Abstract: Aspects relate to a machine learning system implementing an evolutionary boosting machine. The system may initially select randomized feature sets for an initial generation of candidate models. Evolutionary algorithms may be applied to the system to create later generations of the cycle, combining and mutating the feature selections of the candidate models. The system may determine optimal number of boosting iterations for each candidate model in a generation by building boosting iterations from an initial value up to a predetermined maximum number of boosting iterations. When a final generation is achieved, the system may evaluate the optimal model of the generation. If the optimal boosting iterations of the optimal model does not meet solution constraints on the optimal boosting iterations, the system may adjust a learning rate parameter and then proceed to the next cycle. Based on termination criteria, the system may determine a resulting/final optimal mode.

Abstract: A method and system for classifying traffic flows on a computer network, the method including: determining sender information associated with a traffic flow; determining Whols data associated with the sender information; determining online information associated with the Whols data or hostname; parsing the online information for keywords; and classifying the traffic flow based on the keywords or natural language description. The system including: a Whols module configured to determine sender information associated with a traffic flow and determine Whols data or hostname associated with the sender information; a search request and response module configured to determine online information associated with the Whols data; a language model configured to parse the online information for keywords; and a Service and Category recognizer configured to classify the traffic flow based on the keywords or natural language descriptions.

Abstract: A method for classifying tunneled network traffic including: providing at least one model configured to classify network traffic; retrieving a plurality of packets from a traffic flow; determining input and output statistics of the traffic flow based on the plurality of packets; and classifying, via the at least one model, the traffic flow based on the input and output statistics. A system for classifying tunneled network traffic including: a model making module configured to provide at least one model configured to classify network traffic; a packet processing engine configured to retrieve a plurality of packets from a traffic flow; a data collection module configured to determine input and output statistics of the traffic flow based on the plurality of packets; and a classification module configured to classify, via the at least one model, the traffic flow based on the input and output statistics.

Abstract: Aspects relate to a machine learning system implementing an evolutionary boosting machine. The system may initially select randomized feature sets for an initial generation of candidate models. Evolutionary algorithms may be applied to the system to create later generations of the cycle, combining and mutating the feature selections of the candidate models. The system may determine optimal number of boosting iterations for each candidate model in a generation by building boosting iterations from an initial value up to a predetermined maximum number of boosting iterations. When a final generation is achieved, the system may evaluate the optimal model of the generation. If the optimal boosting iterations of the optimal model does not meet solution constraints on the optimal boosting iterations, the system may adjust a learning rate parameter and then proceed to the next cycle. Based on termination criteria, the system may determine a resulting/final optimal mode.