Network Packet Image Generation for Encrypted Application Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional deep packet inspection (DPI) methods are burdensome in terms of time and resources, and often fail to identify malicious client and server applications due to encrypted payloads, making it difficult to protect networks from threats like spyware, viruses, and malware.
Innovation Solution
A computer-implemented method using a convolutional neural network that generates images from payload data and time data from network packets to identify client and server applications, allowing for efficient identification without relying on conventional DPI, even when payloads are encrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection (DPI) is used to identify client and server applications, then identification accuracy is improved, but time consumption and resource usage increase significantly
Solution Approach 1:
The patent extracts only the essential features needed for identification (payload length, time interval, packet sequence number) from the complete packet data, rather than analyzing the entire packet content. This extraction approach maintains identification accuracy while dramatically reducing processing time and resource consumption.
Solution Approach 2:
The packet flow data is segmented into discrete feature components (payload length, time interval, sequence number) that can be processed independently and efficiently. This segmentation allows the system to analyze only relevant aspects of the data without the overhead of comprehensive DPI.
2Measurement precision
If deep packet inspection (DPI) is used to inspect encrypted payloads, then identification capability is improved, but resource consumption increases and encrypted data cannot be accessed
Solution Approach 1:
Instead of trying to decrypt and analyze the payload content (the conventional approach), the patent inverts the approach by analyzing metadata characteristics (payload length, time intervals, packet sequencing) that are visible without decryption. This inversion allows identification of encrypted traffic without requiring decryption capabilities or additional computational resources.
3Loss of information
If conventional DPI methods are used, then detailed packet analysis is possible, but the system becomes slow and resource-intensive
Solution Approach 1:
The patent creates a simplified representation (copy) of the packet flow data by extracting key features into a structured format with predetermined numbers of bins and dimensions. This copied representation retains the essential patterns needed for identification while enabling much faster processing compared to analyzing the original detailed packet data.
Data Source
AI summary
In some embodiments, an example method may include capturing target data from a target flow of network packets, generating a target image from the target data, and determining, based on the target image, an extent to which the target image matches one of a plurality of predetermined images. In some embodiments, the method may include determining, based on the extent to which the target image matches one of the plurality of predetermined images, a likelihood an application associated with the target flow of network packets matches a predetermined malicious application.