Network Apparatus Micro-Bursting Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems fail to detect micro-bursting traffic within short timeframes, such as a few milliseconds to dozens of milliseconds, as they require monitoring periods of several seconds to minutes, leading to missed detection of convergent congestion.
Innovation Solution
A network apparatus comprising a marking unit that identifies traffic exceeding a predetermined rate limit, a measuring unit to quantify the marked traffic, and a monitoring unit that outputs traffic amounts over an expected duration time, enabling detection of abnormal traffic without increasing processing load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If monitoring period is extended to several seconds or minutes, then measurement precision of traffic amount is improved, but detection speed of abnormal traffic deteriorates
Solution Approach 1:
The patent divides traffic monitoring into multiple time granularity levels: short-term monitoring (for micro-bursting detection) and long-term monitoring (for overall traffic pattern analysis). The abnormal traffic detection unit specifically monitors short-term traffic amounts at millisecond-level intervals, while the traffic amount information storage maintains historical data at longer intervals. This segmentation allows simultaneous achievement of fast detection and precise measurement without requiring a single monitoring period to satisfy both constraints.
2Reliability
If monitoring frequency is increased to detect micro-bursting, then detection capability of abnormal traffic is improved, but processing load increases
Solution Approach 1:
The patent applies different monitoring strategies to different traffic characteristics. The abnormal traffic detection unit focuses specifically on detecting micro-bursting patterns with high frequency only when needed, while routine traffic monitoring operates at lower frequencies. The marking unit identifies packets exceeding rate limits and marks them for specialized processing, allowing high-frequency monitoring to be applied selectively only to suspicious traffic patterns rather than all traffic, thus reducing overall processing load while maintaining high detection capability.
3Stability of the object's composition
If rate limiting is applied to control traffic, then network stability is improved, but detection accuracy of abnormal traffic deteriorates
Solution Approach 1:
The patent performs marking of packets that exceed rate limits at the point of rate limiting application, before the packets are actually dropped or throttled. This preliminary marking preserves information about which packets were identified as abnormal by the rate limiting mechanism. The abnormal traffic detection unit then monitors these marked packets separately, allowing accurate detection of abnormal traffic patterns even in the presence of rate limiting. The marking creates a traceable record that maintains detection accuracy despite the stabilizing effect of rate limiting.
Data Source
AI summary
A network apparatus includes a memory and one or more processors. The memory stores instructions. The one or more processors are configured to execute the instructions to mark a traffic that exceeds a predetermined rate limit. The one or more processors are also configured to execute the instructions to measure an amount of the marked traffic by using one or more filters to detect information written in a data packet by the one or more processors. The one or more processors are further configured to execute the instructions to output the measured traffic amount in a period determined based on an expected time duration of an abnormal traffic. The abnormal traffic is a detection target of the network apparatus.