A platform for privacy-preserving decentralized learning and network event monitoring

Abstract

Embodiments of the present disclosure relate to a platform for decentralized learning and network event monitoring with privacy preservation. Systems and methods are provided for implementing pattern detection as a first step in improving the security of computer networks. Pattern detection can predict network tuple parameters using machine learning (ML) models. ML models can be trained on labeled data flow information and deployed by a central server to prevent network-wide network security challenges (e.g., including DNS flux, etc.). Networking devices (e.g., switches, etc.) can monitor the data flow services they receive from networking devices and classify network tuple parameters based on flow behavior. The system can compare the output of the ML model (e.g., classification of data flow services, etc.) with implicit labels (e.g., network tuple parameters included with data flow services, etc.). When the classification matches a specific network tuple parameter, the system can generate an alarm and / or otherwise identify potential network intrusions and other anomalies.

Description

Background Art

[0001] Network security risks have always been prevalent. One type of security risk involves Domain Name System (DNS) technology used by botnets (e.g., private computer networks infected with malware and controlled as a group without the knowledge of the owner) to hide phishing and malware delivery sites. These sites are hidden using botnets, which can constantly change the host that acts as a malware agent. Another type of security risk is called "DNS flux," which is a combination of peer-to-peer networking, distributed command and control, web-based load balancing, and proxy redirection to make malware networks more resistant to discovery and countermeasures.

[0002] In these risk examples, a malicious application can have a large number of Internet Protocol (IP) addresses associated with a single fully qualified domain name, with IP addresses swapped in and out at an extremely high frequency (e.g., by changing DNS records). As a result, even a standard computer network trying to thwart malicious activity can be compromised. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] According to one or more various examples, the present disclosure is described in detail with reference to the following drawings. These drawings are provided for illustration purposes only and depict only typical examples.

[0004] Figure 1 A computer environment according to one or more examples of the present disclosure is illustrated.

[0005] Figure 2 Network devices in a computer environment according to one or more examples of the present disclosure are illustrated.

[0006] Figure 3 A central server in a computer environment according to one or more examples of the present disclosure is illustrated.

[0007] Figure 4 Data flows according to one or more examples of the present disclosure are illustrated.

[0008] Figure 5 is an example decentralized machine learning module that can be used to implement various features of the examples described in this disclosure.

[0009] Figure 6 are example computing components that can be used to implement various features of the examples described in this disclosure.

[0010] Figure 7 are example computing components that can be used to implement various features of the examples described in this disclosure.

[0011] Figure 8Depicted is a block diagram of an example computer system in which various examples described herein may be implemented.

[0012] The drawings are not exhaustive and do not limit the disclosure to the precise forms disclosed. DETAILED DESCRIPTION

[0013] One way to attempt to thwart the network security risks posed to DNS technology is by encrypting the transmitted data packets. However, this implementation may be counterproductive. Some networks have implemented encryption algorithms to transmit encrypted data traffic, which helps a wide range of confidential data to be continuously transmitted. Encrypted data traffic cannot be easily inspected for malicious content. When data cannot be reviewed and checked for malicious content, network security risks may enter the system undetected, thereby increasing the risk of network security issues.

[0014] Additionally, network parameters of computer devices may be removed or randomized to help hide their identities from other devices in the network. For example, the network identity of a client device via well-known network parameters may be randomized, which allows fewer processes to identify the sender of the data in addition to hiding the content of the data. While removing or randomizing the network parameters of these devices may help protect the privacy of the sending device, it also increases the security risk of the network because the users of the network cannot be identified. Therefore, the reduced ability to identify data (e.g., via encryption) and the source of data (e.g., via DNS shielding and hiding malware networks) may make it more difficult to detect malware and bad actors.

[0015] The examples of this application describe a platform for implementing pattern detection as a first step in making security improvements at network edge devices. Pattern detection can be a continuous and more sophisticated change to other systems that can similarly detect patterns in data and senders.

[0016] For example, the platform may include a machine learning (ML) model for predicting classification labels based on information associated with a data stream. The ML model may be trained on labeled data stream traffic information. The trained ML model may be deployed on one or more network devices in a decentralized manner, or at a central server in a centralized manner. Either implementation may prevent network-wide network security challenges (e.g., including DNS flux).

[0017] A networking device (e.g., a switch or other network device) can monitor data flow traffic to determine one or more flow behaviors, including inter-packet arrival times (e.g., minimum, average, maximum, standard deviation) or packet lengths (e.g., minimum, average, maximum, etc.) for a particular data flow. An ML model can receive data flow traffic from a networking device and classify network tuple parameters based on the data flow behavior. The platform can compare the output of the ML model (e.g., a classification of the data flow traffic) with an identifier or implicit label (e.g., a network tuple parameter included with the data flow traffic). When the classification matches a particular network tuple parameter, the platform can generate an alert and / or otherwise identify potential network intrusions, domain name system (DNS) issues, and other anomalies.

[0018] Technical improvements are implemented throughout this disclosure. For example, implementations can improve network security by incorporating decentralized network behavior learning. Additionally, centralized data and machine learning can reduce errors and normalize various data types to create a more streamlined processing and data analysis system.

[0019] Before describing in detail examples of the disclosed systems and methods, it is useful to describe example network installations with which these systems and methods may be implemented in various applications. Figure 1 The computer environment according to one or more examples of the present disclosure is illustrated. The computer environment may include one or more edge devices 110 (illustrated as a first edge device 110A and a second edge device 110B), a network device 120, an external network 130 (eg, the Internet), and a central server 140.

[0020] The edge device 110 may include one or more computing components that transmit data packets to other computing components in the same network or other networks. Each edge device 110 may include a hardware processor (e.g., a central processing unit (CPU), a semiconductor-based microprocessor) for retrieving and executing instructions stored in a machine-readable storage medium. The hardware processor can fetch, decode, and execute instructions to control a process or operation for transmitting data packets.

