Network Application Identification via Token Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to accurately identify network applications responsible for generating network traffic on a per-packet basis, which is crucial for traffic classification and security analysis.
Innovation Solution
A system and method that analyze source code tokens from network applications to generate index documents, extract packet header tokens, and compare them to determine the similarity match scores, thereby identifying the network application generating the traffic flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional traffic classification methods are used, then the process is simple, but the identification accuracy of network applications is insufficient
Solution Approach 1:
The system performs preliminary actions by analyzing application source code in advance to extract characteristic tokens and generate index documents before actual traffic analysis. This pre-processing creates a reference database that enables accurate real-time identification without complex analysis during traffic monitoring
Solution Approach 2:
The patent introduces an intermediary mechanism - a search engine-based comparison system that acts as a mediator between packet headers and application source code. The system uses token extraction and similarity scoring as intermediary steps to bridge the gap between raw traffic data and application identification, improving accuracy while maintaining manageable complexity
2Measurement precision
If per-packet application identification is implemented, then traffic classification capability is improved, but processing time increases
Solution Approach 1:
The system segments the identification process into distinct phases: token extraction from source code, index document generation, packet header tokenization, and similarity comparison. This segmentation allows each step to be optimized independently and enables efficient processing by working with small token sets rather than entire source code bases
Solution Approach 2:
The patent extracts only the essential characteristic tokens from application source code and packet headers, removing unnecessary complexity. By taking out only the relevant tokens needed for identification rather than analyzing complete source code or full packet contents, the system achieves accurate per-packet identification with reduced processing time
Data Source
AI summary
A method for identifying a network application. The method includes analyzing metadata and source code of a network application to extract a set of application tokens, generating an index document of the network application based on the set of application code tokens, wherein the index document is included in a library of index documents corresponding to a number of network applications, extracting a set of packet header tokens from a packet header of a packet in a flow, comparing the set of packet header tokens to the set of index documents to generate a number of match scores, wherein each match score represents a similarity measure between the set of packet header tokens and one index document, and determining, based on a highest match score corresponding to a particular network application, that the flow is generated by the particular network application.