Cloud Traffic Analysis Engines Using DSL for Low-Latency Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing traffic analysis methods, such as those using intrusion detection systems and packet capture, suffer from complex rule maintenance and delays due to the need for copying and analyzing mirrored traffic, which affects the timeliness and efficiency of network security.
Innovation Solution
A cloud platform with a management node and traffic analysis engines that utilize domain-specific language (DSL) program code for direct traffic analysis, enabling just-in-time compilation and distribution to the closest engine, thereby eliminating the need for copying and providing a unified language interface for real-time and accurate analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If packet capture is used to copy traffic before analysis, then traffic can be analyzed externally, but the analysis delay increases and timeliness deteriorates
Solution Approach 1:
The patent extracts the traffic analysis function from external devices and moves it directly into the cloud platform's traffic analysis engines. This eliminates the need for packet capture and external mirroring, allowing traffic to be analyzed in-place within the cloud environment, thereby reducing delay and improving timeliness.
Solution Approach 2:
The cloud platform's traffic analysis engines are designed to perform multiple functions: they can directly receive and analyze traffic from multiple sources (virtual machines, physical machines, containers) without requiring separate packet capture infrastructure. This multi-functionality consolidates the analysis capability within the cloud platform itself, eliminating external dependencies and reducing analysis delay.
2Ease of operation
If intrusion detection system with detection rule library is used, then traffic analysis can be performed, but rule maintenance and updating becomes complex
Solution Approach 1:
The patent transforms the traditional detection rule library into a programmable DSL-based rule set. Instead of maintaining fixed, pre-defined rules, the system allows dynamic creation, modification, and updating of analysis rules through domain-specific language programs. This parameter change from static rule libraries to dynamic programmable rules simplifies maintenance and updating operations.
Solution Approach 2:
The system enables users to independently create, modify, and update their own traffic analysis rules using the DSL without requiring complex administrative operations. The cloud platform provides the infrastructure and language environment, allowing end-users to self-service rule maintenance and updates, thereby reducing operational complexity.
3Device complexity
If traffic is copied through packet capture to external devices, then analysis can be performed, but the system requires external devices and increases operational complexity
Solution Approach 1:
The patent merges the traffic analysis function with the cloud platform's existing infrastructure. Traffic analysis engines are integrated directly into the cloud platform, combining computing, storage, and analysis resources in one unified system. This eliminates the need for separate external analysis devices and simplifies operations by consolidating functions within the cloud environment.
Solution Approach 2:
The cloud platform's traffic analysis engines are designed to handle multiple traffic sources and analysis tasks within a single unified system. This multi-functional capability replaces the need for multiple external specialized devices, reducing system complexity and improving operational simplicity through consolidation.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
This application discloses a traffic analysis method, a cloud platform, and a related apparatus, and belongs to the field of network security technologies. The method is applied to the cloud platform. The cloud platform includes a management node and a plurality of traffic analysis engines. The management node obtains program code of a DSL corresponding to a target traffic analysis task, and the management node verifies the program code. When the verification of the program code succeeds, the management node allocates the program code to a target engine. The target engine determines a traffic analysis result based on the program code. In this application, after the management node in the cloud platform obtains the program code corresponding to the target traffic analysis task, the traffic analysis engine may directly analyze traffic in the cloud platform, and there is no need to first copy to-be-analyzed traffic based on a packet capture condition, and then send mirrored traffic to a traffic analysis device deployed outside the cloud platform for traffic analysis. Therefore, timeliness of traffic analysis can be improved.