Application-Aware Network Management via Flow Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network management systems that rely on static properties of network connections fail to accurately identify applications due to dynamic negotiation of per-session properties and shared properties among applications, and are vulnerable to misinformation from applications, with deep packet inspection being costly and unreliable, especially with encrypted traffic.
Innovation Solution
Implementing an application-aware network management system that uses application classifiers generated by network devices within the control plane, derived from application identifiers, to identify applications and manage network flows, decoupling control and data planes for scalable and consistent application identification across software-defined networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to identify applications, then application identification accuracy is improved, but computational cost and processing time increase significantly
Solution Approach 1:
The patent extracts only the essential features needed for application identification from network traffic flows, rather than performing complete deep packet inspection. By selecting specific flow characteristics (packet size, inter-arrival time, protocol type) and excluding unnecessary data, the system achieves accurate application identification while significantly reducing computational overhead and processing time.
Solution Approach 2:
The system performs preliminary classification of network flows using lightweight feature extraction before applying more complex identification algorithms only to ambiguous cases. This two-stage approach pre-processes the data by filtering out easily identifiable applications, thereby reducing the computational burden on the main identification system and decreasing overall processing time.
2Ease of operation
If static properties of network connections are used for application identification, then processing simplicity is improved, but identification accuracy deteriorates due to dynamic negotiation and shared properties
Solution Approach 1:
The patent transitions from static property-based identification to dynamic behavior-based identification. Instead of relying on fixed port numbers or IP addresses that applications may negotiate or share, the system monitors dynamic characteristics of network flows such as packet size variations, inter-arrival time patterns, and sequence behavior, which change over time and are unique to each application's operational pattern.
Solution Approach 2:
The system changes the parameters used for identification from static connection properties (port numbers, protocols) to dynamic flow characteristics (packet size distribution, timing patterns, byte rates). This parameter transformation enables the system to distinguish applications even when they use the same static properties, thereby improving identification accuracy while maintaining processing efficiency through focused feature monitoring.
3Speed
If QoS information provided by applications is trusted, then network provisioning speed is improved, but reliability deteriorates due to vulnerability to misinformation
Solution Approach 1:
The system implements a feedback mechanism where QoS information provided by applications is cross-validated against observed network flow characteristics. Instead of blindly trusting application-provided QoS labels, the system continuously monitors actual traffic patterns and compares them with expected patterns for the claimed application type, providing feedback to verify or correct the identification, thereby maintaining fast provisioning while improving reliability.
Solution Approach 2:
The patent introduces an intermediary verification layer between the application and the network provisioning system. This intermediary component analyzes network flow characteristics and acts as a mediator that validates application-provided QoS information before final provisioning decisions are made, preventing misinformation from affecting network resource allocation while maintaining efficient provisioning speeds.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one implementation, an application-aware network control system determines that a network flow has been instantiated, derives network flow features associated with the network flow in response to determining the network flow has been instantiated, and provides the network flow features to an application identification module. In response to an application identification signal, the application-aware network control system ceases deriving the network flow features, and applies a flow action to the network flow based on an application identification report received from the application identification module.