Self-learning device classifier for network traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for classifying network traffic rely on outdated type allocation codes (TACs) and require extensive database management, making it difficult to automatically identify unknown devices and adjust network traffic policies effectively.
Innovation Solution
A system that classifies unknown devices based on traffic-borne characteristics using a self-learning technique, analyzing packet information to identify predictive sets of characteristics for accurate device classification, without relying on pre-existing device knowledge or frequent database updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TAC databases are maintained exhaustively to identify all device types, then device identification accuracy is improved, but database update frequency and cost increase significantly
Solution Approach 1:
The system performs self-learning by automatically analyzing captured packets to extract device characteristics and build classification models without requiring manual database updates. The listening node autonomously identifies new device types by analyzing traffic patterns and updating its classification capabilities dynamically, eliminating the need for frequent manual database maintenance while maintaining high identification accuracy
Solution Approach 2:
The system pre-extracts and stores device characteristics from captured packets in advance, building a comprehensive feature set that can be quickly queried during device identification. By preparing classification data beforehand through automated analysis of traffic samples, the system enables rapid device type determination without requiring real-time database updates
2Measurement precision
If fingerprint databases are manually updated with new device characteristics, then classification accuracy is improved, but automation level decreases
Solution Approach 1:
The listening node automatically performs feature extraction from captured packets, identifies new device types through pattern recognition, and updates its classification models without human intervention. The system self-trains by analyzing traffic characteristics and autonomously expanding its device fingerprint database, maintaining high classification accuracy while achieving full automation
Solution Approach 2:
The system continuously monitors classification results and uses feedback from misclassified or unknown devices to refine its models. When new device types are detected or classification accuracy needs improvement, the system automatically adjusts its feature extraction parameters and classification thresholds based on observed traffic patterns, enabling continuous self-improvement without manual intervention
3Device complexity
If offline database access is used for device classification, then system simplicity is improved, but device identification timeliness deteriorates
Solution Approach 1:
The system pre-loads and caches device characteristic data and classification models into local memory before they are needed for actual device identification. By preparing classification data in advance and storing it in readily accessible memory, the system enables rapid device type determination without requiring frequent online database queries, maintaining both simplicity and speed
Data Source
AI summary
Systems and methods classify unknown devices communicating over a packet-switched network based on traffic-borne characteristics comprising packet parameters, flow parameters, and/or operating-system parameters. Embodiments utilize “self-learning” to optimize the level of classification accuracy.