Abstract: Some examples relate to classifying IoT malware at a network device. An example includes receiving, by a network device, network traffic from an Internet of Things (IoT) device. Network device may analyze network parameters from the network traffic with a machine learning model. In response to analyzing, network device may classify the network traffic into a category of malware activity. Network device may determine an effectiveness of network traffic classification by measuring a deviation of the network parameters from previously trained network parameters that were used for training the machine learning model. In response to a determination that the deviation of the network parameters from the trained network parameters is more than a pre-defined threshold, network device may generate an alert highlighting the deviation, which allows a user to perform a remedial action pertaining to the IoT device.

Abstract: Systems are methods are described for predicting and forecasting a resource utilization on network device, particularly for handling multicast flows, by monitoring past resource consumption patterns. A system can include a plurality of multicast clients coupled to a network; and a network device coupled to the network. The network device may be a switch or a router that directs multicast traffic to the plurality of multicast clients. The network device can include a flow prediction controller that determines one or more real-time predictions relating to a demand of the network based on an analysis of an artificial intelligence (AI) forecasting model, such as an Autoregressive Integrated Moving Average (ARIMA) model. Also, the network device can include a resource optimizer that performs a resource management action that optimizes the resources of the network device based on the one or more real-time predictions of the demand of the network and a policy.

Abstract: Examples relate to detection of anomalies in a network. Some examples determine a dictionary including a set of keys for a set of packet length values for a selected sequence of packets associated with a traffic flow over a network, each key represents a combination of two or more successive packet length values from the set of packet length values. An aggregated set of statistical features is determined based in part on the set of statistical features using a machine learning algorithm. Upon determining another set of packet length values for another selected sequence of packets, another set of statistical features for the other set of packet length values is determined. The other set of statistical features is compared with the aggregated set of statistical features. Based on the comparison, an indication that an anomaly has occurred in the traffic flow is transmitted to an administrator.

Abstract: Systems and methods are provided for a light-weight model for traffic classification within a network fabric. A classification model is deployed onto an edge switch within a network fabric, the model enabling traffic classification using a set of statistical features derived from packet length information extracted from the IP header for a plurality of data packets within a received traffic flow. The statistical features comprise a number of unique packet lengths, a minimum packet length, a maximum packet length, a mean packet length, a standard deviation of the packet length, a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length. Based on the calculated values for the statistical features, the edge switch determines a traffic class for the received traffic flow and tags the traffic flow with an indication of the determined traffic class.

Abstract: Systems and methods are provided for a light-weight model for traffic classification within a network fabric. A classification model is deployed onto an edge switch within a network fabric, the model enabling traffic classification using a set of statistical features derived from packet length information extracted from the IP header for a plurality of data packets within a received traffic flow. The statistical features comprise a number of unique packet lengths, a minimum packet length, a maximum packet length, a mean packet length, a standard deviation of the packet length, a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length. Based on the calculated values for the statistical features, the edge switch determines a traffic class for the received traffic flow and tags the traffic flow with an indication of the determined traffic class.

Abstract: A device may track network traffic and may determine sample points associated with a plurality of time intervals, where each sample point from the plurality of sample points that is associated with a respective time interval from the plurality of time intervals comprises a count of packet lengths associated with a plurality of packets that comprise at least a specified portion of total network volume for the respective time interval and a total number of packet lengths observed during the respective time interval. The device may generate a plurality of clusters of the plurality of sample points and may, in response to determining a plurality of new sample points associated with a plurality of new time intervals based on the network traffic, determine a network traffic trend for the network based at least in part on a distribution of the plurality of new sample points within the plurality of clusters.