Enriching Encrypted Traffic Analytics via Flow Data Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Many networks lack the necessary hardware to fully exploit Encrypted Traffic Analytics (ETA) due to insufficient capabilities for extracting ETA telemetry data, resulting in incomplete benefits from this valuable information source.
Innovation Solution
A method is developed to generate a database that maps traffic flow information features to encrypted traffic analytics features, allowing for the determination of encrypted traffic analytics features for domains lacking this information using machine learning models constructed from domains with both types of data available, thereby enriching knowledge about network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If Encrypted Traffic Analytics (ETA) is deployed in networks, then valuable information about network traffic and devices can be extracted, but hardware capability requirements become too high for many networks
Solution Approach 1:
The patent creates a mapping model that copies ETA features from domains with ETA capability to domains without ETA capability. By using traffic flow information features as a proxy and establishing correspondence relationships through machine learning models, the system replicates ETA information for domains where direct ETA extraction is not available, thereby reducing hardware requirements while maintaining information availability.
2Adaptability or versatility
If machine learning models are trained with both traffic flow information and ETA information, then ETA features can be determined for domains with only traffic flow data, but data requirements and processing complexity increase
Solution Approach 1:
The patent extracts the essential mapping relationship between traffic flow information features and ETA features through machine learning models. By training on domains with both types of data and then applying the learned mapping to domains with only traffic flow data, the system extracts and transfers only the necessary feature correspondence information, reducing the actual data requirements during deployment while maintaining adaptability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for enriching encrypted traffic analytics are presented, In one embodiment, a method includes obtaining telemetry data for one or more domains within a network. The telemetry data includes both encrypted traffic analytics information and traffic flow information associated with the network traffic. For each domain of the one or more domains, the method also includes generating a model comprising a mapping from a plurality of traffic flow information features to at least one encrypted traffic analytics feature. The method includes generating a database comprising generated models for each of the domains and obtaining telemetry data for a target domain that includes traffic flow information, but does not include encrypted traffic analytics information. At least one encrypted traffic analytics feature of the target domain is determined based on a plurality of traffic flow information features of the target domain using the database.