Machine-Learned Network Traffic Classification for Encrypted Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification techniques, such as shallow packet inspection and deep packet inspection, are inadequate for accurately analyzing encrypted traffic and require significant computational resources, limiting their effectiveness in modern communications networks.
Innovation Solution
A machine-learning-based approach that generates dynamic intent scores by comparing web embeddings with reference embeddings, using neural networks to analyze URL data objects and extract keywords, allowing for intent-based classification without decrypting network packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to analyze network traffic, then classification accuracy is improved, but computational resources required increase significantly
Solution Approach 1:
The patent extracts only the necessary features from network packets (such as destination port, protocol type, and other header fields) rather than performing complete deep packet inspection of the entire payload. This selective feature extraction maintains sufficient classification accuracy while dramatically reducing computational resource consumption.
Solution Approach 2:
The patent replaces traditional mechanical packet inspection methods with machine learning classification models that can efficiently process network traffic data. The ML models learn patterns from labeled data and can classify traffic types without requiring intensive computational analysis of packet contents, thus reducing processing requirements while maintaining accuracy.
2Measurement precision
If deep packet inspection is used to classify network traffic, then classification accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent performs preliminary actions by pre-processing network data to extract relevant features and preparing training data for machine learning models before actual classification occurs. This pre-extraction of meaningful features from network packets enables faster classification decisions during runtime, as the system only needs to evaluate pre-identified features rather than analyzing entire packet contents in real-time.
Solution Approach 2:
The patent substitutes traditional real-time packet inspection mechanisms with pre-trained machine learning classifiers that can rapidly process extracted features. The ML models, once trained, can classify network traffic types quickly without requiring intensive computational processing during classification, thereby improving processing speed while maintaining accuracy.
3Speed
If shallow packet inspection is used for network traffic analysis, then processing speed is maintained, but classification accuracy is limited
Solution Approach 1:
The patent creates a universal classification system that can handle multiple network traffic types and scenarios using a single machine learning model framework. The model is trained on diverse network data representing various protocols, applications, and traffic patterns, enabling it to accurately classify different types of traffic without requiring separate inspection mechanisms for each protocol, thus maintaining speed while improving accuracy.
Solution Approach 2:
The patent replaces the limited accuracy of shallow packet inspection with machine learning-based classification that can infer traffic types from extracted features. The ML models learn complex patterns and relationships between network parameters, enabling accurate classification of encrypted and obfuscated traffic that traditional shallow inspection cannot detect, while maintaining processing speed through efficient feature-based classification.
Data Source
AI summary
A method includes receiving target input data that includes keyword input data and accessing processed network data that includes a plurality of groups. Each of the groups includes a plurality of URL data objects and is associated with an entity. The method includes generating a dynamic intent score for each group by, for each of the URL data objects, extracting keywords from a webpage associated with the URL data object that are similar to keywords of the target input data, comparing the extracted keywords with the target input data, generating a keyword comparison value for the URL data object, and generating the dynamic intent score based on the keyword comparison values. The method includes ranking the groups according to their respective dynamic intent scores, selecting a subset of the groups according to the ranking, and generating a target account list including the entities associated with the subset of the groups.


