Custom Network Traffic Classification via Event-Driven Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing traffic controllers are mass-produced and typically come with module collections that only identify frequently occurring types of network traffic, making it difficult for individual customers or small groups to identify less-frequent traffic types, especially those using unique in-house software, as they lack the necessary customization options and require costly or technically demanding full-custom programming solutions.
Innovation Solution
The introduction of a Classification Module Language (CML) like CML_Tcl, which is event-driven and allows users to create customized classification modules by incorporating programming language constructs, enabling users to write modules that identify specific network traffic types peculiar to their needs, thereby facilitating the customization of traffic classification without requiring extensive technical expertise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traffic controllers are mass-produced with pre-configured module collections, then production cost and device complexity are reduced, but the ability to identify less-frequent or custom network traffic types is lost
Solution Approach 1:
The traffic controller is divided into a base unit with pre-configured modules for common traffic types and a customizable module system. This segmentation allows the base product to be mass-produced at low cost while enabling custom modules to be added for identifying less-frequent or proprietary traffic types, thus resolving the contradiction between ease of manufacture and adaptability.
Solution Approach 2:
The traffic controller incorporates a universal module collection framework that can accommodate both pre-configured modules for common traffic and user-defined modules for custom traffic types. This multi-functionality allows a single mass-produced device to serve both generic and specialized traffic identification needs, maintaining low production costs while enhancing adaptability.
2Measurement precision
If full-custom programming is implemented to identify unique in-house software traffic, then traffic identification accuracy is improved, but technical complexity and implementation cost increase
Solution Approach 1:
Instead of requiring full-custom programming from scratch, the system provides template modules that can be copied and customized. Users can start with pre-defined module structures and modify them to identify their specific traffic types, reducing implementation complexity while maintaining high identification accuracy. This copying approach eliminates the need for complex programming from scratch.
Solution Approach 2:
The system allows customization through parameter changes within a standardized module framework rather than requiring complete programming redesign. Users can modify parameters such as traffic patterns, protocols, or identification criteria within pre-defined module structures, achieving accurate identification of unique traffic types without the complexity of full-custom programming.
3Adaptability or versatility
If a comprehensive module collection is provided for all traffic types, then adaptability is improved, but the system becomes too complex for mass production
Solution Approach 1:
The module collection is segmented into core modules for frequently occurring traffic types and optional modules for less-frequent types. This segmentation allows the base system to remain simple enough for mass production while enabling selective addition of specialized modules only when needed, thus achieving comprehensive adaptability without inherent system complexity.
Solution Approach 2:
The system provides partial coverage with essential modules for common traffic types in the base version, avoiding the complexity of including all possible traffic type modules. Users can add additional modules only when they need to identify less-frequent traffic types, achieving sufficient adaptability for most cases without the excessive complexity of comprehensive pre-configuration.
Data Source
AI summary
Expertise, for performing classification of a type of network traffic, can be encapsulated in a module. A set of modules, as currently available to a traffic controller, can be referred to as a collection. Programming language constructs are introduced that facilitate the writing of modules customized to identify network traffic that is peculiar to a particular user, or to a relatively small group of users. An example programming language, based on Tcl, is introduced. A key aspect is event-driven programming, and the “when” command construct is introduced. Three important event types, that can trigger a “when” command, are CLIENT_DATA, SERVER_DATA, and RULE_INIT. Another key aspect is an ability to keep state information between events. Constructs for intra-session, intra-module, and global state are introduced. A module can be blocked from executing more than once for a session. Successful execution of a module can be specified by a “match” statement.