Abstract: Some examples relate to classifying IoT malware at a network device. An example includes receiving, by a network device, network traffic from an Internet of Things (IoT) device. Network device may analyze network parameters from the network traffic with a machine learning model. In response to analyzing, network device may classify the network traffic into a category of malware activity. Network device may determine an effectiveness of network traffic classification by measuring a deviation of the network parameters from previously trained network parameters that were used for training the machine learning model. In response to a determination that the deviation of the network parameters from the trained network parameters is more than a pre-defined threshold, network device may generate an alert highlighting the deviation, which allows a user to perform a remedial action pertaining to the IoT device.

Abstract: Systems and methods are provided for classifying network traffic flows across a network. Specifically, the network traffic flows are classified under a fully-segmented ruleset, wherein the fully segmented ruleset was generated by training a decision tree machine learning (“ML”) algorithm with a training dataset, and wherein each item of the training dataset satisfies the complete rule pathway to different leaf nodes of the fully segmented ruleset. Classification under a fully-segmented ruleset allowing for capture of idiosyncratic patterns specific to a given malicious source of network traffic flows. Further, systems and methods are provided allowing for a user to designate network traffic flows for classification of network traffic flows at different network devices, wherein the classification at different network devices may allow for more computationally intensive classification.

Abstract: A system and a method of classifying data and providing an accuracy of classification are described. The method includes determining values of statistical features associated with data packets present in a data stream. The values of statistical features are provided to a data model for producing a classification output including the data packets classified into one or more categories. While producing the classification output, the data model extracts heuristics for each of the values of statistical features, compares the heuristics with one or more conditional checks defined at each node within the data model, and determines a cumulative score based on results of the comparing. The cumulative score is determined by aggregating a score assigned to successful clearance of each conditional check. The cumulative score indicates an accuracy of the classification output.

Abstract: Some examples relate to classifying IoT malware at a network device. An example includes receiving, by a network device, network traffic from an Internet of Things (IoT) device. Network device may analyze network parameters from the network traffic with a machine learning model. In response to analyzing, network device may classify the network traffic into a category of malware activity. Network device may determine an effectiveness of network traffic classification by measuring a deviation of the network parameters from previously trained network parameters that were used for training the machine learning model. In response to a determination that the deviation of the network parameters from the trained network parameters is more than a pre-defined threshold, network device may generate an alert highlighting the deviation, which allows a user to perform a remedial action pertaining to the IoT device.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.

Abstract: A system and a method of classifying data and providing an accuracy of classification are described. The method includes determining values of statistical features associated with data packets present in a data stream. The values of statistical features are provided to a data model for producing a classification output including the data packets classified into one or more categories. While producing the classification output, the data model extracts heuristics for each of the values of statistical features, compares the heuristics with one or more conditional checks defined at each node within the data model, and determines a cumulative score based on results of the comparing. The cumulative score is determined by aggregating a score assigned to successful clearance of each conditional check. The cumulative score indicates an accuracy of the classification output.

Abstract: A system and a method for performing programmable analytics on network data are described. A data layer constructs flow behavior information based on information present within headers of data packets flowing across one or more network devices configured in a computer network. An inline heuristics layer performs one or more inline heuristic operations on the flow behavior information to obtain aggregate statistical information. An integrated analytics layer performs one or more analytical operations on the flow behavior information to obtain network insights. A presentation layer filters and plots information obtained from the data layer, the inline heuristics layer, and the integrated analytics layer, based on a user input.