Abstract: A method for network flow metadata processing at a network packet broker is described herein. The method includes, receiving, as input at a network packet broker, network traffic flow data, aggregating the network traffic flow data over a predefined time period to generate Internet protocol (IP) flow feature vectors containing metadata parameters associated with one or more particular endpoint devices, and providing the IP flow feature vectors to a machine learning element in the network packet broker. The method further includes identifying, by the machine learning element, anomalies existing in the metadata parameters included in the IP flow feature vectors, and automatically configuring one or more filter elements in the network packet broker in response to detecting the identified anomalies of the IP flow feature vectors.

Abstract: A method for selectively processing a packet flow using a flow inspection engine is disclosed. The method includes receiving, by at least one hardware data plane processor component in a network packet broker, a plurality of packets associated with a packet flow, and forwarding, by the at least one hardware data plane processor component to at least one flow inspection engine, a copy of at least a portion of one or more of the initial packets of the packet flow.

Abstract: A method for network flow metadata processing at a network packet broker is described herein. The method includes, receiving, as input at a network packet broker, network traffic flow data, aggregating the network traffic flow data over a predefined time period to generate Internet protocol (IP) flow feature vectors containing metadata parameters associated with one or more particular endpoint devices, and providing the IP flow feature vectors to a machine learning element in the network packet broker. The method further includes identifying, by the machine learning element, anomalies existing in the metadata parameters included in the IP flow feature vectors, and automatically configuring one or more filter elements in the network packet broker in response to detecting the identified anomalies of the IP flow feature vectors.

Abstract: According to one method for control plane traffic filtering in a control and user plane separation (CUPS) environment, the method occurs at a network node implemented using at least one processor and at least one memory. The method includes receiving, from one or more sources, network location information associated with a first network location; receiving control plane messages for different network locations; filtering the control plane messages based on the network location information; and sending traffic including data from the filtered control plane messages to at least one network tool.

Abstract: According to one method for control plane traffic filtering in a control and user plane separation (CUPS) environment, the method occurs at a network node implemented using at least one processor and at least one memory. The method includes receiving, from one or more sources, network location information associated with a first network location; receiving control plane messages for different network locations; filtering the control plane messages based on the network location information; and sending traffic including data from the filtered control plane messages to at least one network tool.