Network Traffic Classifier Using Bag Representation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification methods face challenges in distinguishing between business and non-business critical traffic, as well as identifying malicious traffic, due to the use of similar protocols and the scarcity of labeled malicious samples, which affects the accuracy and efficiency of network optimization and security.
Innovation Solution
A device groups feature vectors representing network traffic flows into bags, aggregates them to form a bag representation, and extends the feature vectors with this representation to enrich the training data, allowing for the training of a network traffic classifier that leverages contextual bag information to improve classification performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network traffic classification methods are used, then the classification process is simple, but the precision and recall of classification are insufficient due to protocol similarities and scarce malicious samples
Solution Approach 1:
The patent merges individual traffic flow features with contextual bag-level features to create enriched training samples. By combining multiple flows into bags and then merging bag representations with individual flow features, the method creates a more comprehensive feature set that improves classification precision without requiring completely new classification architectures
Solution Approach 2:
The patent performs preliminary aggregation of traffic flows into bags and computes bag-level representations before the actual classification process. This preliminary action creates enriched contextual information that is then used to enhance individual flow features, allowing the classifier to benefit from aggregated contextual knowledge without increasing its own complexity
2Measurement precision
If more malicious traffic samples are collected for training, then the classification accuracy improves, but the time and resources required for data collection and labeling increase
Solution Approach 1:
The patent merges scarce labeled malicious samples with unlabeled or lightly-labeled flows by creating bag representations. The aggregation process combines information from multiple flows, allowing the model to learn from limited labeled data while leveraging contextual information from broader traffic patterns, thereby improving accuracy without requiring proportional increases in labeled data collection time
Solution Approach 2:
The patent performs preliminary aggregation and representation learning on traffic bags before the classification stage. By pre-computing bag-level features and enriching individual flow representations with this contextual information, the method prepares enhanced training data in advance, reducing the need for extensive real-time data collection and labeling during deployment
3Productivity
If contextual bag information is used to enrich training data, then the classification performance improves, but the data processing complexity increases
Solution Approach 1:
The patent segments traffic flows into bags based on contextual criteria (such as source/destination pairs or time windows), allowing the processing complexity to be distributed and managed in organized units. This segmentation enables systematic computation of bag representations without overwhelming the processing system
Solution Approach 2:
The patent transitions from analyzing individual flow features to incorporating bag-level aggregated features, adding a new dimensional layer of contextual information. This dimensional change enriches the training data by introducing contextual relationships while maintaining a structured approach that manages processing complexity through hierarchical organization
4Loss of information
If traffic flows are grouped into bags and aggregated, then the contextual information is enhanced, but the computational resources required for aggregation increase
Solution Approach 1:
The patent extracts essential contextual information from groups of traffic flows by computing aggregated bag representations. Rather than processing all individual flow details, the method extracts key contextual features at the bag level, retaining important contextual information while reducing the overall computational burden compared to analyzing every individual flow in detail
Data Source
AI summary
In one embodiment, a device groups feature vectors representing network traffic flows into bags. The device forms a bag representation of a particular one of the bags by aggregating the feature vectors in the particular bag. The device extends one or more feature vectors in the particular bag with the bag representation. The extended one or more feature vectors are positive examples of a classification label for the network traffic. The device trains a network traffic classifier using training data that comprises the one or more feature vectors extended with the bag representation.