Flow Sampling Network Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network administrators face difficulties in identifying and tracking unauthorized or malicious network activities, such as unexpected protocols, programs, or services, which can interfere with network operations and pose security threats, especially in large networks where distinguishing legitimate from suspicious traffic is challenging.
Innovation Solution
Implementing flow sampling to monitor network traffic across multiple devices, comparing source and destination ports to a list of approved ports, maintaining a suspicious activity list, and alerting administrators when unusual ports exceed a threshold, thereby detecting and managing suspicious network activity without blocking valid traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If flow sampling is implemented to monitor network traffic, then the ability to detect suspicious activity is improved, but the device complexity increases
Solution Approach 1:
The patent segments the network monitoring function by deploying flow sampling capabilities at multiple network devices (routers, switches, firewalls) rather than requiring a single centralized system to analyze all traffic. Each device independently performs flow sampling and local analysis, dividing the detection task across multiple components and reducing the complexity burden on any single device.
Solution Approach 2:
The patent introduces flow sampled data as an intermediary representation of network traffic. Instead of directly analyzing complete packet streams, the system uses condensed flow records that capture essential traffic characteristics. This intermediary data structure simplifies the detection process while maintaining effective monitoring capability.
2Measurement precision
If comprehensive network traffic monitoring is performed, then the detection of malicious activities is improved, but the loss of information increases due to the volume of data
Solution Approach 1:
The patent extracts only the essential and relevant features from complete network traffic data through flow sampling. Instead of retaining and analyzing all packet details, the system extracts key flow characteristics (source/destination addresses, ports, protocols, byte counts) that are sufficient for detecting suspicious activities while discarding redundant information.
Solution Approach 2:
The patent applies partial monitoring by sampling a representative subset of network traffic flows rather than analyzing every single packet. This partial action approach provides sufficient detection capability for identifying suspicious patterns while significantly reducing the data volume that must be managed and processed.
3Reliability
If network administrators implement strict security monitoring, then the reliability of network security is improved, but the ease of operation deteriorates due to the difficulty of distinguishing legitimate from suspicious traffic
Solution Approach 1:
The patent performs preliminary classification of network traffic into approved and suspicious categories based on flow sampled data before full analysis. By pre-establishing criteria for legitimate traffic patterns and identifying anomalies early in the monitoring process, the system prepares structured information that simplifies subsequent administrative review and decision-making.
Solution Approach 2:
The patent implements feedback mechanisms where detection results and suspicious activity patterns are continuously analyzed and used to refine monitoring rules. The system provides feedback to administrators about detected anomalies and allows for rule adjustments based on observed traffic patterns, making the monitoring process progressively easier to operate while maintaining high security reliability.
Data Source
AI summary
Methods, media, and computing devices for network security can include receiving flow sampled network traffic from multiple network devices with a network monitoring computing device for network traffic among multiple computing devices, comparing source ports and destination ports in the flow sampled network traffic to a list of approved ports with the network monitoring computing device, and detecting suspicious network activity for flow sampled network traffic having a source port and a destination port exceptional to the list of approved ports with the network monitoring computing device. Alternatively, a suspicious network activity list can be maintained for flow sampled network traffic having source and destination ports exceptional to the list of approved ports. Alternatively, a network administrator can be alerted when a port is added to the suspicious network activity list in response to a total number of ports in the suspicious network activity list exceeding a threshold number.