TECHNICAL FIELD

The present disclosure relates generally to computer networks, and, more particularly, to on-box behavior-based traffic classification.

BACKGROUND

Malicious or otherwise undesirable network traffic can take many different forms. For example, some traffic may seek to overwhelm a service by sending a large number of requests to the service. Such attacks are also sometimes known as denial of service (DoS) attacks. Other forms of malicious traffic may seek to exfiltrate sensitive information from a network, such as credit card numbers, trade secrets, and the like. Typically, such traffic is generated by a client that has been infected with malware. Thus, a further type of malicious network traffic includes network traffic that propagates the malware itself. Additionally, some network traffic may simply be deemed inappropriate for a particular network.

Intrusion prevention systems (IPS), next-generation firewalls, and flow monitoring systems generally attempt to detect and block malicious traffic, whenever possible. However, in recent years, the amount of encrypted and evasive network traffic has increased considerably. Notably, with the advent of transport layer security (TLS) and other security mechanisms, many websites are now encrypting even traditional webpage data. This presents certain challenges to traditional security systems as the contents of the traffic may not be available for analysis and pattern matching is generally inapplicable to encrypted traffic.