[0021] The edge device 110 may include one or more client devices (e.g., desktop computers, laptop computers, servers, or other network devices) that communicate with a controller to enable communication between the edge device 110, the network device 120, and the central server 140. The edge device 110 may include multiple controllers and / or multiple communication points. In some examples, the controller may communicate with other devices through the network device 120 that complies with the IEEE 802.11 standard to access the network 130. The controller may be operable to configure and / or manage the network device 120.

[0022] The network device 120 provides network connectivity (e.g., to the network 130) to the various edge devices 110. The network device 120 may include, for example, a switch, a router, an access point, a gateway, or other device. Using the connection to the network device 120, the edge device 110 may access network resources available on the network 130. The network device 120 may be a combination of hardware, software, and / or firmware configured to provide wireless network connectivity to wireless client devices from each network. The network device 120 may be managed and configured by a controller. Additional details of the network device 120 are provided in the following table. Figure 2 supply.

[0023] Illustrative network device 120 is Figure 2 For example, each network device 120 may include its own processor 204, machine-readable medium 206, and data flow service data repository 218. The machine-readable medium 206 may include one or more modules and engines, including a data flow service module 208, a marking module 210, a decentralized machine learning module 212, a counter module 214, and a routing action engine 216.

[0024] Processor 204 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 206. Processor 204 may fetch, decode, and execute instructions to control a process or operation for implementing routing table anomaly detection using unsupervised machine learning. As an alternative or in addition to fetching and executing instructions, processor 204 may include one or more electronic circuits including functional electronic components for executing one or more instructions, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other electronic circuits.

[0025] The machine-readable medium 206 may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. The machine-readable medium 206 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, etc. In some examples, the machine-readable medium 206 may be a non-transitory storage medium, where the term “non-transitory” does not encompass transient propagating signals.

[0026] The data flow service module 208 is configured to monitor a set of flow behaviors of the data flow service. For example, when a data packet is transmitted from the first edge device 110A to the destination device, the data flow can be received at the network device 120. The flow behavior can include, for example, the inter-packet arrival time (e.g., minimum, average, maximum, or standard deviation) or the packet length (e.g., minimum, average, or maximum) for a particular service flow.

[0027] Monitoring data flow traffic may include receiving and analyzing one or more data flows (e.g., a plurality of data packets transmitted from a source computer as a data flow, etc.) as data flow traffic received at the network device 120 from one or more edge devices 110. Once the data flows are received, the data flow traffic module 208 may apply a classification tag to a portion of the data flow traffic.

[0028] The classification label can be determined using various methods. For example, the classification label can be determined based on information from the data stream (e.g., identifiers, implicit labels, signatures, network tuples, behaviors, etc.). The information from the data stream can be provided as input to the machine learning model. The output of the machine learning model may be a classification label. In some examples, the classification label is determined by providing one or more data streams as data stream services from one or more edge devices 110 to a machine learning model at the network device 120 (e.g., using a decentralized machine learning module 212).

[0029] The data flow service module 208 is also configured to receive a set of flow behaviors of data flow services. For example, the edge device 110 can implement a process of receiving sensor data and analyzing the sensor data for behaviors and characteristics locally at the edge device 110. The sensor data can be used as data flow services. In some examples, each edge device 110 can apply an implicit tag or identifier to the data flow service before sending the data flow service to the network device 120 (e.g., based on header data from the sensor).

[0030] The marking module 210 is configured to determine an implicit label for a network tuple parameter for a particular data flow. The network tuple parameter may include, for example, QOS (e.g., media type), VLAN, MAC address (e.g., source or destination MAC address), or other values ​​from a packet header. In some examples, the implicit label may include a reported value for the network tuple parameter (e.g., an identifier carried by a data packet, as reported in a packet header). An example of an implicit label associated with a network tuple parameter may include, for example, a Differentiated Services Code Point (DSCP) code corresponding to a Quality of Service (QOS) value. The DSCP code may use a 6-bit Differentiated Services (DS) field in an IP header for the purpose of packet classification.

[0031] Data with data flow traffic may include one or more labeled network tuples. The labeled network tuples may include, for example, quality of service (QoS) (e.g., media type), virtual local area network (VLAN), media access control (MAC) address (e.g., source or destination), source IP address, destination IP address, source / destination port number, transmission control protocol / internet protocol (TCP / IP) value, and other network tuples.

[0032] Data with data stream traffic may include a digital signature. The digital signature may correspond to a mathematical algorithm to create a digital fingerprint that identifies the source device or application and verifies that the data originated from the source.

[0033] The marked network tuples and / or signatures may authenticate the flow behavior to the set of monitored flow behaviors. The application of marked network tuples and / or signatures may help predict the classification of network tuple parameters for a particular data flow.

[0034] The decentralized machine learning module 212 is configured to apply a machine learning (ML) model (e.g., supervised learning) to a set of identifiers, implicit labels, network tuples, or flow behaviors of data flow services. These values ​​can be input to a trained ML model that generates an output as a specific classification or classification label.

[0035] The ML model can be trained using role-based segmentation, such as virtual local area networks (VLANs). There can be typical behaviors within each role, as illustrated in Table 1, and each behavior corresponding to each VLAN can be provided as input to train the ML model. Once the model is trained, new behaviors can be provided as input to the trained ML model, and a classification label can be output.

[0036] The classification tag may include various values. In the example shown in Table 1, the classification tag may be one or more network tuple parameters corresponding to a specific VLAN in the network.

[0037] Table 1

[0038] data Category Tags Behavior Vlan 1[network tuple parameters] Behavior Vlan 2 [network tuple parameters]

[0039] The ML model may also be trained on the behavioral data, as illustrated in Table 2. The behavioral data may be provided as input to the trained ML model, and the VLAN may be identified as output from the trained ML model. The data flow services may be identified using determined labels corresponding to the network tuple parameters. Each flow may be compared to the network tuple parameters, and if they match, a match counter value may be incremented. If they do not match, a mismatch counter value may be incremented.

[0040] Table 2

[0041] data Predicted Label Compare Behavior ___[Network tuple parameters] Behavior ___[Network tuple parameters]

[0042] The decentralized machine learning module 212 is also configured to generate, train, and implement multiple machine learning (ML) models. Each ML model can correspond to a model identifier (ID) that can be associated with a request to apply data as input to a specific trained ML model.

