Abstract: A method and system for classifying a device accessing a computer network. The method including: providing a framework of models configured to classify the device; reviewing a network traffic flow associated with a device; extracting flow attributes associated with a network traffic flow; deriving further flow attributes based on the extracted flow attributes; determining at least one model of the framework of models based on the derived flow attributes and extracted encrypted flow attributes; and classifying the device associated with the network traffic flow based on the at least one model. The system includes: a learning engine configured to provide a framework of models; a packet processing engine configured to review a network traffic flow associated with a device; a device classification engine configured to extract flow attributes, derive further flow attributes and determine at least one model; and a device information aggregator configured to classify the device.

Abstract: A method for classifying tunneled network traffic including: providing at least one model configured to classify network traffic; retrieving a plurality of packets from a traffic flow; determining input and output statistics of the traffic flow based on the plurality of packets; and classifying, via the at least one model, the traffic flow based on the input and output statistics. A system for classifying tunneled network traffic including: a model making module configured to provide at least one model configured to classify network traffic; a packet processing engine configured to retrieve a plurality of packets from a traffic flow; a data collection module configured to determine input and output statistics of the traffic flow based on the plurality of packets; and a classification module configured to classify, via the at least one model, the traffic flow based on the input and output statistics.

Abstract: A method and system for classifying a device accessing a computer network. The method including: providing a framework of models configured to classify the device; reviewing a network traffic flow associated with a device; extracting flow attributes associated with a network traffic flow; deriving further flow attributes based on the extracted flow attributes; determining at least one model of the framework of models based on the derived flow attributes and extracted encrypted flow attributes; and classifying the device associated with the network traffic flow based on the at least one model. The system includes: a learning engine configured to provide a framework of models; a packet processing engine configured to review a network traffic flow associated with a device; a device classification engine configured to extract flow attributes, derive further flow attributes and determine at least one model; and a device information aggregator configured to classify the device.