Service Tagging Encrypted Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network technologies face challenges in classifying and prioritizing encrypted traffic flows due to the inability to use deep packet inspection (DPI) when encryption is employed, leading to inefficient resource allocation in constrained access networks.
Innovation Solution
The implementation of service tagging within the Domain Name System (DNS) to identify services associated with encrypted traffic flows, combined with machine learning classifiers to accurately classify and prioritize these flows based on service tags and reputation scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection (DPI) is used to classify traffic flows, then traffic classification accuracy is improved, but it becomes inapplicable when traffic is encrypted
Solution Approach 1:
The patent introduces service tags as an intermediary mechanism that bridges the gap between encrypted traffic and classification capabilities. Instead of directly inspecting encrypted packets, the system uses service tags attached to DNS queries and responses to convey service type information, enabling classification without decryption of the actual traffic payload
Solution Approach 2:
The patent replaces the mechanical packet inspection process with a information-based approach using service tags. Rather than physically examining packet contents through DPI, the system substitutes this with a tagging mechanism that annotates traffic flows with service type information at the DNS level, eliminating the need for cryptographic decryption
2Adaptability or versatility
If service tagging is implemented in DNS, then encrypted traffic classification becomes possible, but DNS protocol complexity increases
Solution Approach 1:
The patent makes the DNS protocol multi-functional by extending it to carry both traditional domain resolution information and new service tag information. The same DNS query and response messages serve dual purposes: resolving domain names and conveying service type information through tags, thereby avoiding the need for separate classification protocols
Solution Approach 2:
The patent changes the parameters of DNS messages by adding service tag fields to existing DNS query and response structures. This modifies the DNS protocol parameters to include additional information elements without fundamentally altering the core DNS resolution mechanism, allowing backward compatibility while enabling new functionality
3Measurement precision
If machine learning classifiers are used for traffic classification, then classification accuracy is improved, but computational resources and time are increased
Solution Approach 1:
The patent performs preliminary classification by attaching service tags to DNS queries before traffic actually flows. This advance tagging allows the classification system to have pre-established knowledge about traffic types, eliminating the need for real-time analysis of encrypted traffic characteristics and reducing processing time during actual traffic classification
Solution Approach 2:
The patent extracts service type information from the DNS layer and separates it from the encrypted traffic payload. By taking out the classification-relevant information (service tags) from the encrypted data stream and placing it in the clear DNS messages, the system enables fast classification without requiring computationally intensive analysis of the encrypted traffic itself
Data Source
AI summary
In one embodiment, a device in a network receives domain name system (DNS) information for a domain. The DNS information includes one or more service tags indicative of one or more services offered by the domain. The device detects an encrypted traffic flow associated with the domain. The device identifies a service associated with the encrypted traffic flow based on the one or more service tags. The device prioritizes the encrypted traffic flow based on the identified service associated with the encrypted traffic flow.