[0043] The decentralized machine learning module 212 is also configured to receive a model ID corresponding to a specific ML model in the ML model set from the central server 140. The ML model set can be private (e.g., accessible by the central server 140 or the network device 120). Each ML model can include a set of public model IDs, a set of labeled network tuples, and a set of private flow signatures. In some examples, the model ID instead of the ML model can be transmitted between the central server 140 and the network device 120.

[0044] The decentralized machine learning module 212 is configured to compare the received model ID with stored model IDs corresponding to one or more stored ML models. When the model ID matches the model ID corresponding to the stored ML model, the decentralized machine learning module 212 can apply the monitored set of flow behaviors to the stored ML model to predict a classification (e.g., a classification label) of the network tuple parameters for the particular data flow. In some examples, the stored ML model is a random model (e.g., not corresponding to a model ID) from a private ML model set. This can help further maintain privacy by obfuscating the selected ML model.

[0045] In some examples, a comparison between the received model ID and the stored model ID results in a mismatch, and various actions may be initiated. In some examples, the decentralized machine learning module 212 (utilizing the routing action engine 216) may generate an alert and transmit it to the central server 140 to identify the received model ID (e.g., without a signature or without a flow behavior pattern). By sending an alert to the central server 140 without a signature, privacy is increased and risk is reduced by maintaining the signature at the network device 120, at least based on the inability of the central server 140 to identify the exact stored model ID.

[0046] In some examples, in the event of a mismatch, the received model ID, flow behavior pattern, and signature may be stored locally at the network device 120 (e.g., without transmitting the information back to the central server 140). By storing the information locally, privacy may be increased and risk may be reduced, at least by keeping the signature at the network device 120 based on the inability of the central server 140 to identify the exact stored model ID.

[0047] The decentralized machine learning module 212 is also configured to update one or more ML models. For example, a classification of network tuple parameters can be generated as an output from a first ML model. The classification and the previous input provided to the ML model can again be provided as input to a second ML model. When the first ML model is implemented at the network device 120 and the second ML model is implemented at the central server 140, this can help achieve decentralized learning capabilities.

[0048] The marking module 210 is also configured to compare the classification tag with an implicit tag (e.g., in a packet header of the data flow service). In some examples, the marking module 210 can determine whether the classification tag or the implicit tag is greater than the other tag. In some other examples, the marking module 210 can compare each tag with a threshold to determine whether one or more of the tags matches the threshold.

[0049] As an illustrative example, an implicit label may correspond to a QOS value (e.g., added to each data packet by an application at edge device 110 and dictating the amount of bandwidth or other system resources that may be used to transmit data packets along a data stream). However, there are instances where the flow behavior does not match (e.g., does not match) the attributes represented by the QOS value. This may occur for a variety of reasons, such as inherent vulnerabilities in the application browser, changes by the user themselves, network latency, backdoor firmware updates, or even malicious data packets sent along with the intended data stream. The flow behavior may be associated with a classification label determined by an ML model to objectively measure data stream traffic as the system receives and transmits data stream traffic.

[0050] The counter module 214 may be configured to increment or decrement various counter values ​​(e.g., mismatch counter values ​​or match counter values). For example, when a comparison (e.g., between a classification tag and an implicit tag, etc.) results in a mismatch, a counter for a data flow service may be incremented by the counter module 214. The larger the counter value, the greater the inconsistency with which the actual flow behavior matches the expected flow behavior. The counter may help identify the expected flow behavior (e.g., illustrated as an implicit tag in a packet header) is performing at an expected level of consistency (or inconsistency).

[0051] The counter module 214 may be configured to compare the counter value with a threshold value. When the counter exceeds the threshold value, the data flow service may still fail to meet the expected flow behavior.

[0052] In some examples, when the comparison results in a mismatch (eg, between the classification label and the implicit label), the value of the flow behavior in the implicit label can be stored locally (eg, at the data flow traffic data store 218).

[0053] In some examples, when the comparison results in a mismatch (e.g., between the classification tags in the implicit tags), the value of the flow behavior in the implicit tags may not be transmitted to the central server 140, but may be stored locally (e.g., at the data flow traffic data repository 218). In some examples, storing the value of the flow behavior locally at the network device 120 may not transmit these values ​​to the central server 140. Such a limitation on the transmission of data to the central server 140 may help allow privacy / obfuscation and reduce the risk of network security issues by reducing the amount of data transmitted via the network 130.

[0054] The routing action module 216 can be configured to perform various actions based on the data, labels, and behavior of the data flow. For example, the actions of the routing action module 216 can include generating an alarm associated with a comparison between a classification label and an implicit label for a network tuple parameter. The alarm can include a flow behavior, a suspicious activity identifier for a data flow service, or an identifier of a source or destination of a suspicious data flow. The alarm can be stored locally (e.g., at a data flow service data repository 218), can be transmitted to the central server 140, or can be transmitted to an administrative user operating a client device accessing the network 130.

[0055] When the counter is above a threshold, the alert may be updated to include a suspicious activity identifier for the data stream traffic. Other information may also be included in the alert. For example, the alert may include an ML model identifier, label data, or other information included with the data stream traffic. The alert may be transmitted to the central server 140 or an administrative user operating a client device accessing the network 130 (e.g., via the routing action engine 216).

[0056] In some examples, the alert may identify new behavior and / or include a model identifier, label data, or other information included with the data stream traffic. In this instance, the alert may be updated to identify Domain Name System (DNS) issues, such as DNS flux, or when a botnet (e.g., a private computer network infected with malware and controlled as a group without the owner's knowledge) is hiding phishing and malware delivery sites on hosts (e.g., network devices 120) that act as malware agents. This information or other information may be merged with the ML model (e.g., via machine learning model 214) to provide additional information about the new behavior.

[0057] The routing action module 216 can be configured to initiate an automatic response in the communication network. For example, one or more network ports can be re-authenticated, or data packets can be re-routed (eg, according to centralized rules).

