Pairwise Feature Histograms for Encrypted Network Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to effectively classify network traffic, especially encrypted traffic, due to limited informative features and noise in time-related characteristics, making it difficult to distinguish between legitimate and malicious traffic.
Innovation Solution
The approach involves dividing groups of tuples of traffic characteristics into pairs, creating two-dimensional feature subspaces, discretizing these subspaces into bins, and forming vector representations based on bin assignments, which are then used to train a machine learning-based traffic classifier.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional soft histogram approaches are used to represent network traffic, then the implementation is simple, but the detection precision of malicious traffic is insufficient
Solution Approach 1:
The patent segments the network traffic representation by dividing tuples into different pairs, with each pair corresponding to a two-dimensional feature subspace. This segmentation allows the system to capture pairwise relationships between features while maintaining manageable complexity through discrete binning in each subspace.
Solution Approach 2:
The patent transitions from traditional one-dimensional histograms to multiple two-dimensional feature subspaces. By discretizing each 2-D subspace into bins and forming vector representations based on bin assignments, the system captures pairwise feature relationships that provide richer information for malware detection.
2Reliability
If encryption is used to protect network traffic, then the security of data transmission is improved, but the ability to inspect and classify traffic is reduced
Solution Approach 1:
The patent applies local quality by focusing on specific two-dimensional feature subspaces that are most informative for classification. Instead of attempting to analyze all features uniformly, the system identifies and analyzes pairwise relationships in specific subspaces, making the inspection process more effective even with encrypted traffic.
Solution Approach 2:
The patent changes parameters by discretizing continuous feature values into discrete bins within each two-dimensional subspace. This transformation makes the traffic representation more robust to variations and noise in encrypted traffic while preserving the essential patterns needed for classification.
3Measurement precision
If more features are used to represent network traffic, then the classification accuracy is improved, but the noise and computational complexity increase
Solution Approach 1:
The patent extracts only the most relevant information by focusing on pairwise feature relationships in two-dimensional subspaces. By discretizing these subspaces into bins and using bin assignment counts as features, the system extracts essential patterns while filtering out noise from individual feature variations.
Solution Approach 2:
The patent merges information from multiple two-dimensional feature subspaces into a unified vector representation. By combining the bin assignment counts from different subspaces, the system creates a comprehensive representation that captures pairwise relationships across multiple feature dimensions while maintaining computational efficiency.
Data Source
AI summary
In one embodiment, a device divides groups of tuples of traffic characteristics of encrypted network traffic into different pairs of the characteristics. Each of the pairs has a corresponding two dimensional (2-D) feature subspace. The device discretizes the 2-D feature subspaces, to form a plurality of bins in each feature subspace. The device assigns the pairs of the traffic characteristics in a particular group of tuples to the bins in the discretized 2-D feature subspaces. The device forms, for each group of tuples, a vector representation of the group of tuples based on the bins in the discretized 2-D feature subspaces to which the pairs of the traffic characteristics from the group are assigned. The vector representations of the groups of tuples are of a fixed dimension. The device uses the vector representations of the groups of tuples to train a machine learning-based traffic classifier.