US 12,244,640 B2
Automatic retraining of machine learning models to detect DDoS attacks
K. Tirumaleswar Reddy, Bangalore (IN); Daniel G. Wing, San Jose, CA (US); Blake Harrell Anderson, Chapel Hill, NC (US); and David McGrew, Poolesville, MD (US)
Assigned to Cisco Technology, Inc., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Dec. 11, 2023, as Appl. No. 18/535,021.
Application 18/535,021 is a continuation of application No. 18/096,143, filed on Jan. 12, 2023, granted, now 11,843,632.
Application 18/096,143 is a continuation of application No. 17/395,264, filed on Aug. 5, 2021, granted, now 11,665,194, issued on May 30, 2023.
Application 17/395,264 is a continuation of application No. 16/906,302, filed on Jun. 19, 2020, granted, now 11,165,819, issued on Nov. 2, 2021.
Application 16/906,302 is a continuation of application No. 15/245,886, filed on Aug. 24, 2016, granted, now 10,728,280, issued on Jul. 28, 2020.
Claims priority of provisional application 62/356,023, filed on Jun. 29, 2016.
Prior Publication US 2024/0259422 A1, Aug. 1, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01)
CPC H04L 63/1458 (2013.01) [G06N 20/00 (2019.01); H04L 63/1425 (2013.01); H04L 2463/144 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A method comprising:
monitoring, at an attack detector in a network, network traffic to detect a Distributed Denial of Service (DDoS) attack by applying one or more first-level attack detection models against one or more attributes of the network traffic;
in response to detection of a DDoS attack,
causing network traffic associated with the DDoS attack to be diverted to an attack mitigation device, wherein the attack mitigation device is configured to perform a mitigation action on attack traffic in the network;
assessing, by the attack mitigation device, the network traffic associated with the DDoS attack using deep packet inspection and a second attack detection model;
providing, by the attack mitigation device, feedback to the attack detector regarding the detected DDoS attack, wherein the feedback indicates a false positive; and
refining at least one of the one or more first-level attack detection models applied by the attack detector based on the feedback.