Endpoint Agent Network Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic analysis approaches face limitations, including inability to monitor devices outside the enterprise network and high storage/bandwidth requirements, especially for devices with limited resources, leading to increased costs and complexity.
Innovation Solution
An agent-based approach that collects network communication metadata on endpoint devices using kernel-level tracing, performs time-based aggregation, and transmits aggregated data to a cloud service for anomaly detection, reducing bandwidth and storage needs, and enabling analysis even when devices are not connected to the enterprise network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network probes/nodes are deployed within the enterprise network to analyze organizational traffic, then network traffic analysis capability is improved, but the system cannot monitor devices when they are not connected to the enterprise network
Solution Approach 1:
The system divides the monitoring function into two segments: a lightweight agent deployed on each endpoint device that collects local network metadata, and a centralized analysis service that processes the aggregated data. This segmentation allows monitoring to occur at the source (endpoint) regardless of network connectivity, while maintaining centralized analysis capabilities.
Solution Approach 2:
The patent introduces an intermediary component (the agent) that resides on the endpoint device and acts as a mediator between the device's network activities and the centralized analysis service. This intermediary collects metadata locally and can buffer it for later transmission, enabling monitoring even when the device is disconnected from the enterprise network.
2Measurement precision
If massive amounts of network traffic are stored for analysis, then analysis accuracy is improved, but storage requirements and system complexity increase significantly
Solution Approach 1:
The system extracts only the essential metadata from complete network traffic data, such as connection timestamps, data volumes, and protocol types, while discarding the actual packet contents. This extraction approach maintains sufficient information for anomaly detection while dramatically reducing storage requirements.
Solution Approach 2:
Instead of analyzing all network traffic in detail, the system applies partial action by focusing only on metadata that is most indicative of anomalies. This selective approach provides sufficient analysis accuracy for security monitoring while avoiding the storage burden of complete traffic capture.
3Measurement precision
If complete network traffic data is collected for analysis, then detection accuracy is improved, but transmission bandwidth consumption increases
Solution Approach 1:
The agent extracts only essential metadata from network traffic, such as connection timing, duration, and data volume metrics, excluding actual packet payloads. This extraction maintains detection accuracy for anomaly identification while minimizing the bandwidth required for transmitting data to the centralized service.
4Adaptability or versatility
If network traffic analysis is performed on devices with limited resources, then monitoring capability is improved, but performance and processing speed deteriorate
Solution Approach 1:
The system extracts only essential metadata from network traffic on resource-constrained devices, avoiding the computationally intensive task of analyzing complete packet streams. This extraction approach enables monitoring capability on devices with limited resources while maintaining acceptable processing speeds.
Solution Approach 2:
The agent performs partial action by collecting only the most critical network metadata rather than complete traffic analysis, which reduces processing overhead and enables monitoring on resource-limited devices without significant performance degradation.
Data Source
AI summary
Systems and methods for an agent-based approach that facilitates endpoint network traffic analysis are provided. According to an embodiment, an agent running on an endpoint device associated with an enterprise network collects network communication metadata from the endpoint device responsive to receiving callbacks from a kernel-level tracing facility implemented within an OS of the endpoint device and locally stores the collected network communication metadata. Further, the agent performs time-based aggregation of the collected metadata to reduce transmission bandwidth and local storage requirements. The aggregated metadata from the endpoint device is submitted to an anomaly detection service when the endpoint device is connected to the enterprise network. The anomaly detection service uses a machine-learning based approach for detection of anomalous behavior.