Stacked EtherType PID Embedding for Network Flow Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in correlating event logs and network flow data effectively, particularly in identifying which process ID (PID) triggers network flows or vice versa, leading to performance degradation and duplication of event data due to high-traffic generation and limited correlation capabilities.
Innovation Solution
A method that defines a new ethertype code for communicating PIDs, selects a suitable abstraction layer, and embeds the PID in network communications using a stacked EtherType in packet headers, allowing for efficient correlation between event logs and network flow data without affecting external communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If event logs and network flow data are collected separately without correlation, then data collection is simple, but correlation between PIDs and network flows cannot be achieved
Solution Approach 1:
The patent introduces an intermediary component (kernel module or network tap) that intercepts network packets and injects PID information into packet headers using a stacked EtherType mechanism. This intermediary enables correlation between event logs and network flows without requiring modifications to individual processes, thus achieving the correlation capability while maintaining system simplicity.
2Loss of information
If PID information is embedded in every network packet, then process-level visibility is achieved, but network traffic volume increases
Solution Approach 1:
The patent embeds PID information within the existing Ethernet packet header structure by utilizing the stacked EtherType field. Instead of adding separate data structures or increasing packet size significantly, the PID is nested within the existing header format. This approach achieves process-level visibility while minimizing the increase in network traffic volume.
3Loss of information
If existing network protocols are modified to include PID information, then correlation capability improves, but compatibility with external systems deteriorates
Solution Approach 1:
The patent segments the network monitoring function into two parts: internal correlation capability and external communication. The stacked EtherType mechanism enables PID correlation for internal monitoring purposes, while the underlying network protocols remain unchanged for external compatibility. This segmentation allows the system to achieve correlation capability without affecting adaptability to external systems.
Data Source
AI summary
A computer-implemented method comprising: (i) defining a new ethertype to be used in communicating PIDs (process identification codes), with the new ethertype being assigned a new ethertype code; (ii) determining a selected abstraction layer from a plurality of abstraction layers to be used in communicating PIDs; and (iii) making a plurality of network communications among and between computers of a networked computers system, with each communication, with the making of each given communication including: (a) inserting the new ethertype code and a PID of a process causing the given communication to occur into a data structure, and (b) communicating the data structure between computers of the networked computers system at the selected abstraction layer.