Network Flow Classification via Tensor Decomposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In highly active networks like the Internet, it is challenging to identify and distinguish between different network flows, especially when observing from an outside perspective, as packets belonging to a specific flow can be difficult to identify due to variations in packet length, interpacket intervals, and reencoding processes.
Innovation Solution
The method involves collecting flow data attributes, composing a tensor, decomposing it into clusters, and comparing these clusters to signatures to classify flows using tensor decomposition, binning, clustering, landmark characterization, and distance metrics, without relying on traditional methods like Deep Packet Inspection (DPI).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional Deep Packet Inspection (DPI) methods are used to classify network flows, then flow identification accuracy may be improved, but device complexity and processing overhead increase significantly
Solution Approach 1:
The patent extracts only the essential flow attributes (packet length, interpacket intervals, protocol types) needed for classification, rather than performing full deep packet inspection. This selective extraction of critical features enables accurate flow identification while significantly reducing processing complexity and computational overhead.
Solution Approach 2:
The patent replaces traditional mechanical DPI inspection methods with a statistical tensor decomposition approach. By using tensor models to represent flow patterns and applying decomposition algorithms, the system achieves flow classification through mathematical computation rather than exhaustive packet inspection, reducing device complexity while maintaining accuracy.
2Measurement precision
If tensor decomposition with multiple dimensions is applied to classify flows, then classification accuracy is improved, but computational time increases
Solution Approach 1:
The patent segments the high-dimensional tensor decomposition problem into manageable components by organizing flow data into structured tensors with specific dimensions (packet length, interpacket intervals, protocol types). This segmentation allows the use of efficient decomposition algorithms that can process multi-dimensional data without excessive computational time, balancing accuracy with processing speed.
Solution Approach 2:
The patent transforms flow characteristics into tensor parameters and applies decomposition to extract meaningful patterns. By changing the representation parameters from raw packet data to tensor-based statistical features, the system achieves accurate classification while reducing computational complexity through dimensionality reduction and pattern recognition.
3Speed
If flow data is collected and processed in real-time, then responsiveness is improved, but processing overhead and resource consumption increase
Solution Approach 1:
The patent extracts only the most discriminative flow attributes (packet length distributions, interpacket interval patterns, protocol types) necessary for classification, ignoring redundant data. This selective extraction enables real-time processing with reduced resource consumption, as the system processes only essential features rather than complete packet payloads.
Solution Approach 2:
The tensor decomposition model is trained offline on historical flow data, creating a self-service classification system. Once trained, the model can rapidly classify new flows in real-time using pre-computed decomposition patterns, minimizing online computational overhead and resource consumption while maintaining high processing speed.
Data Source
AI summary
According to at least one aspect of the present disclosure a method for classifying flows on a network is provided. The method comprises determining a signature of a service's flows, collecting flow data having one or more attributes, responsive to collecting flow data, associating one or more ranges of the flow data with a value, responsive to associating the one or more ranges of the flow data with a value, composing a tensor having a dimensionality of one or more, responsive to composing the tensor, decomposing the tensor into one or more clusters, and responsive to decomposing the tensor into one or more clusters and determining the signature, comparing the signature to the one or more clusters and classifying one or more of the one or more clusters based on the signature.