HTTP Traffic Classification for Deep Inspection Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security systems (NSS) introduce significant latency and consume excessive computational resources due to resource-intensive deep inspection of network traffic, particularly for high-bandwidth, low-security-risk content, leading to network traffic jams and diminished user experience.
Innovation Solution
Implementing an endpoint routing client (ERC) with a bypass list to classify traffic as either loss prevention inspectable or bandwidth conservable, tunneling the latter directly to web services without NSS inspection, and using server-side lists to reclassify and bypass inspection for certain traffic types, thereby reducing latency and error.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep inspection of all network traffic is performed, then security enforcement is improved, but latency increases and network performance deteriorates
Solution Approach 1:
The patent applies different inspection levels to different traffic flows based on their security risk profiles. Low-risk traffic receives minimal inspection (header-only), medium-risk traffic receives standard inspection, and high-risk traffic receives deep inspection. This local differentiation of inspection quality resolves the contradiction by applying security enforcement only where necessary, reducing latency for safe traffic while maintaining security for risky traffic.
Solution Approach 2:
The network traffic is segmented into multiple risk categories (low, medium, high) based on classification criteria. Each segment is then processed differently through the inspection pipeline. Low-risk segments bypass deep inspection entirely, medium-risk segments receive partial inspection, and high-risk segments undergo full deep inspection. This segmentation allows the system to maintain security enforcement while reducing overall latency.
2Reliability
If deep inspection of all network traffic is performed, then security enforcement is improved, but computational resources are consumed excessively
Solution Approach 1:
The system applies computational resources locally and selectively based on traffic risk assessment. Instead of uniformly applying deep inspection to all traffic, the system concentrates computational resources only on high-risk traffic flows that actually require thorough security analysis. Low-risk traffic consumes minimal computational resources, resolving the contradiction between security enforcement and resource consumption.
Solution Approach 2:
The system performs partial inspection (header-only or standard inspection) for low and medium risk traffic, reserving full deep inspection only for high-risk traffic. This partial action approach ensures that computational resources are not excessively consumed on traffic that does not require complete inspection, while still maintaining adequate security enforcement through the differentiated inspection levels.
3Reliability
If deep inspection of all network traffic is performed, then security enforcement is improved, but network bandwidth is consumed excessively causing traffic jams
Solution Approach 1:
The system applies different inspection depths to different traffic flows based on their security risk classification. Low-risk traffic undergoes minimal inspection with small data extraction, medium-risk traffic receives standard inspection, and high-risk traffic receives deep inspection. This local differentiation reduces the overall bandwidth consumption by the security system while maintaining enforcement effectiveness for critical traffic.
4Loss of energy
If classification is performed to enable selective bypass, then bandwidth efficiency is improved, but device complexity increases
Solution Approach 1:
The system performs traffic classification and risk assessment in advance, before the inspection phase. Traffic is pre-categorized into risk levels based on headers, metadata, and content analysis, and this classification information is stored for subsequent processing decisions. This preliminary action enables the system to efficiently route traffic to appropriate inspection levels without adding significant complexity during the main data flow processing.
Data Source
AI summary
The technology disclosed relates to reducing error in security enforcement by a network security system (abbreviated NSS). The NSS classifies incoming connection access requests as loss prevention inspectable or connection preserving by determining their conformance or non-conformance with semantic and content requirements of HTTP and HTTPs protocols. The NSS forwards the loss prevention inspectable connection access requests to a data inspection and loss prevention appliance (abbreviated DILPA) for deep inspection. The NSS directly sends the connection preserving connection access requests to the destination servers, preventing connection termination and error generation.