Asynchronous Large Flow Detection in Communication Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network traffic control systems face challenges in efficiently detecting large flows and responding to changes in traffic due to high resource costs, delays, and limited scalability, making it difficult to address issues like Distributed Denial of Service (DDoS) mitigation and multi-path load balancing.
Innovation Solution
A system and method that uses a controller device to asynchronously calculate traffic rates based on randomly sampled packets, compare them with a threshold, generate notifications for large flows, create filters, assign actions, and install them in network devices using OpenFlow protocol, with the ability to dynamically configure network devices to manage large flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If packet sampling is used to monitor traffic, then network resource costs are reduced, but measurement precision and detection accuracy deteriorate
Solution Approach 1:
The system pre-configures multiple flow detection rules in the controller before traffic analysis begins. These rules are prepared in advance and automatically applied when matching traffic patterns are detected, enabling rapid response without real-time rule compilation overhead.
Solution Approach 2:
The patent introduces an intermediate processing layer that aggregates and analyzes sampled packet data before making control decisions. This intermediary analysis mechanism reconciles the coarse-grained sampled data with fine-grained traffic control requirements, maintaining measurement effectiveness while using resource-efficient sampling.
2Measurement precision
If traditional flow detection methods are used, then comprehensive traffic analysis is achieved, but response time increases and scalability is limited
Solution Approach 1:
The system segments flow detection into multiple independent rule templates that can be individually matched against traffic. This segmentation allows parallel processing of different traffic patterns simultaneously, improving response speed while maintaining comprehensive detection coverage through the collective set of rules.
Solution Approach 2:
The patent applies partial action by implementing a tiered detection approach where commonly attacked protocols and ports are monitored with higher priority and more aggressive detection rules. This allows the system to focus computational resources on the most critical traffic patterns, achieving fast response for high-priority threats while maintaining acceptable detection capability across all traffic.
3Manufacturing precision
If network devices are directly configured for flow control, then control precision is improved, but device complexity and management overhead increase
Solution Approach 1:
The controller serves as an intermediary that centralizes flow rule management and device configuration. It translates high-level security policies into device-specific configuration commands, thereby maintaining precise control while shielding individual network devices from complexity. The controller abstracts the complex coordination logic from the data plane devices.
Solution Approach 2:
The system employs universal flow rule templates that can be applied across multiple network devices with different capabilities. These templates define portable, device-agnostic flow characteristics that can be instantiated on various platform types, reducing the need for device-specific customization and simplifying overall system management.
Data Source
AI summary
A method for controlling large flows in a network includes asynchronously calculating a traffic rate associated with a network flow by a controller device based on a randomly sampled packet, comparing the calculated traffic rate with a threshold value, and generating a notification of a large flow when the rate exceeds the threshold value. The method further includes creating a filter in response to the notification, assigning an action to the filter, and installing the filter and the action in a network device. In addition, the method includes removes the installed filter and action from the network device after a time interval has elapsed.