Time-Sliced Traffic Detection for Encrypted Flow Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately classify encrypted network traffic, particularly for applications beyond the top 25, due to the reliance on byte patterns and flow correlation, leading to incomplete classification and increased CPU/memory costs.
Innovation Solution
A system and method utilizing time slicing to collect and analyze network traffic data in short intervals, employing machine learning models to classify traffic flows, updating models based on previous slices, and providing confidence levels for classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional byte pattern and flow correlation methods are used to classify network traffic, then classification can be performed with simple techniques, but classification accuracy is insufficient especially for encrypted traffic and applications beyond top 25
Solution Approach 1:
The patent segments the traffic classification process into multiple time slices (e.g., first time slice, second time slice, third time slice) where different analysis techniques are applied at different stages. Early time slices use lightweight flow correlation, while later time slices apply more complex machine learning models, achieving high accuracy without requiring all techniques to run simultaneously.
Solution Approach 2:
The patent performs preliminary classification actions in early time slices using simpler methods (byte pattern matching, flow correlation) before applying more complex machine learning techniques. This preliminary action filters out easily classifiable traffic, reducing the burden on subsequent complex analysis stages.
2Measurement precision
If comprehensive traffic analysis is performed to classify 100% of network traffic, then complete traffic identification is achieved, but CPU and memory costs increase significantly
Solution Approach 1:
The patent applies partial action by performing comprehensive machine learning-based analysis only when necessary (when flow correlation and byte pattern matching fail to classify traffic). For easily classifiable traffic, simpler methods suffice, reducing overall computational overhead while maintaining complete coverage when needed.
Solution Approach 2:
The classification process is segmented into multiple time slices with increasing analysis depth. Early slices use resource-efficient methods, and only traffic that remains unclassified progresses to more resource-intensive later slices, optimizing the balance between completeness and resource consumption.
3Measurement precision
If traffic classification is delayed to gather more data, then classification accuracy improves, but response time for traffic management actions decreases
Solution Approach 1:
The patent performs preliminary classification in early time slices using available data, enabling timely traffic management actions. The system is designed to act on partial classification results rather than waiting for complete analysis, achieving both speed and accuracy through staged processing.
Solution Approach 2:
The classification system dynamically adapts its analysis depth and timing based on traffic characteristics. For time-sensitive traffic, earlier classification with sufficient accuracy is performed; for less time-critical traffic, more comprehensive analysis is applied, optimizing the trade-off between accuracy and response time.
Data Source
AI summary
A method for classifying a traffic flow including; determining a plurality of time slices to be used to classify the traffic flow; collecting traffic flow data for a first time slice of the plurality of time slices; if the flow is classifiable based on the first time slice, classifying the traffic flow; otherwise collecting the traffic flow data for each further time slice of the plurality of time slices to classify the traffic flow. A system for classifying a traffic flow having: a time interval module configured to determine a plurality of time slices to be used to classify the traffic flow; a data collection module configured to collect traffic flow data for each of the plurality of time slices; a classification module configured to determine whether the flow is classifiable based after each time slice, and classify the traffic flow.