Encrypted Traffic Classification via SNI and Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Accurate classification of Internet traffic becomes difficult with the increasing use of encrypted communication protocols like HTTPS and QUIC, as traditional methods such as deep packet inspection are less effective, and pattern-based techniques are impacted by underlying network conditions, leading to reduced classification accuracy.
Innovation Solution
A hybrid approach that analyzes both traffic patterns and server name indications (SNIs) using machine learning models to classify encrypted Internet traffic, where initial classifications of individual flows are refined using SNI traffic types as prior probability distributions, minimizing the influence of network conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional deep packet inspection methods are used for traffic classification, then classification can be performed on unencrypted traffic, but classification accuracy deteriorates when encrypted protocols like HTTPS and QUIC are used
Solution Approach 1:
The patent introduces Server Name Indication (SNI) as an intermediary element that bridges the gap between encrypted traffic and classification capabilities. SNI is extracted from TLS handshake packets and serves as a mediator that reveals server identity information without requiring decryption of the actual traffic payload, thereby maintaining classification accuracy while working effectively with encrypted protocols
Solution Approach 2:
The patent replaces traditional deep packet inspection mechanisms with a machine learning-based classification system. Instead of relying on mechanical pattern matching of encrypted bytes, the system uses trained models that analyze traffic flow characteristics combined with SNI information, substituting the mechanical inspection approach with an intelligent classification approach that adapts to encrypted traffic
2Reliability
If pattern-based classification techniques are used, then encrypted traffic can be classified, but accuracy deteriorates due to influence from underlying network conditions
Solution Approach 1:
SNI acts as a mediator that provides stable server-identifying information independent of network conditions. By incorporating SNI into the classification process, the system obtains a reliable feature that is not affected by bandwidth variations, latency, or other network conditions that corrupt pure pattern-based classification
Solution Approach 2:
The patent performs preliminary extraction and classification of SNI information from TLS handshake packets before analyzing traffic patterns. This preliminary action provides a stable baseline classification that is then refined using traffic flow analysis, ensuring that the final classification is not unduly influenced by transient network conditions
3Ease of operation
If only traffic pattern analysis is performed, then classification can be done without additional information, but classification accuracy deteriorates due to network condition variations
Solution Approach 1:
The patent merges two classification approaches: SNI-based classification and traffic pattern-based classification. The SNI extraction provides a first-pass classification that is simple and reliable, which is then combined with machine learning-based traffic flow analysis to produce a final refined classification, achieving both simplicity and high accuracy
Data Source
AI summary
A method includes obtaining a first plurality of encrypted traffic flows traversing a communication network, performing a first classification, wherein a result of the first classification identifies a traffic type associated with each encrypted traffic flow of the first plurality of encrypted traffic flows, and wherein the first classification is based on a traffic pattern of the each encrypted traffic flow, performing a second classification, wherein a result of the second classification identifies a traffic type associated with each server name indication from which the first plurality of encrypted traffic flows is associated, and wherein the second classification is based on the result of the first classification, and performing a third classification identifying a traffic type associated with each encrypted traffic flow of the first plurality of encrypted traffic flows, wherein the third classification is based on a combination of the results of the first classification and the second classification.