Edge Visibility Network Using Rule-Based Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network providers face challenges in improving latency and bandwidth efficiency due to varying network user behaviors and conditions, with existing technologies like US 2016/294776 A1 and US 2017/163685 A1 focusing on security operations and mobile radio networking without addressing comprehensive network visibility and traffic management.
Innovation Solution
A third-party component at the network edge maintains a rule table and performs deep packet inspection to derive network packet characteristics, providing network visibility and actionable insights through deep learning and anomaly detection, enabling efficient network management and user experience optimization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection and rule table matching are performed at the network edge, then network visibility and traffic management capability are improved, but device complexity and processing overhead increase
Solution Approach 1:
The network edge device is segmented into multiple independent components including a rule table maintenance module, a packet inspection module, and an action execution module. This segmentation allows each component to perform its specific function independently, improving network visibility through specialized processing while managing overall device complexity by distributing functions across modular units.
Solution Approach 2:
A rule table acts as an intermediary data structure between incoming network packets and action execution. The rule table stores pre-defined matching criteria and corresponding actions, serving as a mediator that translates complex packet inspection requirements into actionable decisions, thereby improving measurement precision without proportionally increasing device complexity.
2Manufacturing precision
If packet inspection and rule matching are performed for every network packet, then traffic management accuracy is improved, but processing time and latency increase
Solution Approach 1:
The rule table is maintained and populated with matching criteria and actions in advance, before actual packet inspection occurs. This preliminary preparation allows the inspection module to perform rapid pattern matching against pre-compiled rules, improving traffic management accuracy while minimizing real-time processing time by avoiding complex rule compilation during packet handling.
3Adaptability or versatility
If third-party components are deployed at the network edge, then network control and visibility are improved, but network security risks and vulnerability to attacks increase
Solution Approach 1:
The system implements feedback mechanisms where the third-party component monitors network traffic patterns and performance metrics, then adjusts rule table contents and inspection parameters accordingly. This closed-loop control improves network adaptability and visibility while enhancing security through continuous monitoring and dynamic adjustment of inspection behavior based on observed traffic characteristics.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are system, method, and computer program product embodiments for providing traffic visibility in a network. An embodiment operates by a third-party component in communication with a network component - each located at a network's edge - maintaining a rule table including a first rule comprising first identifiers and a first action for deriving a first packet characteristic. The third-party component receives a first packet copy including second identifiers from the network component. Upon the second identifiers matching the first identifiers, the third-party component determines the rule table's second rule includes a second action for deriving a second packet characteristic. Thereafter, the third-party component receives a second packet copy comprising third identifiers from the network component. Upon the third identifiers matching the first identifiers, the third-party component identifies the rule table's second rule and performs the second rule to derive the second packet characteristic based on the second packet's data.