[0058] The routing action module 216 can be configured to trigger the movement of the corresponding workload (e.g., implemented on a virtual machine (VM), or changed from a first VM to a second VM). For example, the workload can be scaled to work with any computing environment. For example, the association between the model ID and the parameter can be copied from the first computing environment to the second computing environment. The association between the model ID and the parameter can be used to reintegrate the environment into the on-premises or enterprise security monitoring of the second computing environment (e.g., via a representational state transfer (REST) ​​or other integration scheme).

[0059] In some examples, the action is determined by the central server 140 and transmitted to the network device 120 for implementation by the route action module 216. The route action module 216 can receive the action and implement the action at the network device 120. In this instance, the action determined by the central server 140 can instruct multiple network devices 120 to perform similar actions in parallel or sequentially across the multiple network devices 120.

[0060] return Figure 1 , the network 130 may be a public or private network (such as the Internet) or other communication network to allow connectivity between various devices. The network 130 may include third-party telecommunication lines, such as telephone lines, broadcast coaxial cables, fiber optic cables, satellite communications, cellular communications, etc. The network 130 may include any number of intermediate network devices, such as switches, routers, gateways, servers, and / or controllers, which are not directly part of the network configuration 100, but facilitate communication between various parts of the network configuration, as well as communication between the network configuration and other network-connected entities.

[0061] The central server 140 can provide backup and consistency at a central location across a decentralized network of network devices 120. The central server 140 can communicate with the network devices 120 via the network 130. The central server 140 can be a combination of hardware, software, and / or firmware configured to store instructions and provide integrated actions across multiple network devices 120. Additional details of the central server 140 are provided by Figure 3 supply.

[0062] Figure 3 The central server in a computer environment according to one or more examples of the present disclosure is illustrated. For example, the central server 140 includes one or more hardware processors 304, a machine-readable medium 306, a tag data repository 320, and a machine learning model data repository 322. The machine-readable medium 306 may include one or more modules and engines, including a tagging module 308, a centralized machine learning module 310, and an alert module 312.

[0063] Processor 304 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 306. Processor 304 may fetch, decode, and execute instructions to control a process or operation for implementing routing table anomaly detection using unsupervised machine learning. As an alternative or in addition to fetching and executing instructions, processor 304 may include one or more electronic circuits including functional electronic components for executing one or more instructions, such as field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), or other electronic circuits.

[0064] The machine-readable medium 306 may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. The machine-readable medium 306 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, etc. In some examples, the machine-readable medium 306 may be a non-transitory storage medium, where the term “non-transitory” does not encompass transient propagating signals.

[0065] The labeling module 308 is configured to receive classification labels based on information associated with the data flow (e.g., identifiers, implicit labels, signatures, network tuples, behaviors, etc.). The received labels may be stored at the label data repository 320. The implicit labels may be based on information contained in the data flow traffic, and the classification labels may be generated by the network device 120 using one or more processes described herein, including by a decentralized ML model.

[0066] The tagging module 308 is also configured to integrate tags from one network device 120 with other network devices. For example, the central server 140 can be a central repository for integrating any newly learned signals with other network devices in the computing environment. The central server 140 can be extended to integrate newly learned tags, behaviors, or signals, including policies, re-authentication procedures, re-validation procedures, or actions performed by other network devices in response to signals learned in other computing environments.

[0067] The centralized machine learning module 310 is configured to generate a private ML model set that is local to the central server 140 and stored at the machine learning model data repository 322. The private ML model set can be based on one or more ML models generated from the network device 120. The private ML model set can be improved at the central server 140 using distributed and decentralized ML models at the network device 120 (e.g., by expanding the training data set and / or by including additional classifications from the network device 120). In some examples, the private ML model set can include a model identifier (ID), a labeled network tuple, and a set of one or more signatures of flow behavior. The signatures and other data for the flow behavior can be private to the central server 140 to help improve data security and limit the data transmitted via the network 130.

[0068] The ML model can classify the labeled network tuples, identifiers or implicit labels, signatures and / or flow behaviors and generate new classification labels. The new classification labels can be stored in the label data repository 320. In some other examples, the classification labels are received from the network device 120.

[0069] The centralized machine learning module 310 is also configured to correlate the machine learning models stored locally using the machine learning model data repository 322 and the machine learning models received from the network device 120. Each ML model can correspond to a model ID associated with a classification label. In some examples, the centralized machine learning module 310 can determine the model ID (e.g., generated by the network device 120) from the set of model IDs corresponding to the classification label and provide the model ID to the network device 120 (e.g., using the alarm module 312).

[0070] The centralized machine learning module 310 may also be configured to update the private ML model set based on the classification labels of the network tuple parameters. For example, the centralized machine learning module 310 may determine a model ID corresponding to the classification label (e.g., stored in the machine learning model data repository 322) by comparing the received classification label with the stored classification label. When a match between the received classification label and the stored classification label matches, the model ID may be returned.

[0071] The alarm module 312 may be configured to generate and transmit alarms based on the classification tags. For example, the alarm module 312 may compare the classification tags from the network device 120 with the network tuple parameters included with the data flow service. When the classification between the classification tag and the specific network tuple parameters matches, the alarm module 312 may generate an alarm and / or otherwise identify potential network intrusions, domain name system (DNS) problems, and other anomalies. The alarm may be transmitted to an administrative user (or other alarm functions performed by the routing action module 216 of the network device 120).

[0072] The alert module 312 is also configured to monitor the frequency of events occurring in the distributed environment, including at each of the plurality of network devices 120 or the edge device 110. The alert module 312 may generate logs or update a data repository to identify potential network intrusions, Domain Name System (DNS) issues, and other anomalies that occurred, as well as timestamps or frequencies associated with each event.

[0073] In some examples, the alarm module 312 determines an action to be performed by the plurality of network devices 120. The action may include instructing each of the network devices to reauthenticate one or more network ports or to reroute data packets (e.g., according to a centralized rule). The action may be transmitted to the network devices 120. In these examples, the action determined by the alarm module 312 may instruct the plurality of network devices 120 to perform similar actions. These actions may be performed in parallel or sequentially across the plurality of network devices 120.

