Edge Traffic Visibility Using Packet Rules and Anomaly Baselines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network providers face challenges in improving user experience by optimizing latency and bandwidth efficiency, which is influenced by variables such as network user behavior and application usage, making it difficult to enhance network performance.
Innovation Solution
A third-party component at the network edge maintains a rule table with identifiers and actions to derive packet characteristics, performs deep packet inspection, and provides network visibility and insights using metadata derived from user data, enabling network actions to improve latency and bandwidth.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If deep packet inspection and rule table matching are implemented at the network edge, then network visibility and analytics capability are improved, but device complexity and processing overhead increase
Solution Approach 1:
The network processing function is segmented into multiple components: network component for packet reception, third-party component for rule table maintenance and deep packet inspection, and analytics component for generating insights. This segmentation distributes processing complexity across specialized modules while maintaining comprehensive network visibility.
Solution Approach 2:
A third-party component acts as an intermediary between the network component and the analytics system. This intermediary maintains the rule table, performs deep packet inspection, and bridges the gap between raw packet data and actionable analytics, reducing the complexity burden on individual components.
2Loss of time
If real-time packet analysis and rule matching are performed, then latency optimization is improved, but processing time and computational resources increase
Solution Approach 1:
The rule table is pre-configured with identification rules and actions before packet processing begins. Network packets can be quickly matched against pre-defined rules, enabling rapid decision-making without requiring complex real-time analysis, thus reducing latency while managing processing power efficiently.
Solution Approach 2:
Different processing strategies are applied based on packet characteristics and rule priorities. High-priority packets with critical latency requirements receive expedited processing with simplified rule matching, while less time-sensitive packets undergo more comprehensive analysis, optimizing the balance between latency and processing power.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for providing traffic visibility in a network. An embodiment operates by a third-party component receiving a copy of a first data packet during a first period of time. The third-party component extracts a first network parameter associated with the first period of time from the copy of the first data packet. The third-party component then predicts a baseline of normalcy for the first network parameter during a second period of time after the first period of time based on data associated with a copy of a second data packet and the first network parameter. Thereafter, the third-party component receives a copy of a third data packet during the second period of time, and extracts a second network parameter from the copy of the third data packet. The third-party component then determines that the second network parameter of the copy of the second data packet is an anomaly based on the baseline of normalcy for the first network parameter.