International Business Machines Corporation
NETWORK TRAFFIC RULE IDENTIFICATION

Abstract:

A computer implemented method for analyzing network connections includes identifying a connection of interest and a corresponding set of connection data. The method additionally includes generating one or more saliency maps corresponding to the connection of interest. The method additionally includes mapping the generated one or more saliency maps to underlying protocols and fields, and identifying one or more values corresponding to each of the underlying protocols and fields. The method additionally includes extracting general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields.