Access Origin Classification via DNS Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying terminal types in network traffic monitoring, such as DPI and DNS query analysis, are inefficient due to high costs, service agreement restrictions, and the need for preliminary checks for each terminal type, especially when new products are launched.
Innovation Solution
An access source classification apparatus that calculates statistics from access logs, extracts index values, applies clustering approaches to determine relevance between access sources and services, and classifies access sources into groups based on similarity, allowing for efficient identification of terminal types without the need for exhaustive checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If DPI (deep packet inspection) is used to identify terminal types by referring to user agent in header information, then terminal type identification accuracy is improved, but implementation cost and complexity increase significantly
Solution Approach 1:
The patent extracts only the necessary identification information (domain names from DNS queries) from the communication data, rather than performing comprehensive deep packet inspection of all traffic. This selective extraction approach maintains identification accuracy while significantly reducing implementation cost and complexity.
Solution Approach 2:
The patent uses inexpensive DNS query data instead of expensive DPI apparatus. DNS queries are naturally occurring, easily collectible data that can be analyzed without requiring costly specialized hardware or deep packet inspection capabilities.
2Device complexity
If DNS query analysis is used to estimate terminal types by monitoring DNS traffic near DNS server, then implementation cost is reduced, but identification efficiency deteriorates due to need for preliminary checks of all terminal types
Solution Approach 1:
The patent performs preliminary clustering analysis on DNS query data to identify characteristic patterns of different terminal types in advance. By pre-processing and grouping data by similarity, the system creates reference profiles that enable rapid identification of new terminals without requiring exhaustive checks of all possible terminal types.
Solution Approach 2:
Instead of performing complete census checks on all terminal types, the patent applies clustering algorithms to identify representative patterns from a subset of DNS query data. This partial analysis approach captures the essential characteristics needed for identification while avoiding the inefficiency of exhaustive verification.
3Adaptability or versatility
If complete census approach is used to check all terminal types for identification, then identification coverage is improved, but processing time and efficiency worsen
Solution Approach 1:
The patent merges multiple DNS query data points into clustered groups that represent terminal type categories. By combining individual query records into aggregated clusters based on similarity, the system achieves comprehensive identification coverage while processing time is reduced through pattern recognition rather than individual terminal verification.
Solution Approach 2:
The clustering algorithm creates universal reference patterns that can identify multiple terminal types simultaneously. A single clustered model can recognize various terminal types by comparing against learned patterns, providing broad identification coverage without requiring separate checklists for each terminal type.
Data Source
AI summary
An access source classification apparatus has: a first calculation unit that calculates a statistic related to access to each service by each access source based on a set of access logs indicating access to any service of a plurality of services by any access source of a plurality of access sources; an extraction unit that, for each of the services, calculates an index value indicating distribution of access status to the service for each of the access sources based on the access logs related to the service, and extracts some services based on the index value; a second calculation unit that calculates relevance between each access source and each service extracted by the extraction unit by applying a clustering approach to the statistic; and a classification unit that classifies an access source to any service extracted by the extraction unit into any of groups each including one or more access sources based on the relevance, thereby assisting improvement of efficiency in identifying the terminal type of an access source to a service.