Network Traffic Classification Using Byte Distribution Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network traffic classification methods require elaborate and expensive classification engines, making them time-consuming and inefficient for certain applications.
Innovation Solution
A network traffic classification system using a packet ingress with counters to generate counts of predetermined byte values at specific positions in data packets, allowing a packet classifier to classify packets based on these counts, employing a data parsing unit, configuration unit, counting unit, and classification unit to analyze and classify network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional content matching classification is used, then classification accuracy can be achieved, but device complexity and processing time increase significantly
Solution Approach 1:
The patent segments the classification task into two distinct phases: a training phase where byte distribution profiles are pre-computed and stored in lookup tables, and an inference phase where packets are classified by comparing their byte distributions against these pre-stored profiles. This segmentation eliminates the need for complex real-time pattern matching engines, as the heavy computational work is performed offline during training.
Solution Approach 2:
The patent performs preliminary action by pre-computing and storing byte distribution profiles for various traffic types during an offline training phase. These profiles, which capture the characteristic byte value distributions of different application protocols, are stored in lookup tables ready for rapid comparison during runtime classification, eliminating the need for complex real-time analysis.
2Measurement precision
If conventional content matching classification is used, then classification accuracy can be achieved, but processing speed decreases
Solution Approach 1:
By segmenting the classification process into offline profile computation and online distribution comparison, the patent enables rapid processing during runtime. The offline phase handles the computationally intensive work of learning traffic patterns, while the online phase performs only simple statistical comparisons, dramatically improving processing speed without sacrificing accuracy.
Solution Approach 2:
The patent creates simplified copies of traffic characteristics in the form of byte distribution profiles stored in lookup tables. Instead of performing complex content matching against original traffic patterns, the system compares packets against these pre-computed statistical representations, which capture the essential characteristics of each traffic type in a compact, easily comparable format.
3Reliability
If elaborate classification engines are used, then classification capability is improved, but cost increases
Solution Approach 1:
The patent replaces expensive, elaborate classification engines with simple statistical counters and lookup tables. The classification functionality is achieved through basic hardware or software counters that track byte value frequencies, combined with pre-computed reference profiles stored in memory. This approach dramatically reduces implementation cost while maintaining effective classification capability.
Solution Approach 2:
The patent substitutes complex mechanical or computational classification engines with a statistical approach based on byte distribution analysis. Instead of using elaborate pattern matching algorithms or deep inspection mechanisms, the system relies on simple frequency counting and statistical comparison against pre-stored profiles, replacing complex processing with straightforward statistical methods.
Data Source
AI summary
A network device has counters that are configured to generate for a plurality of byte positions in a specified portion of data packets, a count indicative of a correspondence of a value found at the byte position corresponding to a rule such that occurrences of predetermined byte values in the plurality of byte positions may be counted. A packet classifier is configured to receive from the counters a number of byte values corresponding to the rules and to classify data packets based on the analysis.