Network Device Classification via Packet Field Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate for classifying devices accessing computer networks, particularly for User Datagram Protocol (UDP) traffic, as they rely on costly machine learning techniques and are not computationally efficient, and fail to accurately identify device attributes like operating systems in encrypted traffic flows.
Innovation Solution
A system and method that determines fields of interest in network traffic flows, extracts and compares parameter values from packets, and classifies devices based on these values, using a processor and memory to execute instructions for monitoring, packet processing, and device classification, including application recognition and field extraction, to identify device attributes such as operating systems efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning based classification is used for device classification, then classification accuracy is improved, but computational cost and processing time increase significantly
Solution Approach 1:
The patent extracts specific fields of interest from network traffic packets that are indicative of device attributes. Instead of using complex machine learning models to analyze entire packets, the system extracts only the relevant fields (such as TCP window size, IP time to live, payload characteristics) and uses these extracted features for classification. This extraction approach maintains classification accuracy while significantly reducing computational complexity.
Solution Approach 2:
The patent employs simple, lightweight classification rules and lookup tables instead of expensive, complex machine learning models. The system uses predefined field value comparisons and pattern matching against stored device profiles, which are computationally inexpensive operations. This replaces the need for resource-intensive machine learning inference while achieving practical classification accuracy for network device identification.
2Adaptability or versatility
If conventional TCP methodologies are used for device classification, then classification capability is achieved, but the method does not work for UDP traffic and has significant cost
Solution Approach 1:
The patent creates a universal device classification system that works across multiple transport protocols including both TCP and UDP. The system identifies protocol-specific fields of interest for each protocol type (TCP headers, UDP payload characteristics) and applies appropriate classification rules based on the detected protocol. This multi-functional approach enables the same classification infrastructure to handle diverse protocols without requiring separate specialized systems for each protocol type.
Solution Approach 2:
The patent adapts the classification approach by changing the parameters being analyzed based on the protocol type. For TCP traffic, the system examines TCP header fields such as window size and sequence numbers. For UDP traffic, it analyzes different parameters including payload size, idle time, and application-layer characteristics. This parameter adaptation allows the system to effectively classify devices across different protocols by adjusting which fields are extracted and compared.
3Measurement precision
If detailed device attribute analysis is performed on encrypted traffic, then identification accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent extracts only the specific fields of interest from encrypted traffic that are necessary for device classification, rather than attempting to fully decrypt and analyze the entire traffic flow. The system identifies and extracts key parameters such as TLS handshake characteristics, cipher suite selections, and other metadata that remain visible or inferable from encrypted traffic. This selective extraction maintains identification accuracy while preserving processing speed by avoiding full decryption of all traffic.
Solution Approach 2:
The patent applies partial analysis to encrypted traffic by examining only the portions of the traffic that provide sufficient information for device classification without requiring complete decryption. The system performs classification based on partial information from packet headers, metadata, and observable traffic patterns, achieving practical identification accuracy without the computational overhead of full decryption and detailed content analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for classifying a device accessing a computer network. The method including: determining fields of interest that are indicators for classifying the device; reviewing a network traffic flow associated with the device; extracting field/parameter values from a packet associated with the network traffic flow; comparing the extracted field/parameter values with values of the fields of interest to determine at least one device attribute; and classifying the device associated with the network traffic flow based on the comparison. The header fields/parameters may include application name and/or fields/parameters available in a TLS header. The system includes a processor, memory, and software modules and engines that implement the method above.