Distributed Decision Trees for Encrypted Packet Flow Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Decision Tree implementations in data center and cloud networks face performance scaling issues due to limited host device capabilities and increasing data traffic volume, making real-time throughput maintenance challenging for encrypted data flow classification.
Innovation Solution
A multi-layered decision tree system is introduced, where an overlay decision tree is linked to underlay decision trees hosted on spine and leaf switches, allowing parallel processing and independent evaluation by each network device, utilizing network topology and flow routing information for efficient and accurate packet flow classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If Decision Tree is implemented on a single host device for data flow classification, then the classification logic can be executed centrally, but the system cannot scale to handle increasing numbers of network devices and growing data traffic volume
Solution Approach 1:
The patent segments the centralized Decision Tree classification system into distributed components deployed across multiple network devices. Each network device hosts a local Decision Tree or classification agent, dividing the classification workload from a single host into parallel distributed processing units. This segmentation enables the system to scale horizontally by adding more network devices to handle increasing traffic volume while maintaining classification capabilities at each node.
2Productivity
If more network devices are added to increase classification capacity, then the system can handle greater traffic volume, but the computational resources of individual host devices become insufficient to maintain real-time throughput
Solution Approach 1:
The patent transitions from a single-dimension centralized processing model to a multi-dimensional distributed processing architecture. By deploying classification capabilities across the spatial dimension of multiple network devices rather than concentrating resources in one host, the system achieves both increased capacity and maintained processing speed. Each device operates independently in parallel, eliminating the bottleneck of centralized processing while handling greater aggregate traffic volume.
3Measurement precision
If centralized Decision Tree processing is used, then classification decisions can be made uniformly, but inter-device traffic and bandwidth consumption increase due to centralized coordination
Solution Approach 1:
The patent enables each network device to perform self-service classification by hosting local Decision Tree instances or classification agents. Instead of every device needing to communicate with a centralized controller for classification decisions, each device independently evaluates local traffic against its Decision Tree. This self-service approach maintains classification accuracy through consistent Decision Tree logic while eliminating the need for continuous inter-device coordination traffic, significantly reducing bandwidth consumption.
Data Source
AI summary
Techniques for generating a multi-layer network topology on a managed network are described herein. An example method includes receiving, from an internetworking device in a network, one or more encrypted packets in a flow; generating a classification decision corresponding to the flow by traversing one or more decision trees; and providing the classification decision to a controller of the network.