[0074] Figure 4 An illustrative data flow process according to an example in the present disclosure is provided. The illustrative process should be interpreted as open-ended and not limiting the present disclosure. For example, a classification label can be provided by the network device 120 at least in part by applying a machine learning (ML) model including a labeled network tuple, an identifier or implicit label, and / or a signature for the flow behavior to a newly monitored flow behavior. The network device 120 can also detect the flow behavior associated with the transmission of one or more data packets in the data flow.

[0075] exist Figure 4 In the example, edge device 410, network device 420 and central server 430 are provided. Figure 4 The edge device 410, network device 420 and central server 430 shown in the figure can be respectively Figure 1 The illustrated embodiments of edge devices 110 , network devices 120 , and central server 140 correspond.

[0076] In box 1, edge device 410 can generate data flow traffic. The data flow traffic can include, for example, an identifier 412 or an implicit tag, a signature 414, a network tuple parameter 416, and one or more behaviors 418 of the data flow traffic. Edge device 410 can transmit the data flow traffic to network device 420. The data flow traffic can be transmitted as a data packet having a data packet header that also contains information associated with the data flow traffic.

[0077] The identifier 412 or implicit label may include, for example, a reported value for a network tuple parameter (e.g., an identifier carried by a data packet, as reported in a packet header). An example of an implicit label associated with a network tuple parameter may include, for example, a Differentiated Services Code Point (DSCP) code corresponding to a Quality of Service (QOS) value. For packet classification purposes, the DSCP code may use the 6-bit Differentiated Services (DS) field in the IP header.

[0078] Signature 414 may include, for example, a digital fingerprint identifying a source device or application used to verify that the data originated from that source.

[0079] The network tuple parameters 416 may include, for example, quality of service (QoS) (e.g., media type), virtual local area network (VLAN), media access control (MAC) address (e.g., source or destination), source IP address, destination IP address, source / destination port numbers, Transmission Control Protocol / Internet Protocol (TCP / IP) values, and other network tuples.

[0080] Behavior 418 may include, for example, inter-packet arrival times (eg, minimum, average, maximum, or standard deviation) or packet lengths (eg, minimum, average, or maximum) for a particular traffic flow.

[0081] In box 2, the network device 420 can process the data flow traffic using the ML model implemented by the decentralized machine learning module 422. The output from the ML model can generate a classification label 424.

[0082] In box 3 , data flow traffic with classification tags 424 (eg, identifier 412 or implicit tag, signature 414 , network tuple parameters 416 , behavior 418 ) may be transmitted to a central server 430 .

[0083] In block 4, central server 430 may process the received data using action module 432 to determine one or more actions 434. One or more actions 434 may be intended to be performed by one or more network devices 420.

[0084] In block 5, action 434 may be transmitted to network device 420. Network device 420 may be configured to implement the action (eg, reroute traffic, send an alert to an administrative user, reauthenticate a network port).

[0085] In box 6 , the central server 430 may use the centralized ML module 436 to update one or more private ML models.

[0086] In block 7, the central server 430 may transmit information associated with the centralized (or private) ML model to the one or more network devices 420. The one or more network devices 420 may update their local ML models using the information received from the central server 430.

[0087] Figure 5 An example machine learning module according to various examples is illustrated. Figure 5 In the example implementation of , computing component 500 includes a hardware processor 502 and a machine-readable storage medium 504 .

[0088] Hardware processor 502 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 504. Hardware processor 502 may fetch, decode, and execute instructions, such as instructions 506 to 512, to control a process or operation. As an alternative or in addition to fetching and executing instructions, hardware processor 502 may include one or more electronic circuits including functional electronic components for executing one or more instructions, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other electronic circuits.

[0089] A machine-readable storage medium, such as machine-readable storage medium 604, may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. Thus, machine-readable storage medium 604 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, or the like. In some examples, machine-readable storage medium 504 may be a non-transient storage medium, where the term "non-transient" does not encompass transient propagating signals. As described in detail below, machine-readable storage medium 504 may be encoded with executable instructions, such as instructions 506 to 512.

[0090] Hardware processor 502 can execute instructions 506 to train an ML model. In some examples, the ML model can be trained using role-based segmentation, such as a virtual local area network (VLAN), so that typical behaviors can exist within each role. In some examples, the ML model can be trained on labeled data flow traffic information.

[0091] Hardware processor 502 may execute instructions 508 to apply the new behavior as input to the trained ML model. For example, the new behavior may be received from a data stream service and provided to the trained ML model. The ML model may determine a classification label as an output to classify the new behavior.

[0092] The hardware processor 502 may execute instructions 510 to compare or match the model identifier with a stored model identifier. For example, when the received model ID matches a model ID corresponding to a stored ML model, the processor may apply the monitored set of flow behaviors to the specific ML model that matches the model ID. The output of the specific ML model may predict a classification (e.g., a classification label) of a network tuple parameter for a specific data flow. In some examples, the stored ML model is a random model (e.g., not corresponding to a model ID) from a private ML model set. This may help further maintain privacy by obfuscating the selected ML model.

[0093] In some examples, a comparison between the received model ID and the stored model ID results in a mismatch, and various actions may be initiated. The processor may generate an alert and transmit the alert to the central server 140 to identify the received model ID (e.g., no signature or no flow behavior pattern). By sending an alert to the central server 140 without a signature, privacy is increased and risk is reduced, at least by keeping the signature at the network device 120, based on the central server 140 being unable to identify the exact stored model ID.

[0094] In some examples, in the event of a mismatch, the received model ID, flow behavior pattern, and signature may be stored locally at the network device 120 (e.g., without transmitting the information back to the central server 140). By storing the information locally, privacy may be increased and risk may be reduced, at least by keeping the signature at the network device 120, based on the inability of the central server 140 to identify the exact stored model ID.

