Deterministic Automata for Low-Memory Network Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification and filtering systems face challenges in efficiently managing policies for large numbers of devices and applications, leading to difficulties in real-time classification and filtering of network traffic, especially with one-off and streaming content requests.
Innovation Solution
Utilizing deterministic finite automata to create a framework for network traffic filtering that includes a primary automaton for network assets and secondary automata for decision outcomes, enabling efficient, deterministic search and filtering based on customizable network policies with a low memory footprint.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional network traffic classification systems are used to manage policies for large numbers of devices and applications, then policy coverage is improved, but real-time classification efficiency deteriorates
Solution Approach 1:
The patent segments the network traffic classification task by dividing policies into multiple categories (e.g., application-level, host-level, domain-level policies) and organizing them into a hierarchical structure. This allows the system to handle large numbers of devices and applications by processing policies in organized groups rather than individually, improving both policy coverage and real-time classification efficiency.
Solution Approach 2:
The patent implements preliminary action by pre-processing and organizing policies into a structured format before actual traffic classification occurs. Policies are parsed, validated, and organized into hierarchical categories in advance, so that during real-time traffic classification, the system only needs to navigate the pre-organized structure rather than processing raw policies on-the-fly, significantly improving classification speed.
2Adaptability or versatility
If comprehensive network policies are implemented for all devices and applications, then network control capability is improved, but system complexity increases
Solution Approach 1:
The patent segments network control capabilities into distinct hierarchical levels (application-level, host-level, domain-level) with each level handling specific aspects of traffic classification. This segmentation allows comprehensive network control to be achieved through modular policy management, reducing overall system complexity by breaking down complex control logic into manageable, independent components.
Solution Approach 2:
The patent introduces dynamic policy loading and unloading mechanisms where policies can be added, modified, or removed from the hierarchical structure at runtime. This dynamic capability allows the system to adapt to changing network requirements without requiring complete system reconfiguration, maintaining comprehensive control while managing complexity through flexible, incremental updates.
3Productivity
If fast network traffic filtering is implemented, then real-time performance is improved, but memory requirements increase
Solution Approach 1:
The patent performs preliminary action by pre-processing and organizing policies into a compressed hierarchical structure before traffic classification. This pre-organization reduces the amount of data that needs to be stored and processed in real-time, as the system only needs to navigate the pre-structured policy tree rather than store complete policy datasets, achieving fast filtering with reduced memory requirements.
Solution Approach 2:
The patent extracts only the essential information needed for traffic classification decisions from the full policy datasets and organizes it into a condensed hierarchical representation. By taking out and retaining only the critical policy attributes (such as classification rules and matching criteria) while discarding redundant information, the system achieves fast real-time performance with minimized memory footprint.
Data Source
AI summary
In one embodiment, a method includes accessing a rule set for a group of networking assets; creating, based on the rule set, a primary automaton including a set of keys, each key including (1) a string identifying a network asset from the group of network assets (2) a separator character following the string and (3) a key branch number identifying a state. The method further includes creating, based on the rule set, one or more secondary automata by creating a secondary automaton for each type of result classification in the rule set; and for each secondary automaton, populating that secondary automaton with a set of values, each including (1) a value branch number identifying a state of that secondary automaton, each value branch number corresponding to a specific key branch number in the primary automaton, and (2) a string identifying a domain identified in the rule set.