FIELD

The present disclosure relates generally to handling of computer network traffic. More particularly, the present disclosure relates to a system and method for classifying traffic and the handling of encrypted traffic.

BACKGROUND

Internet Data traffic continues to grow and is becoming increasingly encrypted in nature, with over 50% of internet traffic already encrypted and the number rising to 80% in some developed markets. Advanced encryption protocols such as TLS 1.3, Encrypted SNI and Encrypted DNS are either being adopted now or are likely to be widely adopted in the near future. At the same time, network operators continue to need to understand what applications and services are being transmitted over the network they operate in order to perform a variety of tasks, such as, but not limited, to ensuring quality of experience, congestion management, advanced data services and billing and charging related services including data fraud detection. In the face of increased encryption, accurately identifying the services in use is a challenge.

Meta data (data points) such as IP addresses, hostnames, SNI (Server Name Identification), SSL Certificate information, DNS records and HTTP User Agents are traditionally used to classify applications and services. With encrypted traffic, some or all of these data points may not be available.

Preserving network visibility has been identified by network operators as critical in evolving their infrastructure to next generation technologies. Without the right data to feed the decision making process, network operators will struggle to meet the conflicting demands of subscriber's expectations of network quality and the demands of financial markets to reduce CAPEX and OPEX.

As such, there is a need for an improved system and method for classifying network traffic.

The above information is presented only to assist with an understanding of the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with regard to the present disclosure.

SUMMARY

In a first aspect, there is provided a system and method for classifying network traffic that includes encrypted data.

According to an aspect herein, there is provided a method for classifying network traffic including: providing a framework of models configured to classify network traffic; determining whether the network traffic flow is encrypted; if the network traffic flow is encrypted: extracting encrypted flow attributes associated with a network traffic flow; deriving further flow attributes based on the extracted encrypted flow attributes; determining at least one model of the framework of models based on the derived flow attributes and extracted encrypted flow attributes; and classifying the traffic flow as a category based on the at least one model; and if the network traffic flow is not encrypted: extracting non-encrypted flow attributes associated with a network traffic flow; classifying the traffic flow as a category of traffic based on the non-encrypted flow attributes.

In some cases, the classifying the traffic flow may include determining a type of service represented by the traffic flow. In this or other cases, the classifying the traffic flow may include determining at least one feature associated with the traffic flow.

In some cases, the method for classifying network traffic may further include: determining a confidence level of the classification of the traffic flow; comparing the confidence level with a predetermined threshold; if the confidence level is higher than the predetermined threshold, marking the flow as classified; and if the confidence level is lower than the predetermined threshold, determining whether any further model may be used to classify the traffic.

In some cases, the method for classifying network traffic may further include: determining an accuracy level for at least one model of the frameworks of models; comparing the accuracy level to a predetermined accuracy threshold; if the accuracy level is higher than the accuracy threshold, continue using the at least one model of the framework of models; otherwise, updating or removing the model from the framework of models.

In some cases, the network traffic flow categories may be selected from a group comprising: Web Browsing; Video Streaming; Bulk Data Transfer; Peer to Peer (P2P) Data Transfer; Virtual Private Networks (VPN); and Voice Over IP (VoIP).

In some cases, the method for classifying network traffic may further include: determining whether the category of the network traffic has a classifier or sub-classifier; if there a classifier or sub-classifier, determining the classifier or sub-classifier based on the derived and extracted flow categories; otherwise classifying the traffic as the category of network traffic.

According to another aspect herein, there is provided a system for classifying network traffic including: a framework of models configured to classify network traffic; a packet processing engine configured to determine whether the network traffic flow is encrypted; the packet processing engine further configured to extract encrypted flow attributes associated with a network traffic flow and deriving further flow attributes based on the extracted encrypted flow attributes if the network flow is encrypted and configured to extract non-encrypted flow attributes if the traffic flow is not encrypted; a traffic classification engine including: a deep classification engine configured to determine at least one model of the framework of models based on the derived and extracted flow attributes and classify the traffic flow based on the at least one model; and a signature classification engine configured to classify the traffic flow as a category of traffic based on the non-encrypted flow attributes.

In some cases, the classifying the traffic flow may include determining a type of service represented by the traffic flow. In this or other cases, the classifying the traffic flow may include determining at least one feature associated with the traffic flow.

In some cases, the deep classification engine is further configured to: determine a confidence level of the classification of the traffic flow; compare the confidence level with a predetermined threshold; if the confidence level is higher than the predetermined threshold, mark the flow as classified; and if the confidence level is lower than the predetermined threshold, determine whether any further model may be used to classify the traffic.

In some cases, the system for classifying network traffic may further include: a model monitoring module configured to: determine an accuracy level for at least one model of the frameworks of models; compare the accuracy level to a predetermined accuracy threshold; if the accuracy level is higher than the accuracy threshold, continue using the at least one model of the framework of models; otherwise, removing the model from the framework of models.

In some cases, the network traffic category may be selected from the group comprising: Web Browsing; Video Streaming; Bulk Data Transfer; Peer to Peer (P2P) Data Transfer; Virtual Private Networks (VPN); and Voice Over IP (VoIP).

In some cases, the traffic classification engine may be further configured to: determine whether the category of the network traffic has a classifier or sub-classifier; if there a classifier or sub-classifier, determine the classifier or sub-classifier based on the derived and extracted flow categories; otherwise classify the traffic as the category of network traffic.

According to another aspect herein, there is provided a method for building a framework of models for classifying network traffic, the method including: for each type of traffic flow to be classified: create a traffic flow with data labels; extract flow attributes associated with the traffic flow; derive flow attributes based on the extracted flow attributes; compare extracted flow attributes and derived flow attributes with the data labels; and determine a model for the traffic flow based on the compared flow attributes.

In some cases, the comparing the extracted flow attributes and derived flow attributes with the data labels may include: normalizing the flow attributes; aggregating the flow attributes; and deriving any additional data points required to perform the comparison.

In some cases, the method of building a framework of models may further include: reviewing the flow attributes associated with the model to determine any redundancy; removing redundant flow attributes; and removing highly correlated data points in the model.

In some further cases, the method of building a framework of models may further include: reviewing each model for each type of traffic flow to be classified; and determining whether the models are relatively proportioned for a plurality of services associated with each type of traffic flow.

Other aspects and features of the present disclosure will become apparent to those ordinarily skilled in the art upon review of the following description of specific embodiments in conjunction with the accompanying figures.

