Network Data Flow Classification Using Static and Dynamic Behavior Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for classifying data flows in networks are inaccurate, particularly due to limitations in port number correlation, packet encryption scenarios, and incomplete feature representation, which hinders the provision of differentiated quality of service for various application types.
Innovation Solution
A network data flow classification method that collects dimension information, establishes static and dynamic behavior models, and calculates model distances to accurately determine the application type of a data flow, using marginal and conditional probability distributions to reflect essential differences between data flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If port number correlation is used for application type classification, then classification can be performed based on simple port number matching, but it cannot accurately classify data flows of applications not defined by IANA or using random port numbers
Solution Approach 1:
The patent segments the classification process into multiple stages: first using port number as a quick filter, then applying behavior model matching to segments of data flow characteristics (packet length distribution, inter-arrival time, etc.). This hierarchical segmentation allows simple port-based filtering while falling back to more complex behavior analysis when port numbers are insufficient, thereby resolving the contradiction between operational simplicity and classification accuracy.
2Reliability
If in-depth packet parsing is performed to identify abnormal data flows, then encryption scenarios can be handled, but the complexity of the classification system increases significantly
Solution Approach 1:
The patent extracts key behavioral features from data flows without performing full packet parsing. Instead of analyzing complete packet contents, it extracts essential characteristics such as packet length distribution, inter-arrival time patterns, and flow duration statistics. This extraction approach maintains the ability to identify abnormal flows while avoiding the complexity of deep packet inspection, particularly important for encrypted traffic where content analysis is not feasible.
3Ease of manufacture
If simple statistical features are used for machine learning classification, then feature engineering is simple, but these features cannot completely represent data flow behavior leading to inaccurate classification
Solution Approach 1:
The patent transforms simple statistical features into more expressive parameters by analyzing their distributions and relationships. Instead of using raw statistics like mean and variance alone, it examines packet length distributions, inter-arrival time patterns, and temporal correlations. This parameter transformation maintains relative simplicity while significantly improving the ability to represent diverse data flow behaviors, resolving the contradiction between feature engineering ease and classification accuracy.
4Measurement precision
If comprehensive behavior modeling is performed to accurately represent data flow characteristics, then classification accuracy improves, but the computational complexity and processing time increase
Solution Approach 1:
The patent performs preliminary action by pre-computing and storing behavior models for known application types during an offline training phase. These pre-established models capture typical behavioral patterns of different application types. During online classification, the system only needs to compare incoming data flow characteristics against these pre-computed models, significantly reducing real-time processing requirements while maintaining high classification accuracy.
Data Source
AI summary
A network data flow classification method related to artificial intelligence includes collecting an information set, including a plurality of pieces of dimension information, of a to-be-processed data flow, establishing a static behavior model and a dynamic behavior model of each piece of dimension information in the information set, where the static behavior model represents a value selection rule of the dimension information, and the dynamic behavior model represents a correlation relationship of the dimension information between two adjacent time moments, obtaining, using the static behavior model and the dynamic behavior model respectively, a static model distance and a dynamic model distance between the to-be-processed data flow and a data flow of each target application type, determining an application type of the to-be-processed data flow based on the static model distance and the dynamic model distance.