Encrypted Traffic Classification via ML Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems face challenges in classifying encrypted data traffic, which hinders the assignment of quality of service (QoS) classes and prioritization, as encrypted data cannot be accessed for classification, leading to difficulties in identifying new traffic patterns and types.
Innovation Solution
A communication system is configured with an anomaly detector and a machine learning-based traffic classifier that uses statistical patterns and packet-level statistics to identify encrypted data flows, and automatically updates models to recognize new traffic patterns by labeling and refining machine learning models with anomalous traffic data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data traffic is encrypted, then data security and privacy are improved, but classification accuracy and QoS assignment deteriorate because encrypted data cannot be accessed
Solution Approach 1:
The patent introduces an intermediary machine learning model that acts as a mediator between encrypted traffic and QoS classification. Instead of directly accessing encrypted data, the model learns to map traffic characteristics (packet sizes, intervals, flow patterns) to QoS classes, enabling classification without decryption while maintaining security.
Solution Approach 2:
The patent replaces the traditional mechanical approach of inspecting data content for classification with a machine learning-based statistical analysis system. The system substitutes direct data access with pattern recognition based on traffic metadata, allowing classification to function without breaking encryption.
2Measurement precision
If machine learning models are trained on existing traffic patterns, then classification performance for known traffic types is improved, but the ability to detect and adapt to new traffic patterns deteriorates
Solution Approach 1:
The patent implements a feedback mechanism where the machine learning model continuously receives input from traffic anomaly detection. When new traffic patterns are detected that differ from training data, the system feeds this information back to update and retrain the model, enabling continuous adaptation to evolving traffic types while maintaining performance on known patterns.
Solution Approach 2:
The patent makes the classification system dynamic by enabling continuous model updates. Instead of a static trained model, the system adapts its parameters and structure over time based on incoming traffic data, allowing it to evolve and recognize new traffic patterns while preserving knowledge of previously learned patterns.
3Speed
If traffic classification is performed in real-time, then QoS assignment and bandwidth allocation speed are improved, but computational complexity and model maintenance requirements increase
Solution Approach 1:
The patent performs preliminary actions by pre-training the machine learning model offline on comprehensive traffic datasets before deployment. This preliminary training phase handles the computationally intensive work, allowing the deployed system to perform rapid real-time classification with minimal computational resources, reducing both speed requirements and maintenance complexity.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer-storage media, for traffic flow classification using machine learning. In some implementations, a communication device includes an anomaly detector comprising a machine learning model trained to predict whether data traffic patterns differ from a set of observed traffic patterns present in a set of training data. The communication device includes a traffic classifier comprising a machine learning model trained to predict a quality of service (QoS) class for network connections or data flows. The communication device is configured to evaluate network connections or data flows using the anomaly detector. The communication device may (i) use the traffic classifier to predict QoS classes for traffic that the anomaly detector predicts to be similar to the observed traffic patterns, and (ii) store data traffic that the anomaly detector predicts to be different from the observed traffic patterns.