[0095] The hardware processor 502 may execute instructions 512 to update the ML model. For example, a classification of network tuple parameters may be generated as an output from a first ML model. The classification and the previous input provided to the ML model may again be provided as input to a second ML model. When the first ML model is implemented at the network device 120 and the second ML model is implemented at the central server 140, this may help achieve decentralized learning capabilities.

[0096] Figure 6 600 illustrates example computing components that can be used to implement privacy-preserving decentralized learning and network event monitoring according to various examples. For example, computing component 600 can be Figure 1 and Figure 2 The illustrated network device 120. Figure 6 In the example implementation of , computing component 600 includes a hardware processor 602 and a machine-readable storage medium 604 .

[0097] Hardware processor 602 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in machine-readable storage medium 604. Hardware processor 602 may fetch, decode, and execute instructions, such as instructions 606 to 612, to control a process or operation. As an alternative or in addition to fetching and executing instructions, hardware processor 602 may include one or more electronic circuits including functional electronic components for executing one or more instructions, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other electronic circuits.

[0098] A machine-readable storage medium, such as machine-readable storage medium 604, may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. Thus, machine-readable storage medium 604 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, etc. In some examples, machine-readable storage medium 604 may be a non-transient storage medium, where the term "non-transient" does not encompass transient propagating signals. As described in detail below, machine-readable storage medium 604 may be encoded with executable instructions, such as instructions 606 to 612.

[0099] Hardware processor 602 may execute instructions 606 to receive a set of flow behaviors for data flow services. For example, network device 120 may receive a set of flow behaviors for data flow services.

[0100] The hardware processor 602 may execute instructions 608 to apply a machine learning (ML) model. For example, the network device 120 may apply an ML model including a labeled network tuple and a signature for a flow behavior to the flow behavior set. The output from the ML model may predict network tuple parameters for a particular data flow of a data flow service.

[0101] The hardware processor 602 may execute the instructions 610 to determine a classification label and / or an implicit label. For example, the network device 120 may determine a classification label for a network tuple parameter for a particular data flow or determine an implicit label for a network tuple parameter for a particular data flow. The implicit label may include a reported value for the network tuple parameter.

[0102] In some examples, the classification labels of the network tuple parameters can be compared to the implicit labels.

[0103] The hardware processor 602 may execute the instructions 612 to perform an action. The action may include generating or sending an alarm, storing the marked data stream in a database, initiating an automated process to change network settings, or automatically adjusting data streams from different network devices. For example, the network device 120 may generate an alarm associated with the comparison. The alarm may identify a new behavior. For example, the new behavior may include a change in the inter-packet arrival time (e.g., minimum, average, maximum, standard deviation) or packet length (e.g., minimum, average, maximum, etc.) for a particular traffic flow.

[0104] Figure 7 600 illustrates example computing components that can be used to implement privacy-preserving decentralized learning and network event monitoring according to various examples. For example, computing component 600 can be Figure 1 and Figure 3 The central server 140 is shown. Figure 7 In the example implementation of , computing component 700 includes a hardware processor 702 and a machine-readable storage medium 704 .

[0105] The hardware processor 702 may be one or more central processing units (CPUs), semiconductor-based microprocessors, and / or other hardware devices suitable for retrieving and executing instructions stored in the machine-readable storage medium 704. The hardware processor 702 may fetch, decode, and execute instructions, such as instructions 706 to 708, to control a process or operation. As an alternative or in addition to fetching and executing instructions, the hardware processor 702 may include one or more electronic circuits including functional electronic components for executing one or more instructions, such as a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other electronic circuits.

[0106] A machine-readable storage medium, such as machine-readable storage medium 704, may be any electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. Thus, machine-readable storage medium 704 may be, for example, a random access memory (RAM), a non-volatile RAM (NVRAM), an electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disk, etc. In some examples, machine-readable storage medium 704 may be a non-transient storage medium, where the term "non-transient" does not encompass transient propagating signals. As described in detail below, machine-readable storage medium 704 may be encoded with executable instructions, such as instructions 706 to 708.

[0107] The hardware processor 702 may execute instructions 706 to receive a classification label. For example, the central server 140 may receive a classification label for a network tuple parameter from a network device including the network device 120. The classification label may be generated by, for example, monitoring flow behavior at the network device; applying a machine learning (ML) model including labeled network tuples and a signature for the flow behavior to the monitored flow behavior to classify the flow behavior and generate the network tuple parameter; and correlating the network tuple parameter with the classification label, wherein if a comparison of the classification label for the network tuple parameter is determined to be different from an implicit label, then the classification label is received, and wherein the implicit label corresponds to the network tuple parameter as reported in a packet header of the corresponding data flow.

[0108] The hardware processor 702 can execute instructions 708 to perform an action. The action can include generating or sending an alert, storing the marked data flow in a database, initiating an automated process to change network settings, or automatically adjusting data flows from different network devices. In some examples, the central server 140 can generate an alert based on the classification tag, where the alert identifies a new behavior.

[0109] Figure 8 A block diagram of an example computer system 800 is depicted in which various examples described herein may be implemented. The computer system 800 includes a bus 802 or other communication mechanism for communicating information, one or more hardware processors 804 coupled to the bus 802 for processing information. The hardware processor(s) 804 may be, for example, one or more general purpose microprocessors.

[0110] The computer system 800 also includes a main memory 806, such as a random access memory (RAM), cache, and / or other dynamic storage device, coupled to the bus 802 for storing information and instructions to be executed by the processor 804. The main memory 806 may also be used for storing temporary variables or other intermediate information during execution of instructions to be executed by the processor 804. When stored in a storage medium accessible to the processor 804, such instructions cause the computer system 800 to function as a special-purpose machine customized to perform the operations specified in the instructions.

[0111] The computer system 800 also includes a read only memory (ROM) 808 or other static storage device coupled to the bus 802 for storing static information and instructions for the processor 804. A storage device 810, such as a magnetic disk, optical disk, or USB thumb drive (flash drive), is provided and coupled to the bus 802 for storing information and instructions.

