Network Traffic Classifier Adaptation via Parameter Sharing

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing network traffic classification systems face challenges in adapting to specific network conditions due to privacy concerns and the need for robust training data, as entities are hesitant to share sensitive data, leading to classifiers that may not accurately identify malicious traffic flows.

Innovation Solution

A method where a generic classifier is trained using centrally-curated data and then adapted using distinct private training data sets within the target network, ensuring privacy by only sharing classifier parameters, allowing for fine-tuning based on local conditions without exposing sensitive information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If entities share sensitive training data centrally, then classifier robustness improves, but data privacy is compromised

Engineering Contradiction:
Improveclassifier robustnessVSAvoiddata privacy
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The training data remains segmented and distributed across multiple private entities rather than being centralized. Each entity maintains its own training data locally, and only trained model parameters (not the raw data) are shared with the central server for aggregation. This segmentation preserves data privacy while still enabling collaborative model improvement through parameter sharing.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces a central server as an intermediary that facilitates model parameter aggregation without directly handling or storing sensitive training data. The server receives trained parameters from various entities, aggregates them to create an improved global model, and redistributes the updated parameters back to entities. This intermediary mechanism enables collaboration while maintaining data privacy boundaries.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If generic classifier is trained on diverse network data, then classification accuracy improves, but adaptability to specific network conditions deteriorates

Engineering Contradiction:
Improveclassification accuracyVSAvoidadaptability to network conditions
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The classifier model is made dynamic through iterative retraining and parameter updates. Entities can retrain local models using their own network-specific data and send updated parameters to the central server. This allows the global model to dynamically adapt to different network conditions while maintaining the benefits of diverse training data, achieving both accuracy and adaptability.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent enables local customization of classifier parameters at each entity based on their specific network conditions. While the global model provides general classification accuracy from diverse data, each entity can fine-tune local parameters to match their specific network environment, achieving both general accuracy and local adaptability simultaneously.

Inventive Principle:
Principle #3Local quality

Data Source

PatentUS10897474B2Adapting classifier parameters for improved network traffic classification using distinct private training data sets
Publication Date: 2021.01.19 CISCO TECHNOLOGY INC
  • US10897474B2 patent drawing
  • US10897474B2 patent drawing
  • US10897474B2 patent drawing

AI summary

In one embodiment, a device in a first network receives traffic flow information regarding a plurality of traffic flows in the first network. The device labels the traffic flow information by associating classifier labels to the traffic flow information. The device receives a generic traffic classifier that was trained using a training data set that comprises labeled traffic flow information for a plurality of other networks and excludes the traffic flow information regarding the plurality of traffic flows in the first network. The device acclimates the generic traffic classifier to the first network using the labeled traffic flow information regarding the plurality of traffic flows in the first network.