Encrypted Traffic Classification via WHOIS and NLP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing encryption of network traffic makes it difficult for operators to identify and classify traffic types, leading to potential revenue loss and inadequate network upgrade decisions, as existing methods rely on outdated sources and are unable to accurately categorize new services like video streaming and gaming.
Innovation Solution
A system and method using WHOIS data, web scraping, and natural language processing to classify traffic flows by determining sender information, parsing online information for keywords, and employing language models to infer application types, enabling the classification of encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is applied to network traffic to protect data, then security is improved, but the ability to identify and classify traffic types deteriorates
Solution Approach 1:
The patent uses WHOIS data and web scraping as intermediary sources to obtain information about senders and services. Instead of directly analyzing encrypted traffic (which loses information), the system queries external databases and websites to infer traffic types from sender information, hostnames, and online presence data.
Solution Approach 2:
The patent replaces traditional deep packet inspection (mechanical analysis of traffic content) with language processing and natural language inference. By substituting the mechanical approach of examining encrypted payloads with linguistic analysis of publicly available information, the system maintains classification capability without requiring decryption.
2Adaptability or versatility
If traditional traffic identification methods are used, then implementation simplicity is maintained, but the ability to identify new services deteriorates
Solution Approach 1:
The patent creates a universal classification system that handles multiple service types (video streaming, gaming, file sharing, etc.) through a single platform. The system queries WHOIS databases, scrapes web content, and applies language processing to identify diverse traffic types, making the solution adaptable to new services without requiring service-specific configurations.
Solution Approach 2:
The system performs preliminary actions by pre-querying WHOIS databases and pre-scraping web information about senders and services before traffic classification is needed. This advance preparation creates a knowledge base that enables rapid identification of new services when traffic patterns emerge, reducing the complexity of real-time analysis.
3Productivity
If manual traffic classification is performed, then classification accuracy can be maintained, but processing speed deteriorates
Solution Approach 1:
The patent implements self-service through automated language processing that independently analyzes WHOIS data, web scraping results, and traffic metadata. The system uses natural language models to automatically infer service types without human intervention, maintaining high classification accuracy while achieving automated processing speeds.
Solution Approach 2:
The system changes parameters by transforming unstructured text data from WHOIS records and web scraping into structured classification results. By converting textual information about senders and services into quantifiable language features and semantic representations, the system enables automated processing while preserving the nuance needed for accurate classification.
Data Source
AI summary
A method and system for classifying traffic flows on a computer network, the method including: determining sender information associated with a traffic flow; determining Whols data associated with the sender information; determining online information associated with the Whols data or hostname; parsing the online information for keywords; and classifying the traffic flow based on the keywords or natural language description. The system including: a Whols module configured to determine sender information associated with a traffic flow and determine Whols data or hostname associated with the sender information; a search request and response module configured to determine online information associated with the Whols data; a language model configured to parse the online information for keywords; and a Service and Category recognizer configured to classify the traffic flow based on the keywords or natural language descriptions.