Packet Sample Path Association for Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network analysis tools face challenges in efficiently collecting and processing path-centric information from packet samples, as these samples often lack necessary data for traffic analysis, requiring innovative methods to associate and aggregate information efficiently in terms of processing time and storage.
Innovation Solution
The method involves using packet samples as search keys to determine path-centric information through data structures like Radix tries, mapping packet-centric information to path-centric information, and adjusting traffic metrics, thereby generating data structures for efficient storage and processing of traffic parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If packet samples are collected for network traffic analysis, then traffic information can be gathered, but the samples lack necessary path-centric information for comprehensive analysis
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing path-centric information (such as autonomous system paths, origin AS, peer AS, and traffic engineering parameters) in data structures before traffic analysis is needed. This allows packet samples to be quickly enriched with pre-prepared path information during the analysis phase, rather than computing this information in real-time when packets are captured.
Solution Approach 2:
The patent uses an intermediary approach by introducing data structures that store the relationship between packet-centric information (source/destination addresses) and path-centric information. These data structures act as intermediaries that map packet headers to pre-computed path information, enabling efficient association without direct real-time computation between packets and path data.
2Reliability
If path-centric information is computed and stored for every packet, then complete traffic analysis data is available, but processing time and storage requirements increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-computing path-centric information such as autonomous system paths, origin autonomous systems, and peer autonomous systems before traffic analysis is needed. This pre-computation stores routing and traffic engineering parameters in advance, allowing rapid association with packet samples during analysis without real-time computation delays.
Solution Approach 2:
The patent extracts only the essential path-centric information parameters needed for traffic analysis (such as origin AS, peer AS, and traffic engineering parameters) and stores them in dedicated data structures. This selective extraction avoids storing unnecessary data, reducing both processing time and storage requirements while maintaining analysis accuracy.
3Loss of information
If detailed path-centric information is stored for all packets, then comprehensive traffic analysis is possible, but storage requirements become excessive
Solution Approach 1:
The patent extracts and stores only the specific path-centric information parameters necessary for traffic analysis, such as origin autonomous system, peer autonomous system, and traffic engineering parameters. By selecting only these essential elements rather than storing complete packet metadata, the system achieves comprehensive analysis capability with reduced storage requirements.
Solution Approach 2:
The patent performs preliminary aggregation and consolidation of path-centric information in data structures before storage, combining multiple packets' worth of path information into aggregated records. This pre-aggregation reduces redundancy and minimizes the total storage space required while preserving all necessary traffic parameters for analysis.
Data Source
AI summary
Samples from an addressed data forwarding devices, such as a router, are associated with path-centric information. Information from the samples is used to update corresponding path-centric traffic information, such as flow information for example. The aggregated path-centric traffic information can then be used by traffic analysis operations.