Network traffic detection with mitigation of anomalous traffic and/or classification of traffic

1. A method for detecting and mitigating anomalous network traffic, comprising the operations of:

with at least one processor in a network, obtaining information regarding network traffic flows, the obtained information comprising traffic pattern information and packet destination information;

with the at least one processor in the network, generating a classification model based on the obtained traffic pattern information and packet destination information, the classification model comprising one or more classification rules for classifying network traffic as normal or anomalous, the generation of the classification model further comprising training the classification model based on an Internet Protocol (IP) address, the IP address corresponding to a first attempt by a specified host to communicate with a computer in a specified country, the specified country corresponding to a location of a computer assigned to the IP address;

with the at least one processor in the network, classifying the network traffic as anomalous or normal based on the generated classification model; and

with the at least one processor in the network, initiating at least one mitigation action based on the network traffic being classified as anomalous.

2. The method of claim 1 , wherein the information comprises netflow records from a network device.

3. The method of claim 1 , wherein the information comprises DNS flow records from a DNS server.

4. The method of claim 1 , further comprising blocking or rate limiting the anomalous network traffic in response to determining that the network traffic is anomalous.

5. The method of claim 1 , further comprising notifying a user in response to the network traffic being classified as anomalous.

6. The method of claim 1 , further comprising soliciting a user to review and approve the mitigation action before the mitigation action is initiated.

7. The method of claim 1 , further comprising defining one or more mitigation rules.

8. The method of claim 7 , further comprising configuring a network device to route the network traffic based on the one or more mitigation rules.

9. The method of claim 8 , wherein the network device is configured to route normal network traffic to its original destination.

10. The method of claim 8 , wherein the network device is configured to route the anomalous network traffic for deep packet inspection.

11. The method of claim 10 , further comprising routing the network traffic to an original destination and updating the one or more classification rules based on information from the deep packet inspection regarding a false positive classification of the network traffic as anomalous network traffic, the routing and the updating being performed in response to confirming that the network traffic is not anomalous.

12. The method of claim 10 , wherein the deep packet inspection triggers a blocking or rate limiting of the anomalous network traffic in response to confirming that the network traffic is anomalous.

13. The method of claim 1 , wherein the one or more classification rules are determined using supervised learning based on a set of historically classified normal network flows and anomalous network flows.

14. The method of claim 1 , wherein the one or more classification rules are based on normal behavior of a given network traffic flow.

15. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies one or more specific Internet Protocol (IP) addresses.

16. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model identifies one or more specific communication protocols.

17. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model identifies one or more atypical Transmission Control Protocol (TCP) flags.

18. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model is characterized by an excessive number of synchronize (SYN) packets.

19. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model comprises an atypical number of requests per second.

20. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model comprises atypical volumes of data to destinations outside of a given geographic area of a computer.

21. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model comprises an amount of Internet Protocol (IP) traffic that exceeds a specified threshold.

22. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model comprises an amount of Internet Protocol (IP) traffic that exceeds a dynamically generated threshold.

23. The method of claim 1 , wherein the traffic pattern information used to generate the one or more classification rules of the classification model comprises traffic characterized by unusual packet sizes.

24. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies one or more Internet Protocol (IP) addresses that are not in a list of a top 1 million addresses.

25. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies an Internet Protocol (IP) address on an atypical port.

26. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies a first use of an Internet Protocol (IP) address in a connection with a specific host computer.

27. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies a Domain Name Server (DNS) server for looking up a domain name, the domain name being excluded from a list of a top 1 million list of domain names.

28. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies a Domain Name Server (DNS) corresponding to a first look up of a domain name.

29. The method of claim 1 , wherein the packet destination information used to generate the one or more classification rules of the classification model identifies a Domain Name Server (DNS) corresponding to a look up of a relatively new domain name.

30. A non-transitory computer readable medium comprising computer executable instructions which when executed by a computer cause the computer to perform a method comprising operations of:

with at least one processor in a network, obtaining information regarding network traffic flows, the obtained information comprising traffic pattern information and packet destination information;

with the at least one processor in the network, generating a classification model based on the obtained traffic pattern information and packet destination information, the classification model comprising one or more classification rules for classifying network traffic as normal or anomalous, wherein the traffic pattern information used to generate the one or more classification rules of the classification model comprises atypical volumes of data to destinations outside of a given geographic area of a computer;

with the at least one processor in the network, classifying the network traffic as anomalous or normal based on the generated classification model; and

with the at least one processor in the network, initiating at least one mitigation action based on the network traffic being classified as anomalous.

31. An apparatus comprising:

a memory; and

at least one processor, coupled to said memory, and operative to perform operations comprising:

with at least one processor in a network, obtaining information regarding network traffic flows, the obtained information comprising traffic pattern information and packet destination information;

with the at least one processor in the network, generating a classification model based on the obtained traffic pattern information and packet destination information, the classification model comprising one or more classification rules for classifying network traffic as normal or anomalous, wherein the packet destination information used to generate the one or more classification rules of the classification model identifies an Internet Protocol (IP) address on an atypical port;

with the at least one processor in the network, classifying the network traffic as anomalous or normal based on the generated classification model; and

with the at least one processor in the network, initiating at least one mitigation action based on the network traffic being classified as anomalous.

32. The apparatus of claim 31 , the operations further comprising blocking or rate limiting anomalous network traffic in response to determining that the network traffic is anomalous.

33. The apparatus of claim 31 , the operations further comprising notifying a user in response to network traffic being classified as anomalous.

34. The apparatus of claim 31 , further comprising soliciting a user to review and approve the mitigation action before the mitigation action is initiated.

35. The apparatus of claim 31 , further comprising defining one or more mitigation rules.

36. A method for classifying network traffic, comprising the operations of:

with at least one processor in a network, obtaining information regarding network traffic flows, the obtained information comprising traffic pattern information and packet destination information;

with the at least one processor in the network, classifying the network traffic based on one or more classification rules and the obtained information, the one or more classification rules generated based on the traffic pattern information and packet destination information, wherein the packet destination information is used to generate the one or more classification rules of the classification model, the packet destination information identifying a Domain Name Server (DNS) corresponding to a first look up of a domain name; and

with the at least one processor in the network, initiating at least one notification based on the classification of the network traffic.

37. The apparatus of claim 36 , wherein the packet destination information used to generate the one or more classification rules of the classification model comprises an Internet Protocol (IP) address, the IP address corresponding to a first attempt by a given host to communicate with a computer in a given country, the given country corresponding to a location of a computer assigned to the IP address.