IP Conversation Detection via Packet Header Merging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network monitoring tools face challenges in efficiently analyzing and storing vast amounts of IP packet headers, leading to storage inefficiencies, incomplete data capture, and difficulty in identifying potential network threats, especially when attackers send small numbers of packets without signature triggers, and there is a lack of real-time analysis capabilities for multicast packet transmission issues.
Innovation Solution
A computer-based method and system for collecting and storing unique IP packet headers, determining the highest probability service port for each IP-to-IP packet combination, accumulating records with timestamp and byte transfer data, and tracking conversations across IP networks, enabling efficient storage and real-time analysis of network traffic patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If all packet headers are stored individually in a database, then complete network traffic data is captured, but storage space and analysis time are excessively consumed
Solution Approach 1:
The patent merges multiple identical or similar packet header records into a single consolidated record. When duplicate packets are detected (same source IP, destination IP, source port, destination port, and protocol), they are combined into one record that includes count information, thereby reducing storage requirements while preserving complete traffic analysis capability.
Solution Approach 2:
The consolidated packet header record serves multiple functions: it stores the actual packet header data, includes a count of duplicate packets, provides timing information (first seen, last seen), and enables both storage efficiency and comprehensive traffic analysis through a single unified data structure.
2Ease of manufacture
If a fixed number of bytes is allocated per captured packet, then storage allocation is simplified, but data truncation occurs when the fixed size is insufficient
Solution Approach 1:
The patent changes the storage parameter from a fixed byte allocation per packet to a dynamic structure where each consolidated record stores only the actual length of the packet header data needed. This allows the system to adapt to varying packet header sizes without truncation while maintaining simple storage allocation through standardized record formats.
3Ease of operation
If individual TCP or UDP protocol sessions are tracked separately, then protocol-specific analysis is simplified, but conversations between IP addresses cannot be identified
Solution Approach 1:
The patent adds a new dimension to packet tracking by consolidating records at the IP conversation level rather than just the protocol session level. Each consolidated record encompasses multiple TCP or UDP sessions between the same pair of IP addresses, enabling conversation-level analysis while preserving protocol-specific details within the unified record structure.
4Measurement precision
If manual review of log files is performed to identify attacker activity, then detailed analysis is possible, but real-time detection and accuracy are compromised
Solution Approach 1:
The system performs automated analysis of consolidated packet header data to identify potential attacker activity patterns. By processing the consolidated records through automated algorithms that detect unusual communication patterns, the system achieves both real-time detection capability and accurate attack identification without requiring manual log review.
Data Source
AI summary
A computer-based method for collecting and storing types and quantities of traffic passing through an internet protocol (IP) network is described. The method includes extracting, from a database, a single instance of each unique packet header associated with a plurality of IP-to-IP packets, the IP-to-IP packets having been transmitted across the computer network over a predefined period of time, determining a highest probability service port for each IP-to-IP packet combination using the extracted packet headers, accumulating all IP-to-IP-on-Port packet combinations into a single record, the single record including a first packet time, a last packet time, and a total number of bytes transferred, storing the records for all IP-to-IP-on-Port conversations in the database, accumulating the packets based on IP-to-IP-on-protocol if the packets were part of a protocol where port numbers do not exist, and storing the accumulated packets where port numbers do not exist in the database.