Multi-Protocol Packet Fingerprinting for Abnormal Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network attack detection methods rely on public blacklists of IPs, leading to low detection accuracy and efficiency due to the large number of unlisted IPs used by hackers, resulting in missed detections.
Innovation Solution
A method involving feature extraction of network data packets using multiple protocol types to generate fingerprints, matching these fingerprints with a reference library, and calculating confidence levels to determine abnormality based on correlation information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If public blacklist IP detection method is used, then detection simplicity is maintained, but detection accuracy deteriorates due to large number of unlisted hacker IPs
Solution Approach 1:
The patent segments the detection process into multiple independent modules: feature extraction module that extracts characteristics from network packets, fingerprint generation module that creates protocol-specific fingerprints, matching module that compares fingerprints against a library, and confidence calculation module that aggregates results. This segmentation allows comprehensive multi-protocol analysis while maintaining modular simplicity.
Solution Approach 2:
The patent transitions from single-dimension IP address matching to multi-dimensional detection by extracting features across multiple protocol layers (TCP, UDP, HTTP, HTTPS, DNS, FTP). Each protocol type provides an additional dimension of analysis, creating a comprehensive fingerprint profile that significantly improves detection accuracy beyond traditional blacklist methods.
2Measurement precision
If multi-protocol fingerprint analysis is implemented, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary feature extraction on network packets before full analysis. The system pre-identifies which protocol types are present in each packet and prepares corresponding fingerprints in advance, reducing the computational burden during the matching phase and accelerating overall processing speed.
Solution Approach 2:
The patent implements a confidence threshold mechanism that allows the system to skip detailed analysis of low-priority packets. When initial fingerprint matching produces high-confidence results, the system rapidly processes these without exhaustive multi-protocol analysis, thereby reducing processing time for obvious cases while maintaining accuracy for suspicious packets.
3Adaptability or versatility
If comprehensive feature extraction across multiple protocols is performed, then detection coverage is improved, but computational complexity increases
Solution Approach 1:
The patent designs a universal fingerprint extraction framework that can handle multiple protocol types (TCP, UDP, HTTP, HTTPS, DNS, FTP) through a single integrated system. The feature extraction module automatically adapts to different protocols, applying protocol-specific extraction rules while maintaining a unified processing architecture, thereby achieving comprehensive coverage without proportionally increasing system complexity.
Solution Approach 2:
The patent dynamically adjusts extraction parameters and fingerprint depth based on protocol type and packet characteristics. For example, DNS packets receive specialized extraction focused on query patterns, while HTTP packets undergo deeper content analysis. This parameter adaptation allows comprehensive multi-protocol coverage while optimizing computational resources for each specific protocol.
Data Source
AI summary
A method for detecting abnormal network data includes performing feature extraction on a network data packet according to each of plural protocol types, and generating a corresponding data packet fingerprint set. The data packet fingerprint set includes one or more data packet fingerprints, each of the one or more data packet fingerprints corresponding to one of the plural protocol types. The method further includes matching at least one data packet fingerprint in the data packet fingerprint set and a reference data packet fingerprint in a reference data packet fingerprint library, and calculating a confidence corresponding to the network data packet based on confidence correlation information corresponding to each of the at least one matched data packet fingerprint. The method also includes obtaining a reference confidence, and determining an abnormality detection result of the network data packet based on the reference confidence and the calculated confidence.