Dynamic Traffic Steering for Network Security

The patent segments network traffic into different categories (suspicious vs. normal) and routes them through different paths. A traffic steering component divides the voluminous traffic stream, sending only suspicious traffic to resource-constrained security services for intensive analysis, while normal traffic is offloaded to capacious communication channels. This segmentation resolves the contradiction by maintaining comprehensive threat detection capability while significantly reducing resource consumption at security services.

The patent extracts and isolates suspicious traffic from the bulk normal traffic using machine learning-based classification. By taking out only the relevant suspicious packets for security service analysis and leaving normal traffic to be handled by other channels, the system achieves effective threat detection without overwhelming security service resources with unnecessary traffic volume.

The patent replaces static routing with dynamic traffic steering decisions made by machine learning models. The system continuously analyzes traffic characteristics, identifies suspicious patterns, and dynamically adjusts routing decisions in real-time based on current threat levels and traffic types. This dynamic approach maintains ease of traffic splitting while adding adaptability to respond to evolving threats and changing network conditions.

The patent implements feedback loops where security services analyze traffic samples, generate threat assessments, and feed this information back to the traffic steering component. This feedback mechanism enables the system to continuously adapt routing decisions based on actual threat levels detected, transforming static routing into a dynamic, responsive system that can adjust to changing security conditions while maintaining operational simplicity.

The patent segments traffic into suspicious and normal categories using machine learning classification, directing only suspicious traffic to resource-constrained security services. This segmentation maintains complete analysis coverage for threats while improving service performance by eliminating the performance-deteriorating burden of processing voluminous normal traffic through the same resource-constrained services.

The patent applies partial action by sending only a subset of traffic (suspicious traffic identified through classification) to security services rather than all traffic. This partial approach ensures complete threat analysis coverage while preventing performance deterioration by avoiding the excessive load that would result from processing entire traffic volumes through resource-constrained services.