Supervisory Device Training Traffic Classifier for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in distinguishing and optimizing traffic flows for specific applications due to the use of shared protocols, and struggle to effectively detect and mitigate Denial of Service (DoS) attacks, particularly distributed DoS (DDoS) attacks, which can overwhelm network resources and impact legitimate traffic.
Innovation Solution
A network-based approach that utilizes a supervisory device to receive traffic data from security devices and distributed learning agents, trains a traffic classifier using machine learning-based anomaly detection, and deploys it to selected agents to differentiate between normal and malicious traffic, enhancing the network's ability to detect and respond to anomalies and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning-based anomaly detection is used to detect attacks, then detection capability is improved, but false positive rates increase
Solution Approach 1:
The system implements feedback by collecting traffic data from multiple sources including security devices and distributed learning agents, using this data to iteratively train and refine the traffic classifier. The classifier's performance is continuously improved through feedback from real-world traffic patterns, allowing it to distinguish legitimate traffic from attacks more accurately over time, thereby reducing false positives while maintaining high detection capability.
Solution Approach 2:
The system employs self-service through automated classifier training and deployment. The supervisory device automatically trains traffic classifiers using collected traffic data without requiring manual intervention. The system self-optimizes by continuously learning from new traffic patterns and automatically deploying updated classifiers to distributed learning agents, enabling the system to adapt and improve its detection accuracy autonomously.
2Measurement precision
If traffic classifiers are trained using centralized data collection, then training accuracy is improved, but network bandwidth consumption increases
Solution Approach 1:
The system segments the centralized data collection process into distributed components. Instead of collecting all traffic data at a single centralized location, the system distributes learning agents across multiple network nodes that independently collect and process local traffic data. This segmentation reduces the bandwidth burden on any single network link while maintaining comprehensive training data through aggregation of distributed observations.
Solution Approach 2:
The system transitions from a single-dimensional centralized collection model to a multi-dimensional distributed architecture. Traffic data is collected across multiple spatial dimensions (different network nodes) and temporal dimensions (continuous monitoring), then integrated through the supervisory device. This dimensional expansion allows the system to gather comprehensive training data without overloading any single network path, as data collection occurs parallelly across multiple dimensions.
3Measurement precision
If distributed learning agents are deployed throughout the network, then detection coverage is improved, but system complexity increases
Solution Approach 1:
The distributed learning agents are designed with multi-functionality to reduce overall system complexity. Each learning agent serves multiple purposes: it collects local traffic data, runs anomaly detection using the traffic classifier, generates security assessments, and provides training data back to the supervisory device. This universal design allows a single component to fulfill multiple functions, reducing the need for separate specialized components and simplifying the overall system architecture despite the distributed deployment.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A supervisory device in a network receives (810) traffic data from a security device that uses traffic signatures to assess traffic in the network. The supervisory device receives (815) traffic data from one or more distributed learning agents that use machine learning-based anomaly detection to assess traffic in the network. The supervisory device trains (820) a traffic classifier using the received traffic data from the security device and from the one or more distributed learning agents. The supervisory device deploys (825) the traffic classifier to a selected one of the one or more distributed learning agents.