Time-Sliced Traffic Classification for Encrypted Short Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately classify encrypted network traffic, particularly for flows shorter than 15 seconds, leading to incomplete or incorrect classifications and high CPU/memory costs, which hampers timely traffic management actions.
Innovation Solution
A system and method utilizing time slices to classify network traffic, employing machine learning models that analyze traffic flow statistics at shorter intervals (1-5 seconds) and update models based on previous classifications to improve accuracy and reduce CPU/memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional traffic classification methods using byte patterns and flow correlation are used, then classification can be performed, but classification accuracy is insufficient for encrypted traffic and short flows (shorter than 15 seconds)
Solution Approach 1:
The patent segments the traffic classification process into multiple time slices (e.g., 1-5 seconds each) instead of requiring a single long observation period. This allows the system to classify traffic incrementally at each time slice, improving accuracy for short flows while maintaining reliability through cumulative classification attempts across multiple slices.
Solution Approach 2:
The patent performs preliminary classification actions at each time slice boundary before the full 15-second period elapses. By evaluating traffic patterns at intermediate points (1-5 seconds) and making classification decisions early when possible, the system improves accuracy for short flows while maintaining the option to reclassify if needed.
2Reliability
If traditional classification methods wait for complete flow data (15+ seconds) before classification, then classification reliability improves, but traffic management response time deteriorates
Solution Approach 1:
The patent divides the classification process into sequential time slices (e.g., 1-5 second intervals) rather than waiting for complete flow data. This segmentation enables early classification decisions to be made at each slice boundary, reducing response time while maintaining reliability through multiple classification opportunities across slices.
Solution Approach 2:
The patent performs preliminary classification evaluations at each time slice before the full observation period completes. This allows traffic management actions to be initiated earlier based on partial data, reducing loss of time while maintaining reliability through the ability to refine or correct classifications in subsequent slices.
3Reliability
If comprehensive traffic analysis is performed to ensure 100% traffic identification, then classification completeness improves, but CPU and memory costs increase
Solution Approach 1:
The patent segments the traffic analysis into incremental time slices, processing and evaluating traffic patterns at each slice boundary. This allows the system to classify traffic using progressively less data over time, reducing CPU and memory consumption compared to analyzing complete flows, while maintaining completeness through multiple classification attempts.
Solution Approach 2:
The patent applies partial classification actions at each time slice, performing analysis on only the portion of traffic available up to that point rather than waiting for complete flow data. This reduces computational resources required per classification attempt while maintaining overall completeness through cumulative classification across multiple slices.
Data Source
AI summary
A method for classifying a traffic flow including: determining a plurality of time slices to be used to classify the traffic flow; collecting traffic flow data for a first time slice of the plurality of time slices; if the flow is classifiable based on the first time slice, classifying the traffic flow; otherwise collecting the traffic flow data for each further time slice of the plurality of time slices to classify the traffic flow. A system for classifying a traffic flow having: a time interval module configured to determine a plurality of time slices to be used to classify the traffic flow; a data collection module configured to collect traffic flow data for each of the plurality of time slices; a classification module configured to determine whether the flow is classifiable based after each time slice, and classify the traffic flow.