Event-Based Flow Record Aging for Network Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security measures are inadequate in preventing unauthorized access through emails and instant messaging, and traditional data filtering methods are computationally expensive and memory-intensive, particularly when maintaining flow records for high-speed internet traffic.
Innovation Solution
The proposed solution involves an event-based flow record aging process that uses hardware timestamps to identify and remove older flow records from memory, allowing for efficient allocation of memory blocks and reducing the need for periodic cleanup processes, while also employing a 6-tuple hash to index flow records for fast retrieval and a forensic capture card to sort traffic into separate streams for filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional periodic cleanup processes are used to evaluate flow records, then flow records can be maintained, but computational resources and memory cycles are excessively consumed at high speeds
Solution Approach 1:
The patent replaces continuous periodic cleanup processes with event-driven flow record aging. Flow records are evaluated and removed based on event triggers (packet arrivals, timeouts) rather than continuous periodic scanning, reducing computational overhead while maintaining flow record integrity
Solution Approach 2:
Flow records automatically age and are removed based on their own timestamps and event-driven evaluation, eliminating the need for external periodic cleanup processes. The system serves itself by autonomously managing flow record lifecycles based on embedded timing information
2Productivity
If memory is allocated for storing flow records at high speeds, then flow creation rates can be sustained, but storage requirements increase
Solution Approach 1:
The patent changes the state of flow records from static to dynamic by implementing aging mechanisms. Flow records transition through different states based on their age and activity, allowing the system to optimize memory allocation by removing expired records and prioritizing active flows, thus sustaining high creation rates with controlled storage
3Measurement precision
If comprehensive flow record tracking is implemented for all network traffic, then security monitoring is enhanced, but processing speed decreases
Solution Approach 1:
The patent extracts only the essential elements needed for security monitoring (packet profiles, flow characteristics) rather than tracking complete flow records for all traffic. By taking out only the critical monitoring data and using event-driven evaluation, the system maintains high measurement precision for security threats while achieving line-rate processing speeds
Data Source
AI summary
Systems and processes for filtering network traffic. In one example, an event based flow record aging process may be used to identify flow records to be removed from memory to provide space for newer flow records. In this example, a new incoming network packet may trigger a determination of the flow record to be removed from memory based on the hardware time stamps of the flow records stored in memory. Determining aging flow records in this way may advantageously reduce the amount of computer resources required to manage flow record aging when compared to traditional techniques that require keeping a timer and periodically performing a cleanup process to check the freshness date of each flow record.