Real-time Deep Packet Inspection Enrichment via Flow Identifier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep packet inspectors (DPIs) require manual reconfiguration when criteria change, leading to missed packets due to static configurations and random changes in device identifiers, such as MAC addresses, which can compromise privacy and network monitoring accuracy.
Innovation Solution
A flow identifier that iteratively accesses records from gateway routers to identify and update device identifiers in real-time, ensuring that new packet flows and attribute changes are captured by the DPI, using machine-learned models to normalize and analyze AAA records for accurate packet selection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a DPI is manually configured with static criteria, then the configuration is simple and stable, but the DPI misses packets when device identifiers change and requires manual reconfiguration
Solution Approach 1:
The system enables the DPI to automatically update its own configuration by having it monitor the gateway router and receive real-time device identifier information, eliminating the need for manual reconfiguration when devices join or change identifiers
Solution Approach 2:
The gateway router provides continuous feedback about device identifier changes to the DPI, allowing the DPI to dynamically adjust its packet capture criteria based on current network conditions rather than relying on static configuration
2Adaptability or versatility
If the DPI configuration remains static, then the device complexity is low, but the DPI cannot adapt to new packet flows or identifier changes
Solution Approach 1:
The gateway router acts as an intermediary between the dynamic device identifier space and the DPI, collecting and distributing device identifier information to enable the DPI to adapt without directly handling the complexity of identifier management
Solution Approach 2:
The gateway router performs multiple functions including routing, authentication, and device identifier management, consolidating the adaptability function in a single component rather than requiring the DPI to handle all adaptation logic
3Measurement precision
If manual reconfiguration is performed whenever criteria change, then the DPI configuration remains accurate, but the loss of time due to manual intervention increases
Solution Approach 1:
The system maintains continuous monitoring of device identifier changes by the gateway router and continuously provides updated information to the DPI, ensuring packet selection accuracy without interruption or manual intervention
Solution Approach 2:
The gateway router pre-collects and maintains device identifier information before the DPI needs to use it, so that when the DPI needs to capture packets, the accurate criteria are already available without waiting for manual configuration
Data Source
AI summary
Real-time enrichment for deep packet inspection is disclosed. A flow identifier iteratively accesses records generated in response to actions by a plurality of computing devices that are communicating through a same gateway router. Each record identifies a device identifier of a corresponding computing device of the plurality of computing devices. A subset of computing devices of the plurality of computing devices is identified based on a criterion. Device identifier information comprising device identifiers that identify the subset of computing devices is generated, each device identifier corresponding to one of the computing devices in the subset of computing devices. The device identifier information is provided to a deep packet inspector that monitors the gateway router and captures packets communicated through the gateway router based on the device identifiers.