Parallel Packet Classification Logic for Real-Time Application Identification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for packet classification in routers, such as deep packet inspection (DPI) and statistical classification, face challenges like latency, resource intensity, high false positive rates, and inability to classify data streams in real-time due to computational costs and polymorphic techniques.

Innovation Solution

Implementing a parallel processing system with packet classification logics and data stream classification logics, where packet classification logics generate signals based on attribute matches and data stream classification logics provide likelihoods of application association, potentially using hardware to enhance speed and accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If deep packet inspection (DPI) is used to detect applications, then classification accuracy is improved, but processing speed deteriorates and resource consumption increases

Engineering Contradiction:

Improveclassification accuracyVSAvoidprocessing speed

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the packet classification task into multiple parallel classifiers, each handling specific application protocols. This divides the monolithic DPI process into smaller, specialized units that can process packets concurrently, improving throughput while maintaining accuracy for recognized protocols.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs partial classification by using statistical features and shallow inspection for common protocols, reserving full DPI only for ambiguous cases. This partial action approach achieves sufficient classification accuracy for most traffic while avoiding the computational overhead of complete DPI on every packet.

Inventive Principle:

Principle #16Partial or excessive action

2Difficulty of detecting and measuring

If deep packet inspection (DPI) is used to examine packet payload contents, then application detection capability is improved, but latency increases causing network slowdowns

Engineering Contradiction:

Improveapplication detection capabilityVSAvoidnetwork latency

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The system performs preliminary classification using statistical features extracted from packet headers and flow characteristics before resorting to payload inspection. This preliminary action filters out most packets that can be classified without deep inspection, reducing latency while maintaining detection capability for protocols identifiable through statistical patterns.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent extracts and utilizes statistical features from packet metadata (headers, flow patterns, timing) separately from payload content. This extraction allows classification based on readily available information, eliminating the time-consuming payload examination for many protocols while preserving application detection through characteristic traffic patterns.

Inventive Principle:

Principle #2Taking out (Extraction)

3Device complexity

If conventional statistical classification techniques using software are used, then implementation complexity is reduced, but computational cost increases and real-time classification becomes impractical

Engineering Contradiction:

Improveimplementation complexityVSAvoidcomputational cost

Core Design Contradiction:

Device complexityVSUse of energy by moving object

Solution Approach 1:

The patent replaces software-based statistical classification with hardware implementation (ASIC or FPGA). This substitution eliminates the high computational cost and energy consumption of software processing while maintaining the simpler statistical approach, enabling real-time classification with reduced resource usage.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Use of energy by moving object

If conventional statistical classification techniques are used, then resource consumption is reduced, but the ability to reach classification conclusions in real-time deteriorates

Engineering Contradiction:

Improveresource consumptionVSAvoidclassification speed

Core Design Contradiction:

Use of energy by moving objectVSSpeed

Solution Approach 1:

The patent implements statistical classification logic in hardware (ASIC/FPGA) rather than software. This substitution provides the speed of hardware processing while maintaining the resource-efficient statistical approach, achieving both low resource consumption and real-time classification capability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS8379639B2Packet classification

Publication Date: 2013.02.19 CISCO TECHNOLOGY INC

AI summary

Apparatuses, methods, and other embodiments associated with packet identification are described. One example apparatus includes a packet selection logic to identify packets associated with a data stream. The example apparatus may also include a set of packet classification logics. A packet classification logic may generate a signal as a function of whether an attribute associated with the packet matches an attribute associated with packets generated by a tested application.