METHOD FOR AUTOMATIC CLASSIFICATION OF NETWORK TRAFFIC BASED ON HEURISTIC ANALYSIS Russian patent published in 2019 - IPC G06N5/02 

FIELD: computer equipment.

SUBSTANCE: invention relates to the computer equipment. Method comprises: classifying network traffic, wherein for classification heuristic rules are used, which describe key characteristics of web traffic and P2P traffic, used to incoming from routers network packets, from which are selected such parameters as IP addresses of sender and recipient, sender and receiver port numbers, size of network packet, time mark, type of network protocol of transport level, life time of network packet, type of service, flags, parameters are stored in database located on a database server, then, using the stored in the database of the listed parameters, calculating the statistical characteristics of the network traffic, such as the number of SYN and ACK flags, the size of the network stream, the number of network packets in the network stream, the number of network protocol packets of each type, the number of outbound connections for the host, the number of incoming connections to a host; at that traffic assignment to P2P traffic class or to web traffic class is performed at traffic parameters correlation.

EFFECT: high efficiency and speed of detecting network attacks in backbone networks.

1 cl, 1 dwg