Packet Sequence Correlation via Modified Needleman-Wunsch Algorithm
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Tracing a message through a network is challenging when it is partitioned into packets, especially if the exact content is unknown, as existing filtering techniques struggle to distinguish the target message from numerous other packets, even with source and destination node filtering and event-sequencing.
Innovation Solution
A system and method that searches a traffic stream for a sequence of packets exhibiting high correlation to a reference sequence using a modified Needleman-Wunsch algorithm, considering correspondence factors based on packet characteristics like direction, size, and content, while preserving sequence order and allowing for null-matches with penalties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If filtering techniques (source/destination node filtering, event-sequencing) are used to reduce complexity, then the tracing task becomes easier, but the packets corresponding to the target message remain intermixed among dozens or hundreds of packets of other messages
Solution Approach 1:
The patent segments the packet stream into potential message sequences by dividing the tracing task into two phases: reference packet collection and matching against traffic stream. This segmentation allows systematic comparison of packet sequences rather than attempting to identify individual packets, resolving the contradiction between reduced complexity and maintained accuracy.
Solution Approach 2:
The patent creates a reference message sequence by copying and storing packets from a known good transaction. This reference copy is then used to match against packets in the traffic stream, enabling accurate identification without requiring complex real-time filtering. The reference copy serves as a template that simplifies the matching process while maintaining high accuracy.
2Measurement precision
If exact content matching is used to identify target packets, then identification accuracy improves, but the search space increases when exact matches are not available
Solution Approach 1:
The patent applies partial matching instead of requiring exact matches. The Needleman-Wunsch algorithm compares reference packets to traffic stream packets and allows for mismatches, insertions, and deletions. This partial matching approach maintains accuracy for similar packets while significantly improving search efficiency by avoiding exhaustive exact matching.
Solution Approach 2:
The patent changes the matching parameters from strict equality to similarity metrics. By using the Needleman-Wunsch algorithm with scoring matrices and gap penalties, the system evaluates packet similarity based on multiple parameters (content, size, direction) rather than requiring exact matches. This parameter transformation enables both accurate identification and efficient searching.
3Measurement precision
If sequence order is strictly enforced in packet matching, then message tracing accuracy improves, but the algorithm complexity increases
Solution Approach 1:
The patent replaces mechanical sequence checking with a dynamic programming approach. The Needleman-Wunsch algorithm uses matrix-based dynamic programming to simultaneously handle sequence order constraints and flexibility. This substitution transforms the complex constraint satisfaction problem into an efficient optimization problem that naturally enforces sequence order while allowing for reasonable variations.
Data Source
AI summary
A system/method searches a traffic stream for a sequence of “matching” packets that exhibit a high degree of correlation or similarity to a sequence of “reference” packets. The correlation between matching and reference packets is based on a degree of correspondence between individual packets, as well as the sequence-order of the corresponding packets. A variation of the Needleman-Wunsch algorithm is preferably used to select corresponding packets in the traffic stream that provide a sequence-order that best matches the sequence-order of the reference packets, based on a measure of the correspondence for each match, and a penalty associated with each non-match. The algorithm is further modified to reduce the required search-space for finding corresponding packets in the traffic stream.