Host Identifier Classification in Encrypted Traffic Using Flow Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network providers struggle to correlate encrypted network traffic with upper-layer behaviors, such as identifying which web page a network flow corresponds to, especially when multiple pages are loaded simultaneously, as encrypted traffic obscures the distinction between core and support domains.
Innovation Solution
A network device employs unsupervised learning to create high-dimensional vectors for host identifiers, followed by supervised learning using a labeled ground truth to classify these identifiers into groups, utilizing techniques like natural language processing and word embeddings, enabling the differentiation between core domains and support domains within encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic is encrypted to protect user privacy and security, then security and privacy are improved, but the ability to correlate network flows with web page behaviors is lost
Solution Approach 1:
The patent introduces flow logs as an intermediary that captures metadata about network flows (source/destination IPs, ports, timestamps, durations) without requiring decryption of the actual traffic content. This mediator enables analysis and correlation of network behaviors with web page activities while maintaining encryption of the actual communication content, thus resolving the contradiction between security and analyzability.
2Productivity
If multiple network flows are opened to download resources for web pages, then web page functionality is improved, but the ability to distinguish core domains from support domains is degraded
Solution Approach 1:
The patent applies preliminary action by using unsupervised learning to pre-process and embed flow log data into high-dimensional vectors before classification. This preliminary transformation organizes the complex multi-flow data structure, making subsequent supervised classification of core versus support domains more effective and less complex.
Solution Approach 2:
The patent transforms the original flow log data into high-dimensional vector space through unsupervised learning embeddings. This dimensionality change allows the system to capture complex relationships between multiple network flows and their corresponding web page resources, enabling effective distinction between core and support domains despite the multiplicity of flows.
3Measurement precision
If unsupervised learning is used to create high-dimensional vectors for host identifiers, then classification precision is improved, but computational complexity increases
Solution Approach 1:
The patent applies preliminary action by using unsupervised learning to pre-process and embed flow log data into high-dimensional vectors before classification. This preliminary transformation organizes the complex multi-flow data structure, making subsequent supervised classification of core versus support domains more effective and less complex.
Solution Approach 2:
The patent transforms the original flow log data into high-dimensional vector space through unsupervised learning embeddings. This dimensionality change allows the system to capture complex relationships between multiple network flows and their corresponding web page resources, enabling effective distinction between core and support domains despite the multiplicity of flows.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to the field of computer networks. More specifically, a solution for machine learning-based classification of host identifiers in encrypted network traffic is provided. The classification can, in particular, include natural language processing capabilities. The present disclosure provides a network device (100) for host identifier classification. The network device (100) is configured to obtain a sequence (101) of host identifiers (102), each host identifier (102) corresponding to a flow of encrypted network traffic (103), apply an unsupervised learning technique (104) to the sequence (101) of host identifiers (102) to learn a vector (105) of a high-dimensional space for each host identifier (102) in the sequence (101), obtain a labelled ground truth (106) comprising labels (107) corresponding to a host identifier (102), and apply a supervised learning technique (108) to each vector (105), based on the labelled ground truth (106), to classify the corresponding host identifier (102).