Multi-Connection Traffic Analysis Using DFA Pattern Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic management systems face inefficiencies in processing and memory usage due to the need to reassemble packets for pattern matching, especially when packets arrive out of order, leading to increased latency and additional traffic processing.
Innovation Solution
A method and apparatus for multi-connection traffic analysis and management using Deterministic Finite Automata (DFA) to scan packets for patterns without reassembling them, allowing for pattern matching on a packet-by-packet basis and handling out-of-order packets by buffering and waiting for subsequent packets, thereby reducing latency and processing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packets are reassembled before pattern matching, then pattern detection accuracy is improved, but processing time and memory usage increase
Solution Approach 1:
The patent segments the pattern matching process into two independent phases: (1) scanning individual packets for partial pattern matches using DFA, and (2) reassembling only the matched packets for complete pattern verification. This segmentation allows parallel processing of packets while maintaining detection accuracy, resolving the contradiction between early detection and complete pattern matching.
Solution Approach 2:
The patent performs preliminary scanning of packet headers and payloads using DFA to identify potential pattern matches before full reassembly. This preliminary action filters out non-matching packets early, reducing the amount of data that requires complete reassembly and verification, thus decreasing overall processing time while maintaining accuracy.
2Measurement precision
If packets are reassembled before pattern matching, then complete pattern detection is improved, but memory usage increases
Solution Approach 1:
The patent segments memory allocation into two pools: (1) minimal buffer memory for storing individual packet segments during scanning, and (2) selective reassembly memory only for packets that match partial patterns. This segmentation reduces overall memory footprint compared to storing all packets for reassembly, while still enabling complete pattern detection.
Solution Approach 2:
The patent extracts only the matching packets from the packet stream for reassembly, rather than reassembling all packets. This extraction approach significantly reduces memory usage by processing only the relevant subset of packets that contain potential pattern matches, while maintaining complete pattern detection capability.
3Measurement precision
If packets are scanned in sequence after reassembly, then complete pattern matching is achieved, but processing efficiency decreases
Solution Approach 1:
The patent performs preliminary DFA-based scanning on individual packets before reassembly to identify candidate matches. This preliminary action creates a filtered subset of packets that require complete reassembly and verification, reducing the scope of sequential scanning from all packets to only matching packets, thus improving processing efficiency while maintaining completeness.
Solution Approach 2:
The patent segments the processing workflow into parallel packet scanning operations followed by selective sequential reassembly. The DFA scanning phase processes packets independently and in parallel, while the reassembly and verification phase processes only the matched subset sequentially, optimizing overall processing efficiency without sacrificing pattern matching completeness.
4Measurement precision
If out-of-order packets are buffered and waited for, then correct pattern detection is improved, but latency increases
Solution Approach 1:
The patent performs preliminary DFA scanning on packets as they arrive, even out of order, to identify partial matches immediately. When a partial match is found in an out-of-order packet, the system proactively buffers only the specific missing packets required to complete that pattern, rather than waiting for all packets to arrive in sequence. This preliminary detection approach reduces overall latency by processing available data immediately.
Solution Approach 2:
The patent implements dynamic buffering strategies where the buffering behavior adapts based on pattern match progress. If partial matches are detected, the system dynamically buffers only the specific missing packets needed to complete patterns. If no partial matches exist, packets are processed immediately without buffering. This dynamic approach optimizes latency by minimizing unnecessary waiting while maintaining pattern detection accuracy.
Data Source
AI summary
A method and an apparatus to perform multi-connection traffic analysis and management are described. In one embodiment, the method includes analyzing data packets in the first data flow of a client application for a pattern of interest, where the client application communicates data using first and second data flows. In response to the method detecting a pattern of interest in the first data flow, the method identifies the second data flow and identifies a traffic policy for the second data flow. The method applies the identified traffic policy to the second data flow. Other embodiments have been claimed and described.