Network Flow Tagged Element Decomposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network traffic analysis methods, such as packet-based and flow-based analysis, lack efficiency and flexibility in decomposing network flows into usable elements for comprehensive analysis, particularly in deriving additional information beyond standard flow protocols like IPFIX and Netflow.
Innovation Solution
A system and method that decomposes network flows into tagged elements, which can include combinations of standard elements, external information, or calculated values, allowing for the creation of simple and compound tagged elements that can be used to build more complex analyses without requiring prior knowledge of the flow data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If network flows are analyzed using standard protocols like IPFIX or Netflow, then flow information can be exported, but the system lacks flexibility to derive additional information beyond standard flow elements
Solution Approach 1:
The patent segments network flows into discrete tagged elements that can be individually processed and combined. Each tagged element represents a specific aspect of flow data (e.g., source IP, destination port, protocol) that can be independently tagged, stored, and recombined to create custom analyses without being constrained by standard protocol definitions.
Solution Approach 2:
The tagged element structure serves multiple functions: it can represent standard IPFIX/Netflow elements, incorporate external information sources, perform calculations on flow data, and be combined in various ways to create different analysis views. This universal structure replaces the need for protocol-specific processing logic.
2Loss of information
If packet-based analysis is performed to extract flow information, then detailed network behavior data can be obtained, but the process is computationally intensive and inefficient
Solution Approach 1:
The system performs preliminary tagging of flow elements as flows are captured and exported, organizing data into a standardized tagged element structure before detailed analysis is required. This pre-processing step enables efficient retrieval and combination of specific flow attributes without requiring re-analysis of raw packet captures or complete flow records when analyses are generated.
Solution Approach 2:
The patent extracts only the specific tagged elements needed for each analysis from the complete flow data set, rather than processing all flow information uniformly. This selective extraction approach reduces computational overhead by focusing resources only on the relevant flow attributes for each analytical task.
3Adaptability or versatility
If standard flow export protocols are used, then flow data can be collected and exported, but the system cannot easily combine flow elements with external information or perform calculations on flow data
Solution Approach 1:
The tagged element structure serves as an intermediary layer between standard flow export protocols and custom analysis requirements. External information sources and calculated values are integrated through the same tagged element interface as standard flow elements, allowing seamless combination of different data sources without requiring separate processing paths or complex integration logic.
Solution Approach 2:
The system allows dynamic addition and modification of tagged element types and attributes based on analysis requirements. New tagged elements can be created to represent external information sources or calculated metrics, and the tagging schema can be extended without breaking compatibility with existing flow data or analysis processes.
Data Source
AI summary
A system and method for preparing network flows for analysis by decomposing such flows into a plurality of elements which are then tagged. Tagged elements may optionally comprise any type of element according to any type of network flow standard, including but not limited to the IPFIX or Netflow standards, or may optionally be derived from such elements.