On-box behavior-based traffic classification
In one embodiment, a networking device in a network detects an traffic flow conveyed in the network via the networking device. The networking device generates flow data for the traffic flow. The networking device performs a classification of the traffic flow using the flow data as input to a machine learning-based classifier. The networking device performs a mediation action based on the classification of the traffic flow.
1. A method, comprising:
detecting, at a networking device in a network, a traffic flow conveyed in the network via the networking device, wherein the traffic flow is encrypted;
generating, by the networking device, behavioral flow data for the traffic flow comprising one or more of: Transport Layer Security (TLS)-based metadata regarding the traffic flow and Secure Socket Layer (SSL)-based metadata regarding the traffic flow;
performing, by the networking device, a classification of the traffic flow using the behavioral flow data as input to a machine learning-based classifier;
performing, by the networking device, a first mediation action when the classification of the traffic flow satisfies a threshold; and
performing, by the networking device, a second mediation action different from the first mediation action when the classification of the traffic flow satisfies the threshold and at least one other feature of the traffic flow satisfies a predefined condition.
2. The method as in claim 1 , wherein the first mediation action comprises generating an alert, and the second mediation action comprises blocking the traffic flow.
3. The method as in claim 1 , wherein the classification of the traffic flow characterizes a maliciousness of the traffic flow.
4. The method as in claim 1 , wherein the at least one other feature of the traffic flow comprises at least one of a source IP address of the traffic flow and a destination IP address of the traffic flow.
5. The method as in claim 1 , further comprising:
prior to performing the classification of the traffic flow, selecting, by the networking device, the machine learning-based classifier among a plurality of machine learning-based classifiers hosted by the networking device based in part on a number of bytes or packets of the traffic flow observed by the networking device.
6. The method as in claim 1 , further comprising:
receiving, at the networking device, an adjustment to the machine learning-based classifier from a supervisory device.
7. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the one or more network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the one or more processes when executed operable to:
detect a traffic flow conveyed in the network via the apparatus, wherein the traffic flow is encrypted;
generate behavioral flow data for the traffic flow comprising one or more of: Transport Layer Security (TLS)-based metadata regarding the traffic flow and Secure Socket Layer (SSL)-based metadata regarding the traffic flow;
perform a classification of the traffic flow using the behavioral flow data as input to a machine learning-based classifier;
perform a first mediation action when the classification of the traffic flow satisfies a threshold; and
perform a second mediation action different from the first mediation action when the classification of the traffic flow satisfies the threshold and at least one other feature of the traffic flow satisfies a predefined condition.
8. The apparatus as in claim 7 , wherein the first mediation action comprises generating an alert, and the second mediation action comprises blocking the traffic flow.
9. The apparatus as in claim 7 , wherein the classification of the traffic flow characterizes a maliciousness of the traffic flow.
10. The apparatus as in claim 7 , wherein the at least one other feature of the traffic flow comprises at least one of a source IP address of the traffic flow and a destination IP address of the traffic flow.
11. The apparatus as in claim 7 , wherein the one or more processes when executed are further operable to:
prior to performing the classification of the traffic flow, select the machine learning-based classifier among a plurality of machine learning-based classifiers hosted by the apparatus based in part on a number of bytes or packets of the traffic flow observed by the apparatus.
12. The apparatus as in claim 7 , wherein the one or more processes when executed are further operable to:
receive an adjustment to the machine learning-based classifier from a supervisory device.
13. A tangible, non-transitory, computer-readable medium that stores program instructions causing a networking device in a network to execute a process comprising:
detecting, at a networking device in a network, a traffic flow conveyed in the network via the networking device, wherein the traffic flow is encrypted;
generating, by the networking device, behavioral flow data for the traffic flow comprising one or more of: Transport Layer Security (TLS)-based metadata regarding the traffic flow and Secure Socket Layer (SSL)-based metadata regarding the traffic flow;
performing, by the networking device, a classification of the traffic flow using the behavioral flow data as input to a machine learning-based classifier;
performing, by the networking device, a first mediation action when the classification of the traffic flow satisfies a threshold; and
performing, by the networking device, a second mediation action different from the first mediation action when the classification of the traffic flow satisfies the threshold and at least one other feature of the traffic flow satisfies a predefined condition.
14. The tangible, non-transitory, computer-readable medium as in claim 13 , wherein the first mediation action comprises generating an alert, and the second mediation action comprises blocking the traffic flow.
15. The tangible, non-transitory, computer-readable medium as in claim 13 , wherein the classification of the traffic flow characterizes a maliciousness of the traffic flow.
16. The tangible, non-transitory, computer-readable medium as in claim 13 , wherein the at least one other feature of the traffic flow comprises at least one of a source IP address of the traffic flow and a destination IP address of the traffic flow.
17. The tangible, non-transitory, computer-readable medium as in claim 13 , wherein the networking device is internal to the network and in communication with one or more network edge devices located on an edge of the network.