ML Classifier for SDN Traffic Flow Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic management systems face challenges in detecting and handling 'elephant' and 'mice' flows due to their diverse characteristics and requirements, leading to network congestion and performance degradation, especially in data centers and software-defined networks, where conventional methods fail to accurately identify application layer protocols without explicit signaling and are ineffective with encrypted packets or privacy concerns.
Innovation Solution
A computer-implemented method using a Machine Learning (ML) classifier within software-defined-networking (SDN) tools to predict and regulate network traffic flows by generating training data from aggregate flow statistics, allowing for dynamic adaptation and accurate prediction of 'elephant' and 'mice' flows without modifying the network infrastructure, and employing separate scheduling and routing strategies for each flow type.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If conventional IP traffic classification methods using flow ports are used, then the method is simple to implement, but it fails when applications hide ports, use arbitrary ports, or pass through firewalls
Solution Approach 1:
The patent introduces an intermediary approach by using aggregate flow statistics (duration, bytes, packets, inter packet gap) as a mediator between the network infrastructure and application identification. Instead of directly examining hidden or encrypted ports, the system uses these statistical characteristics as intermediate indicators to infer application type, resolving the contradiction between simple implementation and reliable detection.
Solution Approach 2:
The patent replaces the mechanical/port-based classification system with a statistical/ml-based system. Instead of relying on fixed port number matching (mechanical approach), the system uses machine learning models that process aggregate flow statistics to classify applications, enabling reliable detection without modifying network infrastructure or requiring explicit signaling.
2Reliability
If payload inspection methods are used to identify application protocols, then detection accuracy improves, but the system cannot handle encrypted packets and raises privacy concerns
Solution Approach 1:
The patent extracts the classification task from the packet payload (which would require decryption and violate privacy) and performs it at the flow statistics level. By taking out the analysis from the encrypted payload and performing it on aggregate statistics collected from flow metadata, the system achieves detection accuracy without compromising privacy or requiring packet decryption.
Solution Approach 2:
The patent uses aggregate flow statistics as an intermediary that bridges the gap between network visibility and application identification. These statistics serve as a mediator that provides sufficient information for classification without requiring direct inspection of encrypted payloads, thus maintaining both accuracy and privacy compliance.
3Reliability
If detailed packet inspection is performed to classify flows, then application identification improves, but network performance degrades due to processing overhead
Solution Approach 1:
The patent applies partial action by analyzing only the necessary aggregate flow statistics (duration, bytes, packets, inter packet gap) rather than performing complete packet inspection. This selective analysis provides sufficient information for accurate classification while minimizing processing overhead and maintaining high network throughput.
Solution Approach 2:
The patent performs preliminary classification at the flow level using aggregate statistics before any packet-level processing would occur. By making classification decisions based on pre-computed flow characteristics, the system avoids the performance penalty of detailed packet inspection while maintaining accurate application identification.
4Reliability
If the network infrastructure is modified to support better flow detection, then detection capability improves, but system complexity increases
Solution Approach 1:
The patent enables the network infrastructure to serve itself by utilizing existing flow statistics that are already collected for routing and management purposes. The system leverages self-generated data (aggregate flow stats from standard network monitoring) to perform classification without requiring external modifications or additional infrastructure components.
Solution Approach 2:
The patent makes the existing flow collection system multi-functional by using the same aggregate statistics infrastructure for both standard network management tasks and application classification. This universal approach allows one system to serve multiple purposes without adding complexity or requiring separate dedicated infrastructure.
Data Source
AI summary
A system and method for management of network traffic flow for one or more networks of interconnected computing devices, including predicting one or more types of network traffic data flows using a Machine Learning (ML) classifier, and updating the ML classifier according to identified changes in the network traffic data flows. Using software-defined-networking (SDN) tools and an updated ML classifier, training data is generated to formulate accurate new predictions of the one or more types of network traffic data flows. Network traffic flow is regulated based on the generated new predictions.