Network Traffic Classification Using Dynamic Intent Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic classification techniques, such as shallow packet inspection and deep packet inspection, are inadequate for accurately analyzing encrypted traffic and require significant computational resources, limiting their effectiveness in modern communications networks.
Innovation Solution
A machine-learning-based approach that generates dynamic intent scores by comparing web embeddings with reference embeddings, using neural networks to analyze URL data objects and extract keywords, allowing for intent-based classification without decrypting network packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to analyze encrypted traffic, then measurement precision is improved, but use of energy increases and productivity decreases
Solution Approach 1:
The patent extracts and analyzes only the header portion of network packets rather than inspecting the entire packet payload. This extraction approach allows the system to obtain sufficient classification information from headers alone, avoiding the computationally intensive process of deep packet inspection while maintaining effective traffic classification capability.
Solution Approach 2:
The patent segments the packet inspection process by focusing exclusively on header fields (such as source IP, destination IP, port numbers, and protocol type) rather than processing the complete packet. This segmentation reduces the data volume requiring analysis and consequently lowers computational resource consumption while preserving essential classification information.
2Use of energy by moving object
If shallow packet inspection is used for traffic classification, then use of energy is reduced, but measurement precision deteriorates
Solution Approach 1:
The patent changes the parameters being inspected by focusing on specific header fields and their combinations rather than traditional port-based classification alone. By analyzing multiple header parameters (source IP, destination IP, port numbers, protocol type) and their relationships, the system achieves improved classification precision while maintaining low computational overhead characteristic of shallow inspection methods.
3Measurement precision
If deep packet inspection is used to access application data, then measurement precision is improved, but productivity decreases
Solution Approach 1:
The patent extracts intent information directly from packet headers without requiring access to the application data payload. This extraction methodology obtains necessary classification information from the readily available header fields, eliminating the time-consuming process of parsing and analyzing encrypted payload content while maintaining accurate intent determination.
Solution Approach 2:
The patent performs classification based on pre-analyzed header information that is already available in the packet structure, rather than requiring preliminary decryption and payload analysis. This preliminary availability of header data enables rapid classification decisions without the productivity loss associated with deep inspection of encrypted content.
Data Source
AI summary
A method includes receiving target input data that includes keyword input data and accessing processed network data that includes a plurality of groups. Each of the groups includes a plurality of URL data objects and is associated with an entity. The method includes generating a dynamic intent score for each group by, for each of the URL data objects, extracting keywords from a webpage associated with the URL data object that are similar to keywords of the target input data, comparing the extracted keywords with the target input data, generating a keyword comparison value for the URL data object, and generating the dynamic intent score based on the keyword comparison values. The method includes ranking the groups according to their respective dynamic intent scores, selecting a subset of the groups according to the ranking, and generating a target account list including the entities associated with the subset of the groups.