US 11,706,249 B2
Identifying network applications using images generated from payload data and time data
John Franklin Limb, Herriman, UT (US)
Assigned to BRAINTRACE, INC., Salt Lake City, UT (US)
Filed by BRAINTRACE, INC., Salt Lake City, UT (US)
Filed on Sep. 22, 2021, as Appl. No. 17/482,154.
Application 17/482,154 is a continuation of application No. 17/208,567, filed on Mar. 22, 2021, granted, now 11,159,560.
Claims priority of provisional application 63/005,909, filed on Apr. 6, 2020.
Prior Publication US 2022/0014548 A1, Jan. 13, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 3/04 (2023.01); G06N 3/08 (2023.01)
CPC H04L 63/1441 (2013.01) [G06N 3/04 (2013.01); G06N 3/08 (2013.01); H04L 63/1416 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method, at least a portion of which is performed by one or more computer processors, the computer-implemented method comprising:
capturing target payload data and target time data from a target flow of network packets between a target client application and a target server application, the target payload data indicating lengths of payloads of the network packets in the target flow, the target time data indicating time periods between arrivals of the network packets in the target flow;
generating a target image from the target payload data and the target time data by
normalizing the target payload data,
normalizing the target time data,
combining the normalized target payload data with the normalized target time data into a set of combined data points,
placing the set of combined data points in a matrix beginning at a center of the matrix and moving outward from the center of the matrix, and
converting the matrix into the target image by converting each data point in the matrix into a pixel of the target image; and
determining, based on the target image, an output including an extent to which the target image matches one of a plurality of predetermined images in order to determine a likelihood that the target client application and/or the target server application matches one of a plurality of predetermined client applications and/or one of a plurality of predetermined server applications.