Application Flow Clustering for New Network App Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep packet inspection (DPI) technologies suffer from low application identification rates due to the need for manual updates of traffic feature databases when new applications emerge, exacerbating congestion and packet loss in private networks like enterprise and campus networks.
Innovation Solution
Perform flow behavior feature analysis on a flow table to cluster services based on IP addresses and port identifiers, determining application types without relying on a traffic feature database, enabling direct identification of new applications through IP and port analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection technology is used to identify applications by matching traffic features with a database, then application identification can be performed, but the application identification rate remains low due to manual database updates when new applications appear
Solution Approach 1:
The system performs self-learning by automatically analyzing flow behavior features and clustering services to identify application types without manual intervention. The clustering module automatically updates application type definitions based on observed traffic patterns, enabling the system to adapt to new applications autonomously.
Solution Approach 2:
The system incorporates feedback mechanisms where flow behavior analysis results feed back into the application type database. The clustering module uses observed traffic patterns to refine and update application type definitions, creating a continuous improvement loop that enhances identification accuracy over time.
2Productivity
If a traffic feature database is maintained for DPI technology, then existing applications can be identified, but manual updates are required when new applications emerge, reducing efficiency
Solution Approach 1:
The system performs preliminary analysis of flow behavior features and pre-clusters services into application types before new applications cause congestion issues. This proactive approach allows the system to prepare identification rules in advance, reducing reaction time when new applications appear.
Solution Approach 2:
The clustering module automatically maintains the application type database by analyzing new traffic patterns and creating updated application type definitions without human intervention, eliminating the time-consuming manual update process.
3Reliability
If manual updates of traffic feature database are performed for new applications, then application identification accuracy can be maintained, but network congestion and packet loss are exacerbated
Solution Approach 1:
The system continuously analyzes flow behavior features and updates application type definitions in real-time, maintaining uninterrupted identification accuracy. This continuous operation eliminates gaps in identification that would otherwise occur during manual update cycles, preventing traffic management decisions from being delayed.
Solution Approach 2:
The automatic clustering mechanism continuously maintains the application type database without requiring manual intervention, ensuring that identification accuracy is maintained while the system actively manages network traffic to prevent congestion and packet loss.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
This application discloses a method, apparatus and storage medium for application identification, and belongs to the field of communications technologies. A network device performs flow behavior feature analysis according to a flow table, to obtain a plurality of services. Each service includes one IP address and one port identifier, and one application may usually include a group of services. Therefore, the network device clusters the plurality of services according to the flow table and a domain name table, to obtain a plurality of application types, where each application type includes a plurality of services, and each application type corresponds to one application. Further, the network device may determine a label corresponding to each of the plurality of application types, where the label is used to identify an application to which a data flow belongs. According to the method provided in this application, an application to which a data flow belongs can be identified based on a flow behavior feature, and a traffic feature database is not required. When a new application appears, the network device identifies the new application based on an IP address and a port of a server accessed by the new application. This improves an application identification rate.