Network Flow State Detection via Filter and Rule Engines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring network traffic in complex and dynamic environments is challenging due to the increasing volume of data and variety of packet types and formats, making it difficult for existing network monitoring tools to effectively assess and troubleshoot communications.
Innovation Solution
A system that employs a filter engine to apply filters to network traffic based on characteristics, followed by a rule engine to apply rules to the filtered traffic, allowing for selective monitoring and analysis of network flows, including turn detection and anomaly identification using filters and rule engines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all network packets are monitored and analyzed in detail, then network traffic analysis completeness is improved, but computational cost and processing time increase significantly
Solution Approach 1:
The patent segments network traffic analysis into multiple processing stages: initial filtering based on packet characteristics, intermediate rule-based analysis, and detailed inspection only for selected packets. This multi-level segmentation allows the system to process high volumes of traffic efficiently while maintaining analysis completeness for relevant packets.
Solution Approach 2:
The system applies different analysis depths to different packets based on their characteristics and importance. High-priority packets receive comprehensive analysis while routine packets receive minimal processing. This local quality approach optimizes computational resources by concentrating detailed analysis where it is most needed.
2Measurement precision
If comprehensive packet inspection is performed on all network traffic, then network security monitoring accuracy is improved, but processing speed decreases
Solution Approach 1:
The system performs preliminary filtering and classification of packets before detailed security inspection. Packets are pre-processed to identify suspicious characteristics, and only packets matching security criteria undergo comprehensive inspection. This preliminary action maintains security accuracy while improving overall processing speed.
Solution Approach 2:
The system applies partial inspection to most packets and excessive (comprehensive) inspection only to selected packets that require detailed analysis. This selective approach ensures security monitoring accuracy for critical packets while maintaining high processing speed for the overall traffic stream.
3Measurement precision
If detailed analysis of all packet types and formats is performed, then network protocol detection accuracy is improved, but device complexity increases
Solution Approach 1:
The system extracts and analyzes only the essential characteristics and headers needed for protocol identification rather than examining all packet contents. This extraction approach maintains protocol detection accuracy while reducing the complexity of the monitoring system by focusing on key identifying features.
Solution Approach 2:
The system employs a universal filtering and analysis framework that can handle multiple packet types and formats through a single integrated engine. This multi-functional approach improves protocol detection accuracy across diverse traffic while avoiding the need for separate specialized analyzers for each protocol type.
Data Source
AI summary
Embodiments are directed to monitoring a network flow. A characteristic of the monitored network flow may be compared to a criterion. A filter may provide the criterion. Filtered network traffic may be provided based on the filter and the comparison. A rule may be provided based on the filtered network traffic, such that each rule is associated with one or more rule prologues and one or more rule actions. The one or more rule prologues may be executed on the filtered network traffic to provide one or more satisfied rule prologues. One or more of the one or more rule actions may be executed based on the one or more satisfied rule prologues, such that the one or more executed rule actions and the one or more satisfied rule prologues are each associated with a same rule.