Sandvine Corporation

A method for detecting fraudulent traffic in a computer network including: receiving a packet from a traffic flow; determining data associated with the traffic flow; determining a score associated with each piece of determined data; aggregating an overall score for the traffic flow; and determining whether the traffic flow is trusted based on the overall score. A system for detecting fraudulent traffic in a computer network including: a data processing engine configured to receive a packet from a traffic flow; a data collection module configured to determine data associated with the traffic flow; a data correlation module configured to determining a score associated with each piece of determined data and aggregating an overall score for the traffic flow; and a traffic classification module configured to determine whether the traffic flow is trusted based on the overall score.

A method and system for classifying a device accessing a computer network. The method including: determining fields of interest that are indicators for classifying the device; reviewing a network traffic flow associated with the device; extracting field/parameter values from a packet associated with the network traffic flow; comparing the extracted field/parameter values with values of the fields of interest to determine at least one device attribute; and classifying the device associated with the network traffic flow based on the comparison. The header fields/parameters may include application name and/or fields/parameters available in a TLS header. The system includes a processor, memory, and software modules and engines that implement the method above.

A method and system for detecting ruleset misconfiguration in a computer network. The method including: generating a set of sample data flows; evaluating each of the set of sample data flows against a predetermined definition to generate a flow descriptor for each of the set of sample data flows; evaluating each of the flow descriptors against a ruleset; and generating a summary of how each of the flow descriptors perform with respect to the ruleset. The system including: a data flow sample retrieval module configured to generate flows; a policy engine configured to store and retrieve a ruleset; a packet processing engine configured to evaluate each of the data flows against a predetermined definition to generate a flow descriptor for each flows, evaluate each of the flow descriptors against a ruleset; and generate a summary of how each of the flow descriptors perform with respect to the ruleset.

A method for detecting fraudulent traffic in a computer network including: receiving a packet from a traffic flow; determining data associated with the traffic flow; determining a score associated with each piece of determined data; aggregating an overall score for the traffic flow; and determining whether the traffic flow is trusted based on the overall score. A system for detecting fraudulent traffic in a computer network including: a data processing engine configured to receive a packet from a traffic flow; a data collection module configured to determine data associated with the traffic flow; a data correlation module configured to determining a score associated with each piece of determined data and aggregating an overall score for the traffic flow; and a traffic classification module configured to determine whether the traffic flow is trusted based on the overall score.

A method and system for detecting ruleset misconfiguration in a computer network. The method including: generating a set of sample data flows; evaluating each of the set of sample data flows against a predetermined definition to generate a flow descriptor for each of the set of sample data flows; evaluating each of the flow descriptors against a ruleset; and generating a summary of how each of the flow descriptors perform with respect to the ruleset. The system including: a data flow sample retrieval module configured to generate flows; a policy engine configured to store and retrieve a ruleset; a packet processing engine configured to evaluate each of the data flows against a predetermined definition to generate a flow descriptor for each flows, evaluate each of the flow descriptors against a ruleset; and generate a summary of how each of the flow descriptors perform with respect to the ruleset.

A method for classifying a traffic flow including; determining a plurality of time slices to be used to classify the traffic flow; collecting traffic flow data for a first time slice of the plurality of time slices; if the flow is classifiable based on the first time slice, classifying the traffic flow; otherwise collecting the traffic flow data for each further time slice of the plurality of time slices to classify the traffic flow. A system for classifying a traffic flow having: a time interval module configured to determine a plurality of time slices to be used to classify the traffic flow; a data collection module configured to collect traffic flow data for each of the plurality of time slices; a classification module configured to determine whether the flow is classifiable based after each time slice, and classify the traffic flow.

A system and method for handling Voice over Internet Protocol (VOIP) traffic flows on a computer network, and, in particular, encrypted VoIP traffic flows. The method including: collecting traffic flow data with respect to an IP session; collecting parameters associated with the IP session; determining whether the IP session is a VoIP session; correlating IP sessions having similar parameters to the collected parameters; and creating at least one Internet Protocol Detail Record (IPDR) or Call Detail Record (CDR) based on the correlated IP sessions. The system including: a collection module configured to collect traffic flow data; an analysis module configured to determine parameters and determine whether the IP session is a VoIP session; and a correlation module configured to correlate IP sessions having similar parameters; and create at least one Internet Protocol Detail Record (IPDR) or Call Detail Record (CDR) based on the correlated IP sessions.

A system and method for classifying network traffic including: providing a framework of models configured to classify network traffic; determining, via a packet processing engine, whether the network traffic flow is encrypted; if the network traffic flow is encrypted: extracting, via the packet processing engine, encrypted flow attributes associated with a network traffic flow; deriving further flow attributes based on the extracted encrypted flow attributes; determining at least one model of the framework of models based on the derived flow attributes and extracted encrypted flow attributes; and classifying, via a traffic classification engine, the traffic flow as a category of traffic based on the at least one model; and if the network traffic flow is not encrypted: extracting non-encrypted flow attributes associated with a network traffic flow; classifying the traffic flow as a category of traffic based on the non-encrypted flow attributes.

A method and system for classifying a device accessing a computer network. The method including: determining fields of interest that are indicators for classifying the device; reviewing a network traffic flow associated with the device; extracting field/parameter values from a packet associated with the network traffic flow; comparing the extracted field/parameter values with values of the fields of interest to determine at least one device attribute; and classifying the device associated with the network traffic flow based on the comparison. The header fields/parameters may include application name and/or fields/parameters available in a TLS header. The system includes a processor, memory, and software modules and engines that implement the method above.

A system and method for handling Voice over Internet Protocol (VoIP) traffic flows on a computer network, and, in particular, encrypted VoIP traffic flows. The method including: collecting traffic flow data with respect to an IP session; collecting parameters associated with the IP session; determining whether the IP session is a VoIP session; correlating IP sessions having similar parameters to the collected parameters; and creating at least one Internet Protocol Detail Record (IPDR) or Call Detail Record (CDR) based on the correlated IP sessions. The system including: a collection module configured to collect traffic flow data; an analysis module configured to determine parameters and determine whether the IP session is a VoIP session; and a correlation module configured to correlate IP sessions having similar parameters; and create at least one Internet Protocol Detail Record (IPDR) or Call Detail Record (CDR) based on the correlated IP sessions.