Edge Switch Traffic Classifier Using Packet Length Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current encrypted internet traffic classification methods are resource-intensive and ineffective due to the rise in dynamic port usage and encryption, especially at edge devices like routers and switches, which lack computational resources for accurate real-time classification using large feature sets or unreliable statistical features.
Innovation Solution
A lightweight classification algorithm utilizing a unique set of nine features based on packet length signatures, including run length statistics, allows for efficient classification of traffic flows into classes like audio streaming, video streaming, and file transfers without deep packet inspection or reliance on source/destination ports, enabling accurate classification on edge devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection or large feature sets are used for traffic classification, then classification accuracy is improved, but computational resource consumption increases making real-time classification infeasible at edge devices
Solution Approach 1:
The patent extracts only the most essential features from traffic flows for classification. Instead of using large feature sets or deep packet inspection, the invention identifies and utilizes a small subset of critical features (such as packet length, inter-arrival time, and flow duration) that provide sufficient classification accuracy while minimizing computational overhead at edge devices
Solution Approach 2:
The patent inverts the traditional classification approach by moving the classification function from centralized cloud-based processing to distributed edge devices. This inversion enables real-time classification at the network edge using lightweight algorithms, eliminating the need for resource-intensive cloud processing while maintaining classification effectiveness
2Use of energy by moving object
If statistical features are used for traffic classification, then computational overhead is reduced, but classification accuracy deteriorates due to inconsistency across different networks
Solution Approach 1:
The patent changes the parameters used for classification from traditional statistical features to packet-level characteristics. By focusing on packet length distributions, inter-arrival time patterns, and flow duration metrics, the invention achieves consistent classification results across different network environments while maintaining low computational overhead at edge devices
3Measurement precision
If cloud-based processing is used for traffic classification, then classification accuracy is improved, but network latency increases and real-time classification is compromised
Solution Approach 1:
The patent performs preliminary action by pre-configuring lightweight classification algorithms and feature extraction rules at edge devices before traffic classification is needed. This preparation enables immediate real-time classification at the network edge without requiring data transmission to or from cloud-based processing systems, eliminating network latency while maintaining classification effectiveness
Data Source
AI summary
Systems and methods are provided for a light-weight model for traffic classification within a network fabric. A classification model is deployed onto an edge switch within a network fabric, the model enabling traffic classification using a set of statistical features derived from packet length information extracted from the IP header for a plurality of data packets within a received traffic flow. The statistical features comprise a number of unique packet lengths, a minimum packet length, a maximum packet length, a mean packet length, a standard deviation of the packet length, a maximum run length, a minimum run length, a mean run length, and a standard deviation of run length. Based on the calculated values for the statistical features, the edge switch determines a traffic class for the received traffic flow and tags the traffic flow with an indication of the determined traffic class.