Service Usage Model for Network Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in optimizing network performance due to the overlap of business and non-business critical traffic using the same protocols, and the difficulty in distinguishing and selecting traffic flows for optimization, as well as the presence of malicious traffic such as DoS attacks and malware propagation.
Innovation Solution
A device in the network generates a service usage model based on user access to services, trains a machine learning-based classifier using training feature vectors that include data on service usage, and employs this model to classify traffic, distinguishing between benign and malicious flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional protocol-based traffic classification is used, then all HTTP/HTTPS traffic is treated uniformly, but it becomes impossible to distinguish between business-critical and non-business-critical applications
Solution Approach 1:
The patent segments traffic analysis into multiple layers: protocol-level identification (HTTP/HTTPS) combined with application-level service usage modeling. Instead of treating all HTTP traffic uniformly, the system divides it into specific application services (e.g., video collaboration, cloud applications) by analyzing service usage patterns across multiple dimensions including request frequency, response time, and data volume characteristics.
Solution Approach 2:
The patent adds new dimensions to traffic analysis beyond protocol identification. It introduces service usage modeling that considers temporal patterns, spatial distribution across network nodes, and behavioral characteristics of different applications. This multi-dimensional approach enables differentiation of business-critical versus non-business-critical traffic without requiring deep inspection of encrypted payloads.
2Measurement precision
If deep packet inspection is used to identify malicious traffic, then detection accuracy improves, but processing overhead and network performance degrade
Solution Approach 1:
The patent extracts only the essential features needed for malicious traffic detection from full packet inspection. Instead of analyzing complete packet payloads, it extracts key characteristics such as service usage patterns, request frequency anomalies, and behavioral deviations from established models. This selective feature extraction maintains detection accuracy while significantly reducing processing overhead.
Solution Approach 2:
The system performs preliminary service usage modeling during normal network operation to establish baseline patterns of legitimate traffic. When anomalies are detected, the pre-built models enable rapid identification of malicious traffic without requiring intensive real-time analysis. This preliminary action prepares the system in advance, allowing fast response to threats while maintaining network throughput.
3Measurement precision
If service usage modeling for all users is implemented, then traffic classification precision improves, but computational resources and data processing requirements increase
Solution Approach 1:
The patent merges service usage data from multiple users into aggregated models that capture common patterns while filtering out individual variations. By combining observations across the user base, the system builds robust service usage profiles that improve classification precision without requiring separate extensive modeling for each user. This merging approach reduces the total data processing volume while enhancing pattern recognition capability.
Data Source
AI summary
In one embodiment, a device in a network identifies an set of services of a domain accessed by a plurality of users in the network. The device generates a service usage model for the domain based on the set of services accessed by the plurality of users. The service usage model models usage of the services of the domain by the plurality of users. The device trains a machine learning-based classifier to analyze traffic in the network using a set of training feature vectors. A particular training feature vector includes data indicative of service usage by one of the users for the domain and the modeled usage of the services of the domain by the plurality of users. The device causes classification of traffic in the network associated with a particular user by the trained machine learning-based classifier.