Classifying applications or activities based on network behavior

    公开(公告)号:US10063434B1

    公开(公告)日:2018-08-28

    申请号:US15690135

    申请日:2017-08-29

    IPC分类号: H04L12/26 G06N99/00 H04L29/08

    摘要: Embodiments are directed to monitoring network traffic in a network. A network monitoring engine may be employed to monitor the network to provide metric profiles based on a plurality of characteristics associated with one or more network flows. The network monitoring engine may provide profile objects based on the metric profiles. The network monitoring engine may provide the profile objects to a classifier engine. The classifier engine provide trained activity models selected from a plurality of trained activity models that may be based on a ranked ordering of characteristics of the trained activity models and the profile objects. The classifier engine may provide classification results for the profile objects based on the trained activity models. And, the network monitoring engine may execute policies based on the classification results associated with the profile objects.

    Correlating causes and effects associated with network activity

    公开(公告)号:US11012329B2

    公开(公告)日:2021-05-18

    申请号:US16565109

    申请日:2019-09-09

    IPC分类号: H04L12/26

    摘要: Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

    CORRELATING CAUSES AND EFFECTS ASSOCIATED WITH NETWORK ACTIVITY

    公开(公告)号:US20220070073A1

    公开(公告)日:2022-03-03

    申请号:US17318423

    申请日:2021-05-12

    IPC分类号: H04L12/26

    摘要: Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

    Correlating causes and effects associated with network activity

    公开(公告)号:US10411978B1

    公开(公告)日:2019-09-10

    申请号:US16100116

    申请日:2018-08-09

    IPC分类号: H04L12/26

    摘要: Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

    Correlating causes and effects associated with network activity

    公开(公告)号:US11496378B2

    公开(公告)日:2022-11-08

    申请号:US17318423

    申请日:2021-05-12

    摘要: Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

    CORRELATING CAUSES AND EFFECTS ASSOCIATED WITH NETWORK ACTIVITY

    公开(公告)号:US20200052985A1

    公开(公告)日:2020-02-13

    申请号:US16565109

    申请日:2019-09-09

    IPC分类号: H04L12/26

    摘要: Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

    Classifying applications or activities based on network behavior

    公开(公告)号:US10382296B2

    公开(公告)日:2019-08-13

    申请号:US16113442

    申请日:2018-08-27

    IPC分类号: H04L12/26 G06N20/00 H04L29/08

    摘要: Embodiments are directed to monitoring network traffic in a network. A network monitoring engine may be employed to monitor the network to provide metric profiles based on a plurality of characteristics associated with one or more network flows. The network monitoring engine may provide profile objects based on the metric profiles. The network monitoring engine may provide the profile objects to a classifier engine. The classifier engine provide trained activity models selected from a plurality of trained activity models that may be based on a ranked ordering of characteristics of the trained activity models and the profile objects. The classifier engine may provide classification results for the profile objects based on the trained activity models. And, the network monitoring engine may execute policies based on the classification results associated with the profile objects.

    CLASSIFYING APPLICATIONS OR ACTIVITIES BASED ON NETWORK BEHAVIOR

    公开(公告)号:US20190068465A1

    公开(公告)日:2019-02-28

    申请号:US16113442

    申请日:2018-08-27

    IPC分类号: H04L12/26 G06N99/00

    摘要: Embodiments are directed to monitoring network traffic in a network. A network monitoring engine may be employed to monitor the network to provide metric profiles based on a plurality of characteristics associated with one or more network flows. The network monitoring engine may provide profile objects based on the metric profiles. The network monitoring engine may provide the profile objects to a classifier engine. The classifier engine provide trained activity models selected from a plurality of trained activity models that may be based on a ranked ordering of characteristics of the trained activity models and the profile objects. The classifier engine may provide classification results for the profile objects based on the trained activity models. And, the network monitoring engine may execute policies based on the classification results associated with the profile objects.