Network Traffic Classification via Layer-7 Signature Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network traffic classification techniques, including port-based and signature-based methods, face challenges such as inaccuracy, scalability issues, and resource consumption, especially when dealing with new applications and encryption, and are not effective in differentiating individual protocols like P2P traffic in high-speed networks.
Innovation Solution
A self-learning system that extracts signatures from traffic flows based on layer-3/layer-4 information, correlates them with layer-7 applications, and uses a distributed architecture with high-speed monitors and a logic server to classify traffic, enabling efficient identification and management of network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If port number based traffic classification is used, then implementation is easy and overhead is low, but classification accuracy deteriorates when applications use non-standard or encrypted ports
Solution Approach 1:
The system segments traffic classification into two layers: port-based filtering for quick initial classification and payload-based signature matching for accurate identification. This segmentation allows the system to benefit from both the speed of port-based methods and the accuracy of payload analysis without paying the full overhead of payload inspection for all traffic.
Solution Approach 2:
The patent introduces an intermediary mechanism that uses port numbers as a first-level filter to identify candidate traffic flows, then applies payload signature matching only to these candidates. This intermediary approach resolves the contradiction by using the simple port-based method to reduce the search space before applying the more accurate but resource-intensive payload analysis.
2Measurement precision
If payload-based signature matching is used, then classification accuracy is high and robustness is improved, but scalability deteriorates due to the need to keep up with hundreds of new applications and protocols
Solution Approach 1:
The system performs preliminary action by maintaining a curated database of application signatures and using port-based filtering to pre-identify candidate flows before applying signature matching. This preliminary preparation reduces the computational burden of maintaining and searching through all possible application signatures, improving scalability while preserving accuracy.
Solution Approach 2:
The patent changes the parameter of signature matching from requiring complete payload inspection to using targeted pattern matching on specific payload fields and protocols. This parameter change reduces the computational complexity of signature matching, allowing the system to scale to hundreds of applications while maintaining high classification accuracy.
3Use of energy by moving object
If pattern classification techniques are used, then resource consumption is reduced by monitoring only layer-3/layer-4 data, but classification accuracy and reliability deteriorate due to dependence on network conditions and observation points
Solution Approach 1:
The patent merges pattern classification (layer-3/4 analysis) with payload-based signature matching (layer-7 analysis) into a unified classification system. This combination allows the system to use resource-efficient pattern classification for initial flow identification while supplementing it with more reliable payload-based verification, thereby improving overall classification reliability without proportionally increasing resource consumption.
Solution Approach 2:
The system substitutes pure statistical pattern recognition with a hybrid approach that incorporates deterministic payload signature matching. This substitution replaces the unreliable probabilistic classification with more certain signature-based identification for critical traffic types, improving reliability while maintaining resource efficiency through selective application of the more expensive method.
4Reliability
If statistical techniques requiring multiple flows and packets are used, then classification robustness is improved, but detection time increases compared to traditional signature matching
Solution Approach 1:
The system applies partial action by using signature matching on a subset of payload data rather than analyzing complete flows. By matching signatures against specific protocol fields and initial packets, the system achieves sufficient classification robustness without requiring the excessive action of collecting and analyzing multiple complete flows, thereby reducing detection time while maintaining reliability.
Data Source
AI summary
The present invention relates to a method of managing a network. The method steps includes extracting a signature from a first traffic flow of a plurality of traffic flows on the network based on layer-3/layer-4 information of the first traffic flow, storing the signature and an identification of a layer-7 application associated with the signature in a signature repository, identifying a second traffic flow of the plurality of traffic flows being associated with the layer-7 application by correlating the second traffic flow to the signature, and managing the network based on layer-7 application identification of the plurality of traffic flows.