[0112] The computer system 800 may be coupled to a display 812, such as a liquid crystal display (LCD) (or touch screen), via the bus 802 for displaying information to a computer user. An input device 814, including alphanumeric and other keys, is coupled to the bus 802 for communicating information and command selections to the processor 804. Another type of user input device is a cursor control 816, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 804 and controlling cursor movement on the display 812. In some examples, the same direction information and command selections as a cursor control may be achieved via receiving touches on a touch screen without a cursor.

[0113] The computing system 800 may include a user interface module for implementing a GUI, which may be stored in a mass storage device as executable software code executed by the computing device(s). By way of example, this module and other modules may include components, such as software components, object-oriented software components, class components, and task components, procedures, functions, properties, programs, subroutines, program code segments, drivers, firmware, microcode, circuit systems, data, databases, data structures, tables, arrays, and variables.

[0114] In general, as used herein, the words "component", "engine", "system", "database", "data repository", etc. may refer to logic implemented in hardware or firmware, or to a collection of software instructions, possibly with entry and exit points, written in a programming language such as, for example, Java, C or C++. Software modules may be compiled and linked into an executable program, installed in a dynamic link library, or may be written in an interpreted programming language (such as, for example, BASIC, Perl or Python). It is to be understood that software components may be callable from other components or from themselves, and / or may be called in response to detected events or interrupts. Software components configured for execution on a computing device may be provided on a computer-readable medium, such as a compressed disk, a digital video disk, a flash drive, a magnetic disk, or any other tangible medium, or provided as a digital download (and may initially be stored in a compressed or installable format that requires installation, decompression or decryption prior to execution). Such software code may be stored in part or in full on a memory device of an executing computing device to be executed by the computing device. Software instructions may be embedded in firmware, such as an EPROM. It is further appreciated that hardware components may include connected logic units, such as gates and flip-flops, and / or may include programmable units, such as programmable gate arrays or processors.

[0115] The computer system 800 may implement the techniques described herein using custom hardwired logic, one or more ASICs or FPGAs, firmware, and / or program logic that, in combination with the computer system, makes the computer system 800 a special purpose machine, or is programmed to be a special purpose machine. According to one embodiment, the techniques herein are performed by the computer system 800 in response to the processor(s) 804 executing one or more sequences of one or more instructions contained in the main memory 806. Such instructions may be read into the main memory 806 from another storage medium such as the storage device 810. Execution of the sequences of instructions contained in the main memory 806 causes the processor(s) 804 to perform the process steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0116] As used herein, the term "non-transient medium" and similar terms refer to any medium that stores data and / or instructions that cause a machine to operate in a particular manner. Such non-transient media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 810. Volatile media include dynamic memory, such as main memory 806. Common forms of non-transient media include, for example, floppy disks, flexible disks, hard disks, solid-state drives, tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a pattern of holes, RAM, PROMs and EPROMs, flash EPROMs, NVRAMs, any other memory chips or cassettes, and networked versions thereof.

[0117] Non-transient media are distinct from transmission media, but can be used in conjunction with transmission media. Transmission media participate in the transfer of information between non-transient media. For example, transmission media include coaxial cables, copper wire, and optical fiber, including the wires that make up bus 802. Transmission media can also take the form of sound or light waves, such as those generated during radio wave and infrared data communications.

[0118] Computer system 800 also includes a communication interface 818 coupled to bus 802. Communication interface 818 provides a two-way data communication coupling with one or more network links connected to one or more local networks. For example, communication interface 818 can be an integrated services digital network (ISDN) card, a cable modem, a satellite modem, or a modem for providing a data communication connection with a telephone line of a corresponding type. As another example, communication interface 818 can be a local area network (LAN) card to provide a data communication connection with a compatible LAN (or with a WAN component of WAN communication). A wireless link can also be implemented. In any such implementation, communication interface 818 sends and receives electrical signals, electromagnetic signals, or optical signals, which carry digital data streams representing various types of information.

[0119] A network link typically provides data communications to other data devices through one or more networks. For example, a network link may provide a connection to a host computer or a data device operated by an Internet Service Provider (ISP) through a local network. The ISP in turn provides data communications services through a global packet data communications network now commonly referred to as the "Internet". Both the local network and the Internet use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link and through the communication interface 818 are example forms of transmission media that carry digital data to and from the computer system 800.

[0120] Computer system 800 can send messages and receive data including program code through the network(s), network links and communication interface 818. In the Internet example, a server can transmit the code for the requested application program through the Internet, an ISP, a local network and communication interface 818.

[0121] The received code may be executed by processor 804 as it is received, and / or stored in storage device 810 or other non-volatile storage for later execution.

[0122] Each of the processes, methods and algorithms described in the previous sections may be embodied in a code component executed by one or more computer systems or computer processors including computer hardware, and fully or partially automated by it. One or more computer systems or computer processors may also operate to support the execution of related operations in a "cloud computing" environment or as a "software as a service" (SaaS). The process and algorithm may be implemented in part or in whole in a dedicated circuit system. The various features and processes described above may be used independently of each other, or may be combined in various ways. Different combinations and sub-combinations are intended to fall within the scope of the present disclosure, and certain methods or process blocks may be omitted in some implementations. The methods and processes described herein are also not limited to any particular sequence, and the blocks or states associated therewith may be executed in other appropriate sequences, or may be executed in parallel, or in some other way. The blocks or states may be added to the disclosed examples, or removed from the disclosed examples. The execution of a particular operation or process may be distributed among computer systems or computer processors, not only residing in a single machine, but also deployed across multiple machines.

[0123] As used herein, circuits can be implemented using any form of hardware, software, or a combination thereof. For example, one or more processors, controllers, ASICs, PLAs, PALs, CPLDs, FPGAs, logic components, software routines, or other mechanisms can be implemented to form circuits. In implementation, the various circuits described herein can be implemented as discrete circuits, or the functions and features described can be shared in part or in whole between one or more circuits. Although various features or functional elements can be described or claimed separately as separate circuits, these features and functionality can be shared between one or more common circuits, and such descriptions should not require or imply the need for separate circuits to implement such features or functionality. In the case where the circuit is implemented in whole or in part using software, such software can be implemented to operate together with a computing or processing system (such as computer system 800) that can perform the functionality described therein.

