Machine-Learned Network Traffic Classification Using Web Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification techniques, such as shallow packet inspection and deep packet inspection, are inadequate for accurately analyzing encrypted traffic and require significant computational resources, limiting their effectiveness in modern communications networks.
Innovation Solution
A machine-learning-based method that generates dynamic intent scores by scraping webpages associated with URL data objects, creating web embeddings, and comparing them with reference embeddings to classify network traffic without accessing payload data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to analyze network traffic, then classification accuracy is improved, but computational resources required increase significantly
Solution Approach 1:
The patent extracts only the necessary metadata from network packets (such as destination port, protocol type, and packet length) rather than inspecting the entire packet payload. This selective extraction approach maintains sufficient classification accuracy while dramatically reducing computational resource requirements compared to full deep packet inspection.
Solution Approach 2:
The patent introduces a machine learning model as an intermediary that processes extracted packet metadata to generate intent scores. This intermediary layer enables accurate classification without requiring direct analysis of encrypted payloads, thus maintaining precision while reducing computational overhead.
2Measurement precision
If deep packet inspection is used to access application data, then classification accuracy is improved, but ability to handle encrypted traffic deteriorates
Solution Approach 1:
The patent extracts classification information from packet headers and metadata rather than requiring access to the application payload. This allows the system to classify encrypted traffic by analyzing external characteristics (port numbers, packet structure) without needing to decrypt or inspect the encrypted content, thus maintaining accuracy while improving adaptability to encrypted traffic.
Solution Approach 2:
The machine learning model serves as an intermediary that infers traffic intent from packet metadata without requiring direct access to encrypted payloads. This intermediary approach enables accurate classification of encrypted traffic by learning patterns from packet characteristics rather than content analysis.
3Use of energy by moving object
If shallow packet inspection is used for network traffic analysis, then computational resources required are reduced, but classification accuracy deteriorates
Solution Approach 1:
The patent dynamically adjusts the level of inspection based on packet characteristics and traffic patterns. Rather than using a fixed shallow or deep inspection approach, the system adapts its analysis depth based on the packet's metadata features and the learning model's requirements, optimizing the balance between computational resources and classification accuracy for each specific traffic flow.
Solution Approach 2:
The patent replaces traditional mechanical packet inspection methods with a machine learning-based classification system. The ML model processes extracted metadata features to generate intent scores, substituting complex manual inspection logic with an automated learning system that achieves higher accuracy with lower computational overhead.
4Ease of manufacture
If packet header information is used for classification, then ease of implementation is improved, but information completeness deteriorates
Solution Approach 1:
The patent creates a universal classification system that handles multiple traffic types and encryption methods using a single machine learning model. The model processes various packet metadata features (port numbers, protocols, packet lengths) and generates unified intent scores, providing complete information about traffic purpose regardless of the underlying application or encryption method, thus maintaining information completeness while preserving ease of implementation.
Data Source
AI summary
A method for classifying network traffic includes accessing processed network data that includes multiple groups. Each group includes multiple URL data objects and is associated with an entity. The method includes generating a dynamic intent score for each group by generating a comparison value for each URL data object within a group, selecting highest comparison values for the URL data objects within the group, generating the dynamic intent score by averaging the selected highest comparison values, and ranking the groups according to their respective dynamic intent scores. The comparison value for each URL data object is generated by scraping a webpage associated with a URL data object to generate a first scraped text data object, creating web embeddings by providing the scraped text data object to a machine learning module, and generating a comparison value by comparing the web embeddings with reference embeddings.