Game Traffic Identification via Packet Arrival Interval Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current traffic identification devices struggle to accurately identify online game traffic due to changes in communication party addresses, leading to low accuracy in classification.
Innovation Solution
The method involves analyzing the distribution feature of arrival time intervals of packets to determine the type of traffic, using a reference time interval probability distribution model and parameters like reciprocal of relative entropy and Kolmogorov-Smirnov test amount to enhance accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If 5-tuple prefix matching is used to identify game traffic, then the identification process is simple, but accuracy deteriorates when communication party addresses change
Solution Approach 1:
The patent changes the identification parameters from static 5-tuple information (source IP, destination IP, source port, destination port, protocol) to dynamic packet arrival time intervals. By analyzing the temporal distribution characteristics of packets rather than relying on fixed address tuples, the system maintains high identification accuracy even when communication addresses change. This parameter transformation enables the system to capture the inherent temporal patterns of game traffic without being constrained by address variability.
2Ease of manufacture
If tuple information of communication parties is used for identification, then the method is straightforward, but reliability deteriorates when addresses change
Solution Approach 1:
The patent performs preliminary analysis of packet arrival time intervals to establish temporal distribution patterns before making identification decisions. By pre-processing the traffic data to extract and analyze time interval characteristics, the system builds a reliable basis for identification that is independent of communication party addresses. This preliminary temporal analysis ensures reliable identification even when address information becomes unreliable due to changes in communication endpoints.
3Productivity
If 5-tuple matching algorithm is applied, then the classification is efficient, but accuracy deteriorates due to address changes
Solution Approach 1:
The patent substitutes the mechanical 5-tuple matching algorithm with a statistical analysis approach based on packet arrival time intervals. Instead of using deterministic matching based on address tuples, the system employs probabilistic analysis of temporal patterns. This substitution maintains computational efficiency while dramatically improving accuracy, as the temporal distribution analysis is unaffected by changes in communication addresses and directly reflects the characteristic behavior of game traffic.
Data Source
AI summary
Embodiments of this application disclose a traffic identification method and a traffic identification device. The method in embodiments of this application includes: The traffic identification device obtains to-be-analyzed traffic of a target data flow. The traffic identification device obtains arrival time intervals of packets of the to-be-analyzed traffic. The traffic identification device determines a type of the to-be-analyzed traffic based on a distribution feature of probabilities of a part or all of the arrival time intervals.