Header-Based Packet Filtering for Malicious Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in real-time detection of malicious network traffic due to the computational overhead required for whole packet analysis, limiting the ability to dynamically compute and update firewall rules effectively.
Innovation Solution
The use of parallel processing units, such as graphics processing units (GPUs), to classify and filter network traffic based on packet header information, reducing computational requirements by performing flow analysis and inferencing using deep learning techniques, allowing for accelerated identification of malicious traffic without the need for whole packet analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If whole packet analysis is used to classify network traffic, then classification accuracy is improved, but computational overhead increases reducing real-time processing capability
Solution Approach 1:
The patent extracts and analyzes only the header portion of network packets rather than performing whole packet analysis. This selective extraction of critical header fields (source/destination IP addresses, ports, protocol types) enables classification decisions to be made with reduced computational overhead while maintaining sufficient accuracy for identifying malicious traffic patterns.
Solution Approach 2:
The patent segments the network traffic analysis process into distinct stages: header field extraction, flow classification based on header information, and separate deep learning-based inferencing. This segmentation allows parallel processing where multiple packets can be classified simultaneously based on headers while deep learning analysis operates on aggregated flow data, improving overall processing throughput.
2Measurement precision
If deep learning techniques are applied to network traffic analysis, then detection accuracy is improved, but computational resources and processing time increase
Solution Approach 1:
The patent performs preliminary classification of network packets into flows based on header information before applying deep learning techniques. By pre-grouping packets into flows using simple header-based rules (matching source/destination IP and port combinations), the system reduces the input data size for deep learning analysis and enables parallel processing of multiple flows simultaneously, significantly reducing overall processing time.
Solution Approach 2:
The patent applies deep learning techniques selectively to aggregated flow data rather than to every individual packet. This partial application of computationally intensive methods only where needed (at the flow level rather than packet level) maintains high detection accuracy while reducing total computational resource consumption and processing time.
3Productivity
If parallel processing units are used to accelerate traffic analysis, then processing speed is improved, but system complexity increases
Solution Approach 1:
The patent employs graphics processing units (GPUs) as parallel processing units to perform multiple functions: header field extraction, flow classification, and deep learning inferencing. This multi-functional use of a single parallel processing architecture simplifies the overall system design compared to using separate specialized hardware for each function, while still achieving high processing speeds through parallel execution of all operations.
Data Source
AI summary
In various examples, a first network interface duplicates received network traffic and forwards a first set of network traffic data to a central processing unit (CPU) and a second set of identical network traffic to one or more parallel processing units (PPUs). In an embodiment, the one or more PPUs analyze the second set of network traffic to identify whether the second set of network traffic is malicious. First, the one or more PPUs filter and classify the second set of network traffic into flows, or logical groupings or subsets of the second set of network traffic. Second, the one or more PPUs sort the network packets within each flow and extract features of interest specific to each flow. Using the extracted features of interest, one or more deep learning techniques infer a status indicating whether each flow is malicious (mal) or good. The one or more PPUs then forward the status for each flow to the CPU for use in determining which network traffic from the first set of network traffic is to be forwarded to a second network interface.