus based on one or more characteristics of the encrypted traffic flow; and
perform a classification of the encrypted traffic flow using the behavioral flow data as input to the machine learning-based classifier that is selected by the apparatus.
9. The apparatus as in claim 8 , wherein the one or more processes when executed are further operable to:
receive an adjustment to the machine learning-based classifier from a supervisory device that provides supervisory control over the network.
10. The apparatus as in claim 8 , wherein the machine learning-based classifier is configured to assess a maliciousness of the encrypted traffic flow.
11. The apparatus as in claim 8 , wherein the apparatus selects the machine learning-based classifier based in part on a number of bytes or packets of the encrypted traffic flow.
12. The apparatus as in claim 8 , wherein the one or more processes when executed are further operable to:
perform a mediation action when the classification of the encrypted traffic flow indicates that the encrypted traffic flow is suspicious or malicious.
13. The apparatus as in claim 12 , wherein the mediation action comprises at least one of generating an alert and blocking the encrypted traffic flow.
14. The apparatus as in claim 8 , wherein the apparatus is a switch or a router through which the encrypted traffic flow flows.
15. A tangible, non-transitory, computer-readable medium that stores program instructions causing a networking device in a network to execute a process comprising:
detecting, at the networking device, an encrypted traffic flow conveyed in the network via the networking device;
generating, by the networking device, behavioral flow data for the encrypted traffic flow, the behavioral flow data comprising one or more of: Transport Layer Security (TLS)-based metadata regarding the encrypted traffic flow and Secure Socket Layer (SSL)-based metadata regarding the encrypted traffic flow;
selecting, by the networking device, a machine learning-based classifier among a plurality of machine learning-based classifiers hosted by the networking device based on one or more characteristics of the encrypted traffic flow; and
performing, by the networking device, a classification of the encrypted traffic flow using the behavioral flow data as input to the machine learning-based classifier that is selected by the networking device.
16. The tangible, non-transitory, computer-readable medium as in claim 15 , wherein the machine learning-based classifier is configured to assess a maliciousness of the encrypted traffic flow.
17. The tangible, non-transitory, computer-readable medium as in claim 15 , wherein the networking device selects the machine learning-based classifier based in part on a number of bytes or packets of the encrypted traffic flow.
18. The tangible, non-transitory, computer-readable medium as in claim 15 , wherein the process further comprises:
performing, by the networking device, a mediation action when the classification of the encrypted traffic flow indicates that the encrypted traffic flow is suspicious or malicious.
19. The tangible, non-transitory, computer-readable medium as in claim 15 , wherein the networking device is a switch or a router through which the encrypted traffic flow flows.
20. The tangible, non-transitory, computer-readable medium as in claim 15 , wherein the networking device is internal to the network and in communication with one or more network edge devices located on an edge of the network.