Multi-Stage Network Scanning for Application Flow Prediction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network security systems struggle to identify application layer protocols before data begins to flow, leading to delayed policy enforcement and increased vulnerability to cyberattacks.

Innovation Solution

Implement a multi-stage pattern matching process in the network control plane to identify application layer protocols by scanning for predictor protocols like SIP, building pattern matching databases, and creating mappings between predictor protocol identifiers and predicted application traffic flows.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If deep packet inspection is used to identify applications, then application identification accuracy is improved, but processing time increases and policy enforcement is delayed

Engineering Contradiction:

Improveapplication identification accuracyVSAvoidpolicy enforcement timing

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary scanning of network traffic flows to identify predictor protocols (such as SIP, H.323, FTP) before the actual application data begins to flow. By detecting these signaling protocols in advance, the system can pre-identify the application type and prepare policy enforcement rules beforehand, eliminating the need to wait for application data to accumulate for deep packet inspection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention introduces predictor protocols as intermediary indicators that mediate between raw network traffic and application identification. These predictor protocols (SIP, H.323, FTP signaling) serve as early indicators that reveal the identity of subsequent application data flows, allowing the system to identify applications through their signaling phase rather than waiting to analyze the actual application data.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If multi-stage scanning is implemented to identify predictor protocols, then application flow prediction accuracy is improved, but system complexity increases

Engineering Contradiction:

Improveapplication flow prediction accuracyVSAvoidscanning system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The scanning system is divided into multiple stages, each with a specific function: Stage 1 scans for predictor protocol signatures, Stage 2 extracts flow identification information from matched predictor protocols, and Stage 3 creates mappings between predictor protocols and predicted application flows. This segmentation allows each stage to be optimized independently and simplifies the overall system architecture by breaking down the complex task of application identification into manageable sub-tasks.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system adds a temporal dimension to application identification by scanning during the signaling phase (before application data flow) rather than only during the data transfer phase. This dimensional shift from analyzing application data to analyzing predictor protocol signaling enables early identification without requiring complex analysis of application payload data.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Use of energy by moving object

If application identification is delayed until data flow begins, then system resource consumption is reduced, but network security vulnerability increases

Engineering Contradiction:

Improvesystem resource consumptionVSAvoidcyberattack vulnerability

Core Design Contradiction:

Use of energy by moving objectVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary identification of application flows during the signaling phase using lightweight predictor protocol detection, rather than waiting for application data to flow and then performing resource-intensive deep packet inspection. This preliminary action enables early policy enforcement and security rule application before malicious traffic can establish connections or transmit harmful data.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

By identifying predictor protocols in advance, the system can pre-configure security policies and enforcement rules before the actual application data flow begins. This preliminary anti-action allows security measures to be in place and active before potential cyberattacks can exploit unidentified application flows, enabling proactive rather than reactive security enforcement.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS12413512B2Application traffic flow prediction based on multi-stage network traffic flow scanning

Publication Date: 2025.09.09 PALO ALTO NETWORKS INC

AI summary

In a network control plane, a pattern matching database is built and maintained for identifying an application or application level protocol. In addition, pattern matching databases for predicting a subsequent flow for application layer/level protocols or data protocols are built and maintained. After flow differentiation in network traffic mirrored from a data plane, the network traffic flow is scanned in a first stage and then in a second stage if a signaling protocol message is detected in the first stage scan. For the second stage, one of the application/data protocol pattern databases is selected for scanning based on the signaling protocol message detected in the first stage scanning. If a match is found from the stage 2 scanning, a mapping between the signaling protocol identifier and an identifier for a predicted application traffic flow is created and communicated to the data plane for policy selection and enforcement.