Rate Limiter Sampling for Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional rate-limiting systems in communications networks provide minimal information about traffic statistics and can be overwhelmed by redirecting all out-of-profile packets, leading to inefficiencies and potential threats.
Innovation Solution
Implementing a rate limiter with at least three states, including an out-of-profile leak state, where packets are sampled and forwarded to a processing mechanism for analysis, allowing for selective rate-limiting and defensive actions to be taken based on identified threat conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all out-of-profile packets are redirected to a processing mechanism, then complete traffic analysis is achieved, but the processing mechanism becomes overwhelmed
Solution Approach 1:
The patent applies partial action by redirecting only a sample subset of out-of-profile packets to the processing mechanism rather than all packets. The rate limiter identifies packets exceeding the rate threshold and selectively forwards them based on sampling criteria, providing sufficient traffic analysis data while preventing processing mechanism overload.
2Productivity
If traditional two-state rate limiting is used, then packet traffic is controlled, but detailed traffic statistics are not provided
Solution Approach 1:
The patent introduces an intermediary sampling mechanism between the rate limiter and the processing mechanism. This intermediary selectively forwards sampled out-of-profile packets while maintaining normal forwarding for in-profile packets, thus preserving traffic statistics information without disrupting overall packet forwarding efficiency.
3Reliability
If out-of-profile packets are dropped, then rate limiting is enforced, but no information about the traffic is obtained
Solution Approach 1:
The patent extracts a sample subset of out-of-profile packets from the main traffic flow and forwards them to the processing mechanism for analysis. This extraction provides traffic information about rate-exceeding packets while the majority of out-of-profile packets are still subject to rate limiting enforcement through dropping or redirection.
Data Source
AI summary
Out-of-profile rate-limited traffic is sampled to provide data for analysis, such as for, but not limited to, identifying a threat condition such as a denial-of-service or other malicious attack, or a non-malicious attack such as an error in configuration. A rate limiter including at least three states is typically used, with one of these states being an out-of-profile sampling state wherein the packet traffic is sampled to identify one or more sampled packets on which analysis can be performed, with defensive action possibly taken in response to the analysis.