Network Traffic Metadata Mapping for Fast System Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring technologies struggle to efficiently identify and classify network systems, particularly in environments with a high number of network-connected devices, leading to difficulties in applying appropriate security measures and maintaining network security.
Innovation Solution
A system mapping component that parses network traffic metadata to generate network system maps without deep packet inspection, identifying network systems and their device connections, thereby reducing resource consumption and enabling quicker classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is performed to identify and classify network systems, then measurement precision and reliability improve, but use of energy and processing time increase significantly
Solution Approach 1:
The patent extracts only the necessary metadata fields from network packets (source/destination IPs, ports, protocols) without performing deep packet inspection of the entire packet content. This selective extraction approach maintains identification accuracy while significantly reducing processing overhead and energy consumption.
Solution Approach 2:
The system performs partial inspection by focusing only on critical packet headers and metadata rather than analyzing the complete packet payload. This partial action approach provides sufficient information for network system identification while avoiding the excessive resource consumption of full packet inspection.
2Object-generated harmful factors
If comprehensive network traffic analysis is performed to identify all devices and connections, then object-generated harmful factors are reduced through better security measures, but productivity and processing speed decrease
Solution Approach 1:
The patent segments the network traffic analysis process into distinct components: metadata extraction, device identification, connection mapping, and system classification. This segmentation enables parallel processing of different traffic streams and reduces bottlenecks, maintaining high identification speed while comprehensively analyzing network traffic for security purposes.
Solution Approach 2:
The system performs preliminary classification of network traffic based on metadata before conducting more detailed analysis. By pre-categorizing traffic flows and identifying obvious patterns early, the system can quickly process high-volume traffic while applying more intensive analysis only where needed, thus maintaining productivity while reducing security risks.
3Reliability
If detailed network mapping is generated to show all device couplings and connections, then reliability of security measures improves, but device complexity and processing requirements increase
Solution Approach 1:
The patent applies local quality by generating network maps with different levels of detail for different purposes. Critical security-relevant connections are mapped with high detail showing all couplings and protocols, while less critical paths are represented with simplified topology. This approach maintains security reliability for important areas while reducing overall processing complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and related technologies for generating a network system map based on network traffic and possibly additional data are described. Network traffic may be received and parsed to obtain metadata associated with the network traffic. A network system may be identified based on the metadata. A network system map may be generated for the network system based on one or more of the metadata or the additional data.