CPC H04L 63/1425 (2013.01) [H04L 63/145 (2013.01); H04L 63/1466 (2013.01); H04L 63/1483 (2013.01)] | 20 Claims |
1. A method comprising:
receiving, at a network device, a set of flow behaviors for data flow traffic;
applying, at the network device, a machine learning (ML) model that comprises labelled network tuples and signatures for flow behaviors to the set of flow behaviors, wherein output from the machine learning model predicts a classified label for a particular data flow of the data flow traffic;
determining, at the network device, an implicit label for a network tuple parameter for the particular data flow, wherein the implicit label comprises a reported value in a packet header of the particular data flow;
comparing the classified label for the network tuple parameter to the implicit label; and
perform an action associated with the comparison.
|