Cloud Traffic Analysis via Flow Data Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud server environments, conventional methods for analyzing network traffic face difficulties in determining flow and session information due to virtual local area network (VLAN) communication, especially with encrypted traffic, as they do not support IP address-based communication and struggle with processing overhead, making it challenging to analyze session information effectively.
Innovation Solution
A method and system for analyzing traffic based on flow data by calculating the average byte per packet rate (BPR) and TCP flag ratio (TCPFR) from flow data obtained from switches or routers, comparing these metrics with known traffic patterns to determine whether the traffic is normal or abnormal, using techniques such as vector similarity calculations to identify traffic types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional methods analyze IP packet headers and payloads to determine traffic patterns, then traffic analysis accuracy is improved, but processing overhead increases and encrypted traffic cannot be analyzed
Solution Approach 1:
The patent extracts only the necessary flow information (5-tuple: source IP, destination IP, source port, destination port, protocol) from network traffic without analyzing complete IP packet headers or payloads. This extraction approach enables traffic analysis while significantly reducing processing overhead and allowing analysis of encrypted traffic since only metadata is examined, not the encrypted payload content.
Solution Approach 2:
The patent segments traffic analysis into two distinct parts: flow information extraction (metadata only) and traffic pattern analysis. By separating the analysis of packet headers and payloads from flow-based metadata analysis, the system achieves efficient processing of encrypted traffic while maintaining analytical capability through statistical methods applied to flow characteristics.
2Adaptability or versatility
If VMs perform VLAN communication through OVS, then network virtualization is enabled, but flow and session information becomes difficult to determine
Solution Approach 1:
The patent introduces a flow information extraction mechanism that operates as an intermediary between the OVS virtual switching layer and the traffic analysis layer. This intermediary captures essential flow metadata (5-tuple) at the virtual switch level, enabling traffic analysis in virtualized environments without requiring deep inspection of VLAN-tagged frames or session states, thus resolving the difficulty of determining flow information in OVS-based networks.
3Adaptability or versatility
If 802.1Q VLAN trunking with tagging method is used, then VLAN communication is supported, but IP address-based communication for each VM is not supported
Solution Approach 1:
The patent transitions from analyzing traffic at the link layer (VLAN tagging dimension) to analyzing traffic at the network layer (IP address dimension). By extracting and analyzing the 5-tuple flow information including source and destination IP addresses, the system enables IP address-based communication analysis while maintaining compatibility with VLAN trunking infrastructure, effectively adding an IP addressing dimension to the VLAN-based virtualized network.
Data Source
AI summary
A method, an apparatus, and a system for analyzing traffic through obtaining flow data of a flow from a switch or a router of a network, calculating an average byte per packet rate (BPR) and a TCP flag ratio (TCPFR) for all flows included in a session including the flow using the flow data, and comparing the average BPR and the TCPFR with an average BPR and a TCPFR of previously-known traffic and determining whether the traffic including the flow is normal traffic or abnormal traffic based on the comparison result are provided.