Network Stream Classification via Lexical Header Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for classifying network traffic require prior knowledge of the application generating the stream and often need a software agent on endpoint devices, failing to provide fine-grained control and accurate classification without prior knowledge or endpoint presence.
Innovation Solution
The system automatically classifies network streams by extracting keywords from their headers using a lexicon dictionary, allowing classification without endpoint presence and prior knowledge, enabling granular control through a modular approach that builds, identifies, and classifies network streams based on lexical analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods are used to classify network streams, then classification accuracy may be improved through prior knowledge of the application, but device complexity increases due to requiring software agents on endpoint devices
Solution Approach 1:
The patent extracts the classification function from endpoint devices and relocates it to network infrastructure components. By analyzing network streams at network vantage points using lexical analysis of headers and payloads, the system eliminates the need for software agents on endpoint devices while maintaining classification accuracy through content-based analysis
Solution Approach 2:
The patent introduces network vantage points as intermediary components between applications and network infrastructure. These vantage points perform lexical analysis on network streams using built-in lexicon dictionaries, serving as mediators that enable classification without requiring endpoint software agents
2Ease of operation
If traditional classification methods are used, then fine-grained control may be achieved through application knowledge, but ease of operation deteriorates due to requiring prior knowledge
Solution Approach 1:
The patent enables network streams to self-identify their classification through lexical analysis of their own headers and payloads. The system automatically builds and updates lexicon dictionaries from observed network traffic patterns, allowing classification without requiring administrators to have prior knowledge of applications
Solution Approach 2:
The patent performs preliminary lexical analysis by building lexicon dictionaries from captured network streams before classification is needed. This preliminary action extracts and stores characteristic lexical features of different application types, enabling rapid automated classification without requiring prior application knowledge
3Ease of operation
If automated classification is implemented without endpoint presence, then ease of operation improves, but measurement precision may worsen without application knowledge
Solution Approach 1:
The patent performs partial classification by analyzing only the header and payload portions of network streams that contain lexical identifiers, rather than requiring complete application knowledge. This partial action approach achieves sufficient classification accuracy for network traffic management while maintaining ease of operation
Solution Approach 2:
The patent replaces the mechanical approach of installing software agents on endpoint devices with an information-based approach using lexical analysis. By substituting direct application interaction with text-based header and payload analysis, the system achieves automated classification without endpoint presence
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed computer-implemented method for automated classification of application network activity may include (1) building a lexicon dictionary that comprises lexical keywords, wherein network streams whose headers contain a given lexical keyword represent communications of an activity type that is associated with the given lexical keyword in the lexicon dictionary, (2) identifying, at a network vantage point, a network stream that represents a communication between an application and a server, (3) extracting, through a lexical analysis that utilizes the lexicon dictionary, a set of keywords from one or more header fields of the network stream, and (4) classifying the network stream based on activity types associated with each keyword in the set of keywords that were extracted from the header fields of the network stream. Various other methods, systems, and computer-readable media are also disclosed.