Domain Name Vector Embeddings for Encrypted Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current internet traffic classification methods are inefficient due to the prevalence of encrypted protocols, which makes it difficult to accurately classify and prioritize internet traffic, as they often rely on direct similarity mechanisms that fail to identify changes in domain names used for similar purposes.
Innovation Solution
A system and method that utilize a deep neural network to convert domain names into vector embeddings based on their relationships, trained using a dataset of DNS queries sorted by frequency and timestamp, allowing for improved classification and prioritization of internet traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If direct similarity mechanisms are used to classify domain names, then the classification process is simple, but the accuracy is very limited and fails to identify changes in domain names used for similar purposes
Solution Approach 1:
The patent transforms domain names from their original string format into numerical vector embeddings, fundamentally changing the parameter representation. This allows the use of sophisticated similarity measurements (cosine similarity) that can capture semantic relationships between domain names, significantly improving classification accuracy while managing complexity through established ML techniques
Solution Approach 2:
The patent replaces simple string-matching mechanisms with a machine learning-based vector embedding system. Instead of direct mechanical comparison of domain name strings, the system uses neural network-generated vectors and cosine similarity calculations, substituting a complex but more accurate computational approach for the simple but inaccurate direct similarity mechanism
2Reliability
If encrypted internet protocols are used, then privacy and security are improved, but traffic classification becomes difficult to achieve
Solution Approach 1:
The patent introduces vector embeddings as an intermediary representation between encrypted traffic and classification algorithms. Instead of attempting to directly analyze encrypted payload content (which would break security), the system uses DNS query data as a mediator to generate domain name vectors that preserve classification capability while maintaining encryption integrity
Solution Approach 2:
The patent performs preliminary classification actions at the DNS query stage, before the actual encrypted traffic payload is transmitted. By classifying domain names upfront using vector embeddings, the system enables subsequent traffic engineering operations on encrypted streams without requiring decryption, thus maintaining both security and classification effectiveness
3Measurement precision
If all DNS queries are included in the training dataset, then the dataset is comprehensive, but the model cannot effectively learn changes in frequently queried domain names
Solution Approach 1:
The patent extracts and removes the most frequently queried domain names (stop words) from the training dataset. By taking out these high-frequency entries that would dominate the training process, the system allows the model to more effectively learn patterns from less frequent but more variable domain names, improving overall learning accuracy while reducing data redundancy
Solution Approach 2:
The patent applies different treatment to different portions of the training data based on their frequency characteristics. Frequently queried domain names are removed (stop word filtering), while less frequent domain names are retained with full detail. This local differentiation in data processing quality allows the model to focus learning capacity on the most informative samples
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of and system for converting domain names to a vector space embedding may include receiving data relating to internet traffic over a network, organizing the data into one or more documents that make up a training dataset, each of the one or more documents including one or more Domain Name Server (DNS) queries, providing the training dataset to a deep neural network to generate at least one vector space embedding for one or more domain names, and providing the vector space embedding as an output.