Prototype Dataset Dictionary for ML Traffic Analyzer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of network traffic, including the use of encryption and the indistinguishability of business and non-business critical traffic, complicates the optimization of network performance and the detection of malicious traffic, such as DoS attacks and malware propagation, making it difficult for existing technologies to effectively classify and manage network traffic flows.
Innovation Solution
A device generates a feature vector based on traffic flow data and updates a training dataset dictionary by adding or incrementing existing feature vectors, allowing for the creation of a prototype training dataset for a machine learning-based traffic flow analyzer, which reduces redundancies and efficiently trains the analyzer, enabling better classification of benign and malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a machine learning-based traffic analyzer is trained using a comprehensive dataset including all traffic flows, then the classification accuracy improves, but the storage requirements and training time increase significantly
Solution Approach 1:
The patent creates a prototype dataset that replicates the essential characteristics of comprehensive network traffic without requiring the full volume of actual traffic data. By synthesizing a representative subset that captures the diversity of traffic patterns, the system achieves effective training with reduced data volume.
Solution Approach 2:
The system transforms the training approach by changing parameters such as dataset composition and structure. Instead of using raw comprehensive traffic data, the patent generates a curated prototype dataset with specific parameter configurations that optimize both training efficiency and classification performance.
2Reliability
If all traffic flows are captured and analyzed in detail, then the detection of malicious traffic improves, but the processing complexity and time increase
Solution Approach 1:
The patent extracts and isolates the most critical features and patterns from network traffic that are indicative of malicious activity. By focusing on these key extracted characteristics rather than processing all raw traffic data, the system achieves reliable detection with reduced processing complexity.
Solution Approach 2:
The system segments the traffic analysis process into distinct phases: generating a prototype dataset, training the machine learning model, and deploying for classification. This segmentation allows each phase to be optimized independently, reducing overall processing complexity while maintaining detection reliability.
3Reliability
If encryption is used to protect traffic payloads, then the security of data transmission improves, but the ability to inspect and classify traffic deteriorates
Solution Approach 1:
The patent performs preliminary actions by training the machine learning model on encrypted traffic patterns before deployment. The prototype dataset is generated and the model is trained in advance to recognize encrypted traffic characteristics, enabling effective classification without requiring decryption of actual traffic during operation.
Data Source
AI summary
In one embodiment, a device in a network generates a feature vector based on traffic flow data regarding one or more traffic flows in the network. The device makes a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary. The device updates the training dataset dictionary based on the determination by one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary. The device generates a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer.