Data Stream Classification via Statistical Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for classifying network traffic, such as deep packet inspection (DPI) and statistical classification, are unreliable, resource-intensive, and introduce latency, especially when dealing with encrypted data or polymorphic techniques, leading to network slowdowns and inaccurate classifications.
Innovation Solution
A method that identifies packets associated with a data stream, updates characterization data based on packet information, and uses low-computation statistical comparisons to classify data streams by comparing the characterization data to training data, allowing for accurate classification with reduced resource usage and minimal impact from encryption or polymorphic techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection (DPI) is used to classify network traffic, then classification accuracy is improved, but processing speed and resource efficiency deteriorate
Solution Approach 1:
The patent extracts only the essential statistical features (packet size, inter-arrival time, packet rate) from the packet stream, ignoring the encrypted payload content. This selective extraction maintains classification accuracy while dramatically reducing processing complexity and improving speed.
Solution Approach 2:
The patent replaces the mechanical deep packet inspection process with a statistical analysis system that uses lightweight computations on packet metadata. This substitution eliminates the need to actually read and analyze packet payloads, achieving both speed and accuracy.
2Reliability
If deep packet inspection (DPI) is used to examine packet payload contents, then classification capability is improved, but resource consumption and latency increase
Solution Approach 1:
The patent pre-computes and maintains statistical characteristics (average packet size, standard deviation, packet rate) as packets arrive, rather than performing heavy analysis when classification is needed. This preliminary statistical buildup enables fast real-time classification decisions.
Solution Approach 2:
The patent changes the classification approach from content-based analysis to parameter-based statistical analysis. By monitoring parameters like packet size distribution and inter-arrival times, the system achieves reliable classification without examining packet contents, thereby reducing latency.
3Use of energy by moving object
If conventional statistical classification techniques are used, then resource consumption is reduced, but classification speed and practical applicability deteriorate
Solution Approach 1:
The patent uses a limited set of essential statistical features (packet size, inter-arrival time, packet rate) rather than comprehensive analysis. This partial action approach consumes minimal resources while providing sufficient classification accuracy for practical network applications.
Solution Approach 2:
The statistical characteristics are computed incrementally as packets naturally flow through the system, using the packet stream itself to generate the classification data. This self-service approach eliminates the need for separate heavy computation processes, achieving both low resource consumption and high speed.
4Measurement precision
If DPI is used to detect applications, then classification accuracy is improved, but false positive rates increase and reliability deteriorates due to encryption and polymorphic techniques
Solution Approach 1:
The patent converts the harmful effect of encryption (which blocks payload analysis) into a benefit by designing a system that deliberately ignores encrypted content and relies solely on statistical patterns. These patterns remain consistent even when payloads are encrypted or polymorphically modified, eliminating false positives.
Solution Approach 2:
The patent changes from analyzing packet content parameters to analyzing traffic flow parameters. Statistical characteristics like packet size distribution, inter-arrival times, and packet rates are invariant to encryption and polymorphic code changes, providing reliable classification regardless of payload manipulation.
Data Source
AI summary
Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.