Patent Document ID: 8676729
Application ID: 13160418
Patent Flag: 1

Claim One:
1. A method for classifying network traffic in a network, comprising: generating, by a processor of a computer system during a training phase, a plurality of signatures of an application executing in the network, comprising: obtaining, from the network traffic, a plurality of flows generated by the application to form a training set of the application; extracting, based on a first pre-determined criterion, a plurality of feature vectors each from a flow in the training set, the plurality of feature vectors corresponding to a plurality of nodes in a N-dimensional space having N dimensions where N represents a count of feature elements in each of the plurality of feature vectors; determining, based on a second pre-determined criterion, a plurality of subspace clusters each contained in a corresponding subspace in a plurality of subspaces of the N-dimensional space and representing a portion of the plurality of nodes projected into the corresponding subspace using a subspace projection mapping, wherein the subspace projection mapping maps a feature vector in the N-dimensional space to a sub-vector in the corresponding subspace having a subset of the N dimensions, wherein the sub-vector corresponds to a subspace node in the corresponding subspace and comprises a portion of the feature elements in the feature vector corresponding to the subset of the N dimensions; and defining a region of interest based on one of the plurality of the subspace clusters in a corresponding subspace, wherein the region of interest is used as one of the plurality of signatures; and classifying, by the processor, a new flow obtained from the network traffic, comprising: extracting, based on the first pre-determined criterion, a new feature vector from the new flow; projecting, using the subspace projection mapping, the new feature vector into each of the plurality of subspaces to identify a corresponding subspace node in each of the plurality of subspaces; comparing, based on a third pre-determined criterion and in each of the plurality of subspaces, a subspace cluster contained therein and the corresponding subspace node of the new feature vector extracted from the new flow to select a matched subspace cluster from the plurality of subspace clusters that is contained in a matched subspace of the plurality of subspaces, wherein the region of interest of the matched subspace cluster contains the corresponding subspace node of the new feature vector extracted from the new flow; and determining, based on the region of interest of the matched subspace cluster containing the corresponding subspace node of the new feature vector extracted from the new flow, the new flow as being generated by the application.