Service Directory for Network Flow Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network classification techniques, such as deep packet inspection, are resource-intensive and time-consuming, making it inefficient to classify network flows with short lifespans, and often result in wasted resources when flows cease to exist before classification is complete.
Innovation Solution
Implementing a method that uses a service directory to classify network flows by querying a centralized or local service directory with the network address and port identifier, allowing for quick and efficient classification and management of new network flows without the need for extensive deep packet inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to classify network flows, then classification accuracy is improved, but resource consumption increases and processing time increases
Solution Approach 1:
The patent segments the classification process into two parts: (1) quick classification using service directory lookup based on five-tuple information, and (2) detailed classification using deep packet inspection only when needed. This segmentation allows most flows to be classified rapidly without resource-intensive inspection, while still maintaining accuracy for complex flows that require deeper analysis.
Solution Approach 2:
The patent performs preliminary classification actions by maintaining a service directory that pre-stores classification information for known services and applications. When a network flow is detected, the system first checks the service directory using the flow's five-tuple information to obtain quick classification results, avoiding the need for immediate deep packet inspection and reducing overall processing time and resource consumption.
2Measurement precision
If deep packet inspection is used to classify network flows, then classification accuracy is improved, but processing speed decreases
Solution Approach 1:
The classification process is divided into a fast path using service directory lookup and a slow path using deep packet inspection. The majority of flows are handled by the fast path, achieving high processing speed, while the slow path is reserved for edge cases requiring higher accuracy, thus balancing speed and accuracy overall.
Solution Approach 2:
By pre-populating the service directory with classification rules and service information, the system performs preliminary classification work in advance. This allows most network flows to be classified immediately using stored information without requiring time-consuming deep packet inspection, significantly improving processing speed while maintaining accuracy for complex flows.
3Reliability
If deep packet inspection is used to classify network flows, then classification completeness is improved, but resource waste increases for short-lived flows
Solution Approach 1:
The service directory performs preliminary classification using readily available five-tuple information before the flow completes its lifecycle. This preliminary action captures classification data for short-lived flows that would otherwise disappear before deep packet inspection could complete, ensuring classification completeness without wasting resources on flows that end prematurely.
Solution Approach 2:
The patent extracts essential classification information from the five-tuple data and service directory lookup, separating this quick classification from the more resource-intensive deep packet inspection. By taking out the essential classification needs and satisfying them through lighter means, the system avoids wasting resources on short-lived flows while maintaining completeness for flows that require deeper analysis.
Data Source
AI summary
Techniques for classifying a network flow using a service directory. Embodiments receive a request to establish a network flow with a remote service. The request specifies a network address associated with the remote service. A classification of the remote service is determined by querying a service directory using the network address and the port identifier. Embodiments also determine a network management policy to apply to the network flow, based on the determined classification.