AI Network Telemetry via Segmented Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently mitigating the impact of distributed Denial-of-Service (DDOS) attacks on networks, particularly in resource-intensive inspection processes.
Innovation Solution
The implementation of AI-supported telemetry methods, where packets from new flows are inspected by machine learning models to determine if they are associated with network attacks, allowing for routing decisions that bypass intensive inspection for non-attack flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packet inspection is performed for all incoming packets to detect DDOS attacks, then detection accuracy is improved, but system resource consumption increases significantly
Solution Approach 1:
The patent segments the packet inspection process into two distinct paths: a fast path for established flows that bypasses intensive inspection, and a slow path for new flows that undergoes full machine learning-based inspection. This segmentation allows the system to maintain high detection accuracy for new potential threats while conserving resources on routine traffic.
Solution Approach 2:
The patent applies partial inspection action by performing complete machine learning-based packet inspection only when necessary (for new flows), rather than inspecting every packet at full depth. Established flows receive minimal or no inspection, reducing overall resource consumption while maintaining security through the selective application of intensive analysis.
2Reliability
If machine learning models inspect every packet to ensure security, then detection reliability is improved, but processing speed decreases
Solution Approach 1:
The system segments packet handling into new flow and established flow paths. New flows are subjected to full machine learning inspection to ensure reliability, while established flows are routed through a fast path that maintains security through stateful inspection without the overhead of repeated full ML analysis, thereby preserving processing speed.
Solution Approach 2:
The system performs preliminary inspection on the first packet of a new flow to classify it and establish the flow's security profile. This preliminary action enables subsequent packets in the same flow to be handled more efficiently through the fast path, maintaining both reliability and speed by doing the heavy lifting only when necessary.
3Measurement precision
If all new packet flows are subjected to intensive inspection, then attack detection capability is improved, but system scalability deteriorates
Solution Approach 1:
The patent implements segmentation of packet flow handling where new flows undergo intensive machine learning inspection while established flows are processed through a streamlined fast path. This segmentation enables the system to maintain high attack detection capability for new threats while achieving linear scalability as traffic volume increases, since the majority of established flows require minimal processing resources.
4Productivity
If packet inspection is bypassed for established flows, then processing efficiency is improved, but security monitoring capability deteriorates
Solution Approach 1:
The patent introduces flow state tables and connection tracking mechanisms as intermediaries that maintain security monitoring for established flows without requiring intensive packet-by-packet inspection. These intermediaries store flow characteristics and enable the fast path to operate efficiently while still providing security oversight through stateful inspection and anomaly detection capabilities.
Data Source
AI summary
A device receives a packet from a local network. The packet may be directed toward a cloud computing resource. The device determines that the packet is associated with a new packet flow. In response to determining that the packet is associated with the new packet flow, the device provides one or more packets from the new packet flow to a machine learning model for packet inspection. The device receives an output from the machine learning model and routes the new packet flow based on the output received from the machine learning model. The output indicates whether or not the new packet flow is associated with a network attack.