[0124] As used herein, the term "or" may be interpreted in an inclusive or exclusive sense. Furthermore, descriptions of resources, operations, or structures in the singular should not be interpreted to exclude the plural. Unless otherwise specifically provided or otherwise understood within the context as used, conditional language (such as "can," "may," "possibly," or "could," etc.) is generally intended to convey that certain embodiments include and other embodiments do not include certain features, elements, and / or steps.

[0125] Unless expressly provided otherwise, the terms and phrases used in this document and variations thereof should be interpreted as open-ended and non-restrictive. Adjectives such as "conventional," "traditional," "ordinary," "standard," "known," and terms of similar meaning should not be interpreted as limiting the items described to a given time period or to items available at a given time, but should be interpreted as covering conventional, traditional, ordinary, or standard technologies that may be available or known at any time now or in the future. The presence of expanded words and phrases (such as "one or more," "at least," "but not limited to," or other similar phrases in some instances) should not be interpreted as meaning that a narrower case is intended or required in instances where such expanded phrases may not exist.

Claims

1. A method comprising: At a network device, receiving a flow behavior set for a data flow service; At the network device, applying a machine learning (ML) model to the set of flow behaviors, the machine learning model comprising labeled network tuples and signatures for flow behaviors, wherein an output from the machine learning model predicts a classification label for a specific data flow of the data flow service; determining, at the network device, an implicit label for a network tuple parameter for the particular data flow, wherein the implicit label comprises a reported value in a packet header of the particular data flow; comparing the classification labels for the network tuple parameters with the implicit labels; and An action associated with the comparison is performed.

2. The method according to claim 1, further comprising: When the comparison results in a mismatch, a counter for the data flow service is incremented.

3. The method according to claim 2, further comprising: When the counter is above a threshold, updating an alert to include suspicious activity for the data flow service; as well as The alert is transmitted to a central server.

4. The method according to claim 1, further comprising: When the comparison results in a mismatch between the classification label and the implicit label, a value for the flow behavior and the implicit label are stored locally.

5. The method according to claim 1, wherein the flow behavior depends on a model identifier ID, and the method further comprises: The value for the flow behavior is stored locally at the network device without transmitting the value to a central server.

6. The method according to claim 1, further comprising: receiving, from the central server, a model identifier ID corresponding to a second machine learning ML model in a set of private ML models, each machine learning model comprising a set of public model IDs, a set of labeled network tuples, and a set of private flow signatures; as well as Applying the set of flow behaviors to the second ML model corresponding to the model ID to predict the classification label of the network tuple parameters for the specific data flow, wherein the flow behaviors depend on the model ID.

7. The method of claim 6, wherein the second ML model is a random model from the collection of private ML models.

8. The method according to claim 6, further comprising: When the comparison results in a mismatch, the model ID and the classification are sent to the central server.

9. The method according to claim 6, further comprising: When the comparison results in a mismatch, the model ID and flow behavior signature are stored locally at the network device.

10. The method according to claim 6, further comprising: An update to the set of private ML models is received, wherein the update is based on the classification of the network tuple parameters for the particular data flow.

11. The method of claim 1, wherein the flow behavior set comprises at least one of an inter-packet arrival time or a packet length for the specific data flow. 12 . The method according to claim 1 , wherein the network tuple parameter comprises at least one of the following: quality of service (QOS), virtual local area network (VLAN), or media access control (MAC) address.

13. The method of claim 1, wherein performing the action associated with the comparing identifies new behavior at the network device, and wherein the new behavior is a network security risk associated with a Domain Name System (DNS) issue.

14. A method comprising: At a central server, a classification label for a network tuple parameter is received, wherein the classification label is generated by: Monitor traffic behavior at network devices; Applying a machine learning (ML) model to the monitored flow behavior to classify the flow behavior and generate a classification label, the machine learning model comprising labeled network tuples and a signature for the flow behavior; and wherein the classification tag is received if a comparison of the classification tag against the network tuple parameter is determined to be different than an implicit tag reported in a packet header of a corresponding data flow, and wherein the implicit tag corresponds to the network tuple parameter; as well as An action is performed based on the classification label.

15. The method according to claim 14, further comprising: A private ML model set is generated at the central server, the private ML model set comprising a set of model identifiers IDs, a set of labeled network tuples, and a set of signatures for flow behaviors.

16. The method of claim 15, wherein the signature for streaming behavior is private to the central server.

17. The method according to claim 15, further comprising: Determining a model ID from the set of model IDs that corresponds to the classification label; transmitting the model ID to the network device; as well as The private ML model set is updated based on the classification labels for the network tuple parameters, the classification labels for the network tuple parameters being generated by the application of the ML model with the corresponding model ID.

18. The method of claim 14, wherein performing the action associated with the comparing identifies new behavior at the network device, and wherein the new behavior is a network security risk associated with a Domain Name System (DNS) issue.

19. A non-transitory machine-readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions, when executed by the one or more processors, causing the one or more processors to: receiving a flow behavior set for a data flow service; Applying a machine learning (ML) model to the set of flow behaviors, the machine learning model comprising labeled network tuples and signatures for flow behaviors, wherein an output from the machine learning model predicts a classification label for a specific data flow of the data flow service; determining an implicit label for a network tuple parameter for the particular data flow, wherein the implicit label comprises a reported value in a packet header of the particular data flow; comparing the classification labels for the network tuple parameters with the implicit labels; and An action associated with the comparison is performed.

20. The non-transitory machine-readable storage medium of claim 19, wherein the one or more processors are further configured to: receiving, from the central server, a model identifier ID corresponding to a second machine learning ML model in the set of private ML models, each machine learning model comprising a set of public model IDs, a set of labeled network tuples, and a set of private flow signatures; and Applying the set of flow behaviors to the second ML model corresponding to the model ID to predict the classification label of the network tuple parameters for the specific data flow, wherein the flow behaviors depend on the model ID.

Images