Machine-Learned Network Traffic Classification for Encrypted Data

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing network traffic classification techniques, such as shallow packet inspection and deep packet inspection, are inadequate for accurately analyzing encrypted traffic and require significant computational resources, limiting their effectiveness in modern communications networks.

Innovation Solution

A machine-learning-based approach that generates dynamic intent scores by comparing web embeddings with reference embeddings, using neural networks to analyze URL data objects and extract keywords, allowing for intent-based classification without decrypting network packets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If deep packet inspection is used to analyze network traffic, then classification accuracy is improved, but computational resources required increase significantly

Engineering Contradiction:
Improveclassification accuracyVSAvoidcomputational resources
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the necessary features from network packets (such as destination port, protocol type, and other header fields) rather than performing complete deep packet inspection of the entire payload. This selective feature extraction maintains sufficient classification accuracy while dramatically reducing computational resource consumption.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent replaces traditional mechanical packet inspection methods with machine learning classification models that can efficiently process network traffic data. The ML models learn patterns from labeled data and can classify traffic types without requiring intensive computational analysis of packet contents, thus reducing processing requirements while maintaining accuracy.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If deep packet inspection is used to classify network traffic, then classification accuracy is improved, but processing speed decreases

Engineering Contradiction:
Improveclassification accuracyVSAvoidprocessing speed
Core Design Contradiction:
Measurement precisionVSSpeed

Solution Approach 1:

The patent performs preliminary actions by pre-processing network data to extract relevant features and preparing training data for machine learning models before actual classification occurs. This pre-extraction of meaningful features from network packets enables faster classification decisions during runtime, as the system only needs to evaluate pre-identified features rather than analyzing entire packet contents in real-time.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent substitutes traditional real-time packet inspection mechanisms with pre-trained machine learning classifiers that can rapidly process extracted features. The ML models, once trained, can classify network traffic types quickly without requiring intensive computational processing during classification, thereby improving processing speed while maintaining accuracy.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Speed

If shallow packet inspection is used for network traffic analysis, then processing speed is maintained, but classification accuracy is limited

Engineering Contradiction:
Improveprocessing speedVSAvoidclassification accuracy
Core Design Contradiction:
SpeedVSMeasurement precision

Solution Approach 1:

The patent creates a universal classification system that can handle multiple network traffic types and scenarios using a single machine learning model framework. The model is trained on diverse network data representing various protocols, applications, and traffic patterns, enabling it to accurately classify different types of traffic without requiring separate inspection mechanisms for each protocol, thus maintaining speed while improving accuracy.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent replaces the limited accuracy of shallow packet inspection with machine learning-based classification that can infer traffic types from extracted features. The ML models learn complex patterns and relationships between network parameters, enabling accurate classification of encrypted and obfuscated traffic that traditional shallow inspection cannot detect, while maintaining processing speed through efficient feature-based classification.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12406010B2Machine-learned classification of network traffic
Publication Date: 2025.09.02 INTENTSIFY LLC
  • US12406010B2 patent drawing
  • US12406010B2 patent drawing
  • US12406010B2 patent drawing

AI summary

A method includes receiving target input data that includes keyword input data and accessing processed network data that includes a plurality of groups. Each of the groups includes a plurality of URL data objects and is associated with an entity. The method includes generating a dynamic intent score for each group by, for each of the URL data objects, extracting keywords from a webpage associated with the URL data object that are similar to keywords of the target input data, comparing the extracted keywords with the target input data, generating a keyword comparison value for the URL data object, and generating the dynamic intent score based on the keyword comparison values. The method includes ranking the groups according to their respective dynamic intent scores, selecting a subset of the groups according to the ranking, and generating a target account list including the entities associated with the subset of the groups.