Network Traffic Analysis via PSD and Histograms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malicious traffic flows in communication networks, especially in encrypted and constantly changing environments, is challenging due to varying packet types and durations, which can be difficult to distinguish using standard techniques, and requires real-time analysis with limited data processing time.
Innovation Solution
The system combines power spectral density (PSD) estimation with histogram data to enhance the energy and visibility of packet types with low frequency or short durations, generating distinct signatures and reducing the amount of data needed for analysis, while monitoring traffic in real-time without dependency on communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standard traffic analysis techniques are used, then the system can process traffic data, but it cannot effectively distinguish packet types with low frequency or short durations from noise
Solution Approach 1:
The patent combines power spectral density (PSD) estimation with histogram data to create a hybrid analysis approach. The PSD component captures periodic patterns in packet arrivals, while the histogram component records packet distribution across different time bins. By merging these two complementary representations, the system achieves superior detection accuracy for low-frequency and short-duration packet types compared to using either method alone.
Solution Approach 2:
The patent transforms the one-dimensional packet arrival time sequence into a two-dimensional analysis space by generating both PSD estimates (frequency domain) and histograms (time domain distribution). This dimensional transformation allows the system to detect patterns that are not apparent in the original time series, particularly for intermittent and low-frequency malicious traffic that resembles background noise.
2Productivity
If real-time analysis is performed with limited data processing time, then the system responds quickly, but it cannot analyze sufficient data to achieve high detection accuracy
Solution Approach 1:
The patent implements a progressive analysis approach where the PSD and histogram computations are performed incrementally as packet data arrives. The system can produce detection results with partial data sets, allowing real-time responsiveness while continuing to accumulate data for improved accuracy. This partial action enables the system to provide immediate alerts for obvious threats while refining detection confidence as more data becomes available.
3Reliability
If the system monitors all communication traffic, then it can detect intrusions, but it requires extensive data processing resources and time
Solution Approach 1:
The patent segments the traffic analysis process into distinct computational components: packet arrival time extraction, histogram binning operations, and PSD estimation calculations. Each segment processes specific aspects of the traffic data independently, allowing for optimized resource allocation and parallel processing. This segmentation reduces overall system complexity while maintaining comprehensive monitoring capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for detecting malicious traffic flows in a network is provided. The system includes a processor. Based on packet information received for a plurality of data packets transmitted over the network the processor is programmed to calculate inter-arrival times and packet durations for the plurality of data packets. The processor is also programmed to filter the packet information to remove noise. The processor is further programmed to generate at least one histogram based on the packet information, the inter-arrival times, and the packet durations. In addition, the processor is programmed to generate a power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations. Moreover, the processor is programmed to analyze the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows. Furthermore, the processor is programmed to report the one or more unexpected data flows.