SYSTEM AND METHOD FOR EFFICIENT CLASSIFICATION AND PROCESSING OF NETWORK TRAFFIC

摘要

Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

主权项

1. A system for classifying flows of communication packets from a network, the system comprising:
a classification unit configured to receive unclassified input flows of communication packets from a front-end processor and to assign a classification to a given unclassified input flow that indicates whether the input flow is to be analyzed by a flow analysis unit, wherein the classification is assigned by the classification unit based on less than 5% of the input packets of the given input flow, wherein assigning the classification comprises the classification unit being configured to assign a first classification to a first unclassified input flow that indicates whether the first flow is to be analyzed by the flow analysis unit based on information produced in assigning a second classification to a second unclassified input flow, and wherein the classification unit is configured to identify a server-side address and a client-side address in the second input flow, and to use the identified server-side and client-side addresses in assigning the first classification to the first input flow.