Passive Middlebox Detection via Network Session Vector Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for detecting middleboxes in computer networks rely on active detection techniques, which strain network resources and are cumbersome for administrators, especially when network topologies change.

Innovation Solution

A system that passively detects middleboxes by analyzing network session information from monitoring devices, transforming it into vectors, computing similarity measures, and visualizing relationships to characterize network topology without injecting additional traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If active detection methods are used to detect middleboxes by sending known traffic signals, then detection accuracy is improved, but network resource consumption increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidnetwork resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

Instead of actively sending detection traffic to find middleboxes, the system passively observes and analyzes existing network traffic flows. Network monitoring devices collect session information from normal traffic, and the system processes this data to detect middleboxes without injecting additional traffic into the network.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system uses the network's own traffic data to detect middleboxes. By analyzing session information from monitoring devices that capture existing traffic flows, the system enables self-detection without external detection signals, turning the network's operational traffic into a detection resource.

Inventive Principle:

Principle #25Self-service

2Difficulty of detecting and measuring

If active detection techniques are deployed to identify middleboxes, then detection capability is enhanced, but network strain increases

Engineering Contradiction:

Improvedetection capabilityVSAvoidnetwork strain

Core Design Contradiction:

Difficulty of detecting and measuringVSObject-affected harmful factors

Solution Approach 1:

The system inverts the detection approach by passively analyzing existing traffic patterns rather than actively probing the network. Monitoring devices collect session information from ongoing traffic, and similarity computations detect middleboxes embedded in this passive observation data, avoiding any additional network strain.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

Network monitoring devices serve as intermediaries that collect and forward session information to the detection system. These devices passively capture traffic data without interfering with normal network operations, enabling middlebox detection while isolating the detection process from direct network strain.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If manual identification of middleboxes is performed by network administrators, then detection accuracy is maintained, but operational complexity increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidoperational complexity

Core Design Contradiction:

Measurement precisionVSEase of operation

Solution Approach 1:

The system performs automatic middlebox detection by processing session information from monitoring devices through vector transformation and similarity computation. This automated process eliminates the need for manual administrator intervention in identifying and specifying middleboxes, reducing operational complexity while maintaining detection accuracy.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system transforms session information into vectors and uses similarity measures to automatically identify middleboxes. By changing the detection parameters from manual configuration to automated computational analysis, the system reduces operational burden while preserving accurate detection of middlebox devices.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11483393B1Apparatus and method for passive detection of middleboxes within computer networks

Publication Date: 2022.10.25 CPACKET NETWORKS

AI summary

A non-transitory computer readable storage medium has instructions executed by a processor to receive network session information from network monitoring devices distributed throughout an enterprise network. The network session information characterizes communications between a client device within the enterprise network and a server external to the enterprise network. The network session information is transformed into vectors of network communication session parameters. The vectors are combined into different time series of data. A similarity measure is computed between the different time series of data to detect unique sessions between the client device and a middlebox network device within the enterprise network or unique sessions between a middle box network device within the enterprise network and the server. The unique sessions are evaluated to infer relationships between networked devices within the enterprise network. A visualization of the relationships to characterize enterprise network topology is supplied.