Network Traffic User Identifier Detection Using Byte Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying user identifiers in network traffic are processing-intensive and inefficient, especially at high internet speeds, as they require decoding multiple application protocols and checking every byte position, leading to performance limitations and high costs in hardware implementation.
Innovation Solution
A method and apparatus that classify each byte of network traffic as valid, invalid, or delimiter, generating an information stream and storing valid characters between delimiters to examine for user identifiers, using a translator, state machine, shift register, memory, and comparator to efficiently match user identifiers without decoding each protocol.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If software-based collection monitoring is used to identify user identifiers in network traffic, then user identification can be performed across multiple application protocols, but processing performance becomes insufficient at high internet speeds (2.5 gigabits per second and above)
Solution Approach 1:
The patent replaces software-based protocol decoding with a hardware-based system consisting of a network interface card, application layer processing unit, and string search engine. This hardware substitution enables the system to process network traffic at line speed (2.5 gigabits per second and above) while maintaining the ability to identify user identifiers across multiple application protocols through the string search engine's protocol-agnostic pattern matching capability.
2Productivity
If hardware-based protocol decoders (ASIC or FPGA) are implemented to improve processing speed, then processing performance increases, but device complexity and implementation cost increase due to the need to handle all application protocols
Solution Approach 1:
The patent extracts the protocol-specific decoding complexity from the hardware implementation and relocates it to the software application layer. The hardware component (network interface card and string search engine) is simplified to perform only high-speed packet capture and pattern matching, while the application layer software handles protocol-specific interpretation. This extraction reduces hardware complexity and implementation costs while maintaining high processing speeds and multi-protocol support.
3Productivity
If tag scanning techniques are used with high-speed hardware filters, then processing speed improves by avoiding full protocol stack decoding, but software component complexity increases due to high tag match rates and unique extraction rules for each protocol
Solution Approach 1:
The patent implements a universal string search engine that can identify user identifiers across all application protocols using a single pattern matching algorithm, rather than requiring separate extraction rules for each protocol. The system uses configurable search patterns that can be adapted to different protocols (SMTP, POP3, IMAP, FTP, HTTP, etc.) without changing the underlying hardware or fundamental software architecture. This universality reduces software complexity compared to protocol-specific tag scanning approaches while maintaining high processing speeds.
Data Source
AI summary
Techniques are provided for determining whether network traffic includes a user identifier of interest. Each byte of network traffic is classified as being either a valid character, an invalid character, or a delimiter character. An information stream can be generated based on the classification. Storage of valid characters in the information stream can be initiated when a first delimiter character is detected. Storage of valid characters in the information stream can be stopped when a second delimiter character is detected. The stored valid characters between the first delimiter character and the second delimiter character can be examined to determine whether the stored valid characters correspond to a user identifier.