Network Device Application Signature Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face delays in identifying and generating application signatures for unknown applications, leading to inefficiencies in classifying and managing network traffic, as new applications and versions emerge faster than signature providers can keep up, and local traffic patterns may not be immediately recognized.
Innovation Solution
Implementing a system where network devices automatically generate and distribute application signatures based on contextual information from network traffic, using a context database and threshold-based mechanisms to identify and normalize signatures, allowing for local generation and distribution of signatures for popular applications before central providers can update them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If central signature providers generate and distribute application signatures, then signature accuracy and reliability are improved, but response time and productivity deteriorate due to delays in identifying and distributing signatures for new applications
Solution Approach 1:
The system performs preliminary action by having network devices collect and analyze contextual information from network traffic in advance, maintaining a ready pool of application identification data. When a new application is detected, the signature can be quickly generated and distributed without waiting for central providers to first discover and analyze the application, thus reducing response time while maintaining reliability through pre-collected accurate data
Solution Approach 2:
The patent introduces an intermediary mechanism where network devices act as intermediate nodes between central signature providers and the network traffic. These intermediaries locally generate and cache application signatures based on observed traffic patterns, enabling faster local response while still coordinating with central providers for signature validation and updates, thus balancing response time and reliability
2Measurement precision
If deep packet inspection is used to identify applications, then application identification accuracy is improved, but computing resource consumption and device complexity increase
Solution Approach 1:
The system extracts only the essential contextual information needed for application identification from network traffic, such as protocol type, port numbers, and specific packet patterns, rather than performing complete deep packet inspection of all traffic. This extraction approach maintains sufficient identification accuracy while significantly reducing computing resource consumption by focusing only on relevant features
Solution Approach 2:
The patent applies partial action by implementing selective deep packet inspection only for traffic that cannot be classified using lighter-weight methods. The system first attempts identification using low-cost heuristics, and only performs resource-intensive DPI when necessary, thus optimizing the balance between identification accuracy and computing resource usage
3Stability of the object's composition
If application signatures are generated and distributed centrally, then signature consistency across the network is improved, but productivity and response time worsen due to inability to quickly adapt to local traffic patterns
Solution Approach 1:
The patent segments the centralized signature management into distributed components, allowing each network device to independently generate and maintain local signature caches based on its observed traffic patterns. This segmentation enables parallel signature generation across multiple devices, improving overall productivity and response time while maintaining consistency through periodic synchronization with central providers
Solution Approach 2:
The system implements dynamic signature management where signature generation and distribution adapt to changing network conditions and traffic patterns. Network devices dynamically adjust their signature caching strategies based on local traffic characteristics, enabling faster adaptation to new applications while maintaining coordination with central providers for overall consistency
Data Source
AI summary
A network device may receive network traffic for an application. The network device may identify an application layer protocol being used for the network traffic. The network device may obtain contextual information, from the network traffic, to obtain an item of contextual information, and the item of contextual information may be selected based on the application layer protocol. The network device may determine that the item of contextual information matches a stored item of contextual information. The network device may determine that a threshold has been met with regard to the stored item of contextual information. The network device may generate an application signature for the application based on the item of contextual information. The network device may send the application signature to another device to permit the other device to identify the application based on the application signature.