Systems and methods are provided for combining a multiple sub-time window sampling architecture with machine learning to detect outlier traffic flow behavior which may indicate malicious/problematic network activity. For example, a network device may obtain a sample of traffic flow data during a defined time window. The sample of traffic flow data may comprise information associated with a sampled subset of traffic flows transferred by a network device in the defined time window. The network device may partition the defined time window into two or more sub-time windows. In each sub-time window, using machine learning, the network device may assign an outlier-related classification to each sampled traffic flow based on the relative behavioral characteristics of all the sampled traffic flows. The network device may aggregate the outlier-related classifications for each sampled traffic flow across multiple sub-time windows, and process traffic flows based on the aggregated outlier-related classifications.
Assigning outlier-related classifications to traffic flows across multiple time windows
2024-07-02
Patent
Electronic Resource
English
IPC: | G08G Anlagen zur Steuerung, Regelung oder Überwachung des Verkehrs , TRAFFIC CONTROL SYSTEMS |
ASSIGNING OUTLIER-RELATED CLASSIFICATIONS TO TRAFFIC FLOWS ACROSS MULTIPLE TIME WINDOWS
European Patent Office | 2023
|Assigning user class link flows uniquely
Elsevier | 2013
|Assigning user class link flows uniquely
Online Contents | 2013
|Assigning Traffic Over Essentially-Least-Cost Paths
Online Contents | 1996
|Traffic counts and classifications: distributed data processing
Tema Archive | 1989
|