Network Device Flow Table Abnormal Record Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices face challenges in efficiently analyzing flow records due to hardware limitations, leading to a mismatch between the number of flow records generated and the analysis speed of analyzers, resulting in reduced monitoring effectiveness and potential missed abnormal packets.
Innovation Solution
A method where a network device generates a flow table and identifies abnormal flows, sending only the corresponding flow records to an analyzer, while processing and aggregating records based on specific rules to reduce the overall number of records analyzed, thereby improving analysis speed and timeliness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the network device sends all flow records to the analyzer, then the analyzer can analyze complete traffic statistics, but the analysis speed cannot match the quantity of flow records generated
Solution Approach 1:
The patent extracts and identifies abnormal flow records from the complete flow table using abnormal flow identification rules, and sends only these abnormal records to the analyzer. This extraction approach maintains analysis precision for critical issues while dramatically reducing the volume of data requiring analysis, thereby resolving the contradiction between completeness and analysis speed.
2Productivity
If an ACL is used to filter packets and create flow tables, then the quantity of flow records is reduced, but abnormal packets are easily missed and monitoring strength is reduced
Solution Approach 1:
The patent performs preliminary action by generating the complete flow table first without filtering, then applies abnormal flow identification rules to detect abnormal flows. This ensures no abnormal packets are missed during the detection phase, while still achieving reduced data volume for analysis by sending only the identified abnormal records to the analyzer.
Solution Approach 2:
The system implements feedback mechanisms where the analyzer analyzes abnormal flow records and sends analysis results back to the network device. This feedback loop continuously improves the accuracy of abnormal packet detection by refining the abnormal flow identification rules based on analysis outcomes, thereby resolving the reliability concern.
3Loss of information
If the network device generates and sends all flow records, then comprehensive monitoring is achieved, but the hardware performance limitations of the analyzer cannot handle the volume
Solution Approach 1:
The patent extracts only abnormal flow records from the complete flow table using identification rules that detect anomalies in packet characteristics, flow patterns, and statistical deviations. This extraction maintains comprehensive monitoring coverage for abnormal conditions while reducing the quantity of flow records to a manageable level that matches analyzer hardware capabilities.
Solution Approach 2:
The patent applies local quality by treating different flow records differently based on their characteristics. Normal flow records are aggregated or summarized, while abnormal flow records are extracted and sent individually for detailed analysis. This differentiated approach maintains monitoring coverage where needed while reducing overall data volume to match analyzer capacity.
Data Source
AI summary
In accordance with an embodiment, a method includes generating, by a network device, a flow table comprising a plurality of flow records; determining, by the network device, whether a data flow corresponding to the plurality of flow records is an abnormal flow; and sending, by the network device, a flow record of the abnormal flow to an analyzer in response to a determination that the data flow is the abnormal flow, so that the analyzer analyzes the abnormal flow.