HTTP Tunnel Detection Using Flow Features and AI Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting HTTP tunnels in data communication networks are inefficient, leading to high computational costs and demanding hardware requirements due to the need for deep packet inspection of all network traffic.
Innovation Solution
A method using a collecting device to gather data, process parameter fields, and apply pre-defined rules with an artificial intelligence engine to identify HTTP tunnels, reducing the need for full network traffic analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to detect HTTP tunnels, then detection accuracy is improved, but computational cost and hardware requirements increase significantly
Solution Approach 1:
The patent extracts and analyzes only specific flow-level features (duration, packet count, byte count, inter-arrival times) from HTTP traffic instead of performing deep packet inspection of all traffic. This selective extraction of relevant features maintains detection accuracy while significantly reducing computational cost and resource requirements.
Solution Approach 2:
The patent segments the detection process into two stages: first using lightweight flow-level statistics to filter and identify potential HTTP tunnel candidates, then applying more sophisticated analysis only to these candidates. This segmentation avoids the need for computationally expensive deep packet inspection of all network traffic.
2Measurement precision
If deep packet inspection is used to detect HTTP tunnels, then detection accuracy is improved, but hardware requirements become more demanding
Solution Approach 1:
The patent extracts only essential flow-level metadata (duration, packet count, byte count, timing information) rather than inspecting full packet contents. This extraction approach maintains sufficient detection accuracy while using standard network monitoring hardware without requiring specialized high-performance computing equipment.
3Reliability
If all data packets are collected for HTTP tunnel detection, then detection completeness is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary analysis using flow-level statistics and pre-defined rules to identify potential HTTP tunnel candidates before applying more sophisticated detection methods. This preliminary filtering action reduces the volume of traffic requiring detailed analysis, thereby maintaining detection completeness while reducing overall processing time.
Solution Approach 2:
The patent applies partial inspection by analyzing only the essential flow-level characteristics of packets rather than inspecting complete packet contents. This partial action approach processes traffic more quickly while still achieving sufficient detection reliability for HTTP tunnel identification.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A method for (namely, a method of) detecting one or more HTTP tunnels present in a data communication network, includes using a collecting device arrangement to gather data from data flows occurring between network devices coupled to the data communication network. The method further includes processing the gathered data to generate a plurality of parameter fields that are representative of characteristics of the data flows. A subset of the parameter fields and their associated one or more parameters is processed according to one or more pre-defined rules. The method further includes applying the processed subset of parameters to an artificial intelligence engine to identify whether or not at least a portion of the gathered data corresponding to one or more types of HTTP tunnels. The method provides an efficient detection of the one or more HTTP tunnels with improved detection accuracy and less computational cost.