Packet Flow Detection via Statistical Frequency Deviation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect a single data flow in an aggregate packet data flow, particularly for encrypted protocols like VoIP, as they lack the capability to identify the application generating the flow without knowledge of the protocols and algorithms used.
Innovation Solution
A method utilizing the Pearson chi-square statistical function to measure frequency deviation in block values of packet data flows, allowing for the detection and identification of a single data flow by comparing measured frequency values against expected distributions and threshold values, differentiating between deterministic, random, and mixed distributions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional detection methods are used to identify data flows in aggregate traffic, then the system can operate with simple protocols, but it fails to detect encrypted protocols like VoIP
Solution Approach 1:
The patent changes the detection parameter from protocol-specific features to statistical properties of packet flows. By analyzing frequency distributions, inter-arrival times, and packet size variations, the system can detect encrypted traffic without needing to understand the encryption protocols themselves.
Solution Approach 2:
The patent introduces statistical analysis as an intermediary layer between the raw packet data and the detection decision. Instead of directly analyzing protocol contents, the system uses statistical features (frequency distributions, timing patterns) as mediators to infer the presence and type of encrypted traffic.
2Loss of information
If the system attempts to identify applications generating encrypted flows without knowledge of their protocols, then it can provide application identification, but the detection accuracy decreases
Solution Approach 1:
The patent applies partial action by not attempting to fully decode or understand the encrypted protocol, but instead focusing on analyzing the statistical patterns that are visible even in encrypted traffic. This partial analysis of timing, frequency, and size patterns provides sufficient information for accurate detection without requiring complete protocol knowledge.
Solution Approach 2:
The patent performs preliminary statistical analysis on packet flows before attempting application identification. By pre-computing and storing statistical profiles of different applications under various conditions, the system can quickly match unknown flows to known patterns without needing to understand the underlying encrypted protocols.
3Measurement precision
If the system analyzes detailed packet contents to identify flows, then it can achieve high detection precision, but the computational complexity increases
Solution Approach 1:
The patent extracts only the essential statistical features from packet flows (frequency distributions, inter-arrival times, packet size patterns) while discarding the detailed packet contents. This extraction approach maintains detection accuracy by focusing on the most discriminative features while significantly reducing computational complexity.
Solution Approach 2:
The patent segments the flow analysis into distinct statistical dimensions (frequency, timing, size) that can be independently computed and analyzed. This segmentation allows the system to process each dimension separately using simple statistical tests rather than requiring complex holistic analysis of entire packet streams.
Data Source
AI summary
The invention relates to a method and a system for detecting a single data flow in an aggregate packet data flow and identifying the application generating the single data flow, this single data flow being divided into messages, each message comprising a plurality of blocks, each block (g) having n bits for identifying 2n block values (i). The method comprises the steps of providing, for each block value (i), an expected frequency value (Ei), measuring, for a predefined number (G) of blocks (g), the values Formula (I) of frequency with which each block (g) identifies each block value (i) so as to obtain a plurality of measured frequency values Formula (I), processing, for each block (g), the measured frequency values Formula (I) and the expected frequency values (Ei) in order to generate a frequency deviation value Formula (II) representative of the deviation of the measured frequency values Formula (I) with respect to the expected frequency values (Ei), and processing the frequency deviation values Formula (II) generated for each block (g) with at least one frequency deviation threshold value (χth) in order to detect the single data flow and identify the application generating said single data flow.