Packet Classification Using Header Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network devices require elaborate and expensive classification engines for deep packet payload inspection, which is time-consuming and inefficient for packet classification based on layer 7 classifications.
Innovation Solution
A method for packet classification that stores characteristic signatures of packet flows in network devices, using attributes from packet headers to identify flows associated with network applications without deep packet inspection, employing bit-masking to extract payload sizes and other attributes, and utilizing decision trees for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet payload inspection is performed to classify network applications, then classification accuracy is improved, but processing time increases and device complexity increases
Solution Approach 1:
The patent extracts only the necessary packet attributes (payload size, arrival rate, inter-arrival time) from packet headers and flow characteristics, rather than performing complete deep packet inspection. This extraction approach maintains classification accuracy by focusing on key distinguishing features while significantly reducing processing time and computational resources required.
Solution Approach 2:
The patent performs preliminary classification by analyzing packet header attributes and flow characteristics before conducting any deep packet inspection. This preliminary action filters and categorizes packets based on readily available information, reducing the need for time-consuming payload inspection while maintaining accurate application identification.
2Measurement precision
If deep packet payload inspection is performed to classify network applications, then classification accuracy is improved, but device complexity and cost increase
Solution Approach 1:
The patent extracts only the necessary packet attributes (payload size, arrival rate, inter-arrival time) from packet headers and flow characteristics, rather than performing complete deep packet inspection. This extraction approach maintains classification accuracy by focusing on key distinguishing features while significantly reducing processing time and computational resources required.
Solution Approach 2:
The patent uses simple, easily computable packet header attributes and flow statistics as classification features instead of expensive deep packet inspection engines. These lightweight features can be extracted and processed with minimal computational resources, replacing complex classification hardware while maintaining effective application identification.
3Productivity
If packet attributes are extracted from headers using bit-masking and calculations, then processing speed is improved, but measurement precision may be reduced
Solution Approach 1:
The patent performs preliminary classification by analyzing packet header attributes and flow characteristics before conducting any deep packet inspection. This preliminary action filters and categorizes packets based on readily available information, reducing the need for time-consuming payload inspection while maintaining accurate application identification.
Data Source
AI summary
Aspects of the disclosure provide a method for packet classification. The method includes storing, in a computer memory of a network device, characteristic signatures of packet flows for network applications. The characteristic signature includes a pattern of two or more packet attributes of packets in packet flows for a network application. Then, the method includes receiving a stream of network packets at the network device, identifying one or more packet flows in the stream of network packets, processing the packets, at a packet processor, to obtain packet attributes of packets in the respective packet flows, and identifying a packet flow as being associated with a given network application when the packet attributes of packets in the packet flow match the characteristic signature of the given network application.