Data Stream Protocol Analysis for Tunneled Session Identification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network supervision and traffic management systems face inefficiencies in processing high-speed data streams due to hardware limitations, packet slicing leading to information loss, and inadequate protocol identification, especially in tunneled or multiplexed sessions, resulting in inaccurate analysis and high processing overheads.

Innovation Solution

A method and system for analyzing data streams that utilize a dynamic protocol analysis process, including explicit detection, session detection, and deep packet inspection, coupled with a hash-based digital fingerprinting system to identify protocols across layers 2 to 7 of the OSI model, ensuring unique identification and continuous detection of tunneled or multiplexed protocols.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If hardware-based network probes are used to process high-speed data streams, then processing speed is improved, but hardware limitations and processing overhead increase

Engineering Contradiction:

Improvedata stream processing speedVSAvoidhardware limitations

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The patent replaces hardware-based network probes with a software-based solution running on general-purpose processors. The software implementation uses efficient algorithms and data structures to achieve high processing speeds without the constraints of specialized hardware, thereby substituting mechanical/hardware systems with software-based alternatives.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Productivity

If packet sampling is used to reduce processing overhead, then processing efficiency is improved, but analysis accuracy deteriorates due to restrictive 5-tuple identification

Engineering Contradiction:

Improveprocessing efficiencyVSAvoidprotocol identification accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent implements a dynamic protocol identification mechanism that adapts to different protocol types and tunneling scenarios. Instead of using a static 5-tuple approach, the system dynamically selects identification methods based on the detected protocol characteristics, enabling accurate identification of tunneled protocols while maintaining processing efficiency.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes the identification parameters from the fixed 5-tuple (source IP, destination IP, source port, destination port, protocol) to a more flexible set of parameters that include protocol-specific fields and hierarchical protocol chain information. This allows accurate identification of protocols in tunneled and multiplexed sessions while maintaining sampling efficiency.

Inventive Principle:

Principle #35Parameter changes

3Speed

If FPGA and ASIC hardware with packet slicing is implemented, then processing speed is improved, but information loss occurs due to limited memory and periodic cache clearing

Engineering Contradiction:

Improvepacket processing speedVSAvoiddata packet loss

Core Design Contradiction:

SpeedVSLoss of information

Solution Approach 1:

The patent replaces FPGA/ASIC hardware systems with software-based processing on general-purpose processors. This substitution eliminates the limited memory constraints and periodic cache clearing issues inherent in hardware implementations, allowing complete packet data to be retained in memory without information loss while maintaining high processing speeds through optimized software algorithms.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Loss of time

If 5-tuple digital fingerprint calculation is used for session identification, then identification speed is improved, but accuracy deteriorates in tunneled or multiplexed protocols

Engineering Contradiction:

Improveidentification timeVSAvoidsession identification accuracy

Core Design Contradiction:

Loss of timeVSMeasurement precision

Solution Approach 1:

The patent implements a hierarchical protocol chain identification approach where protocols are identified in nested layers. The system first identifies outer protocols and then progressively identifies inner tunneled protocols, creating a nested identification structure. This allows accurate identification of sessions in complex protocol chains while maintaining efficient processing by working from outer to inner layers.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent adds dimensional depth to the identification process by considering the hierarchical structure of protocol chains rather than treating all protocols at the same level. The system operates in multiple identification dimensions, first at the transport layer level and then drilling down into application layer protocols, enabling accurate session identification in tunneled and multiplexed scenarios.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS12489820B2Method and system for data stream analysis

Publication Date: 2025.12.02 NANO CORP

AI summary

The invention relates to a method for analysing a data stream of data packets received via a communications network, a protocol analysis (DAP) according to the following steps:analysing the first packet (P0) of a batch to check whether the first packet (P0) announces the protocol of the next data packet (P1);analysing the next protocol or protocols Pi+n with n≥2 by repeating the steps of explicit detection classification (S10), session detection classification (S20), and deep packet inspection classification (S40) until at least one protocol, the identity of which is certain, is identified; and—associating a label with the data packets; and its implementation system.