Network Traffic Application Identification Without Deep Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current traffic monitoring and management systems, relying on Deep Packet Inspection (DPI), face challenges in identifying applications due to encrypted packets, delayed identification, and high bandwidth consumption by protocols like peer-to-peer, making it impractical to rely solely on DPI for traffic recognition.
Innovation Solution
A method that analyzes network traffic by creating access records associating domains and remote hosts with applications, allowing identification of applications without requiring DPI or decryption, using port mappings and DNS analysis to infer applications from fewer than tens of packets, even in encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Deep Packet Inspection (DPI) is used to identify applications by analyzing traffic content, then application identification accuracy is improved, but the system cannot identify encrypted traffic and requires tens of packets before identification
Solution Approach 1:
The system performs preliminary actions by analyzing DNS queries and port mappings before actual traffic content inspection is needed. By establishing application identity early through metadata analysis (DNS lookups, port associations) rather than waiting to inspect packet content, the system identifies applications in the first few packets instead of requiring tens of packets, thus reducing identification time while maintaining accuracy
Solution Approach 2:
The invention extracts and analyzes specific metadata elements (DNS query results, port mappings, URL patterns) from traffic flows separately from the main encrypted content. By taking out these identifiable features for analysis independent of packet content inspection, the system can identify applications even when the bulk traffic is encrypted, achieving both accuracy and speed
2Measurement precision
If Deep Packet Inspection (DPI) is used to analyze traffic content, then application recognition capability is improved, but the system cannot interpret encrypted packets
Solution Approach 1:
The system introduces intermediary analysis methods (DNS query analysis, port mapping lookup, metadata inspection) that act as mediators between the traffic flow and application identification. These intermediaries provide application identity information without requiring direct inspection of encrypted packet content, enabling the system to recognize applications in both encrypted and unencrypted traffic with equal capability
Solution Approach 2:
The invention substitutes the mechanical DPI approach (direct packet content inspection) with alternative identification mechanisms based on network layer metadata analysis. By replacing content-based inspection with metadata-based identification (DNS, ports, URLs), the system achieves application recognition capability that works universally across both encrypted and unencrypted traffic types
3Measurement precision
If DPI is used to identify all traffic applications, then comprehensive traffic recognition is improved, but the system requires extensive packet analysis which is impractical for high bandwidth applications
Solution Approach 1:
The system performs preliminary identification using DNS and port metadata before extensive packet analysis would be required. By establishing application identity early through efficient metadata lookup, the system achieves comprehensive traffic recognition without the need to analyze tens of packets for each flow, thus maintaining productivity even for high bandwidth applications
Solution Approach 2:
The invention applies partial action by analyzing only the necessary metadata elements (DNS queries, port mappings) rather than performing excessive full-content inspection of all packets. This selective approach achieves complete traffic recognition for management purposes without the computational overhead of analyzing every packet in high bandwidth flows, thereby maintaining system productivity
Data Source
AI summary
A system monitors first traffic and identifies associations between applications that generated or received the traffic and parameters such as domain names, a remote host, and a local host referenced in the traffic. Subsequent traffic is monitored and determined to be generated by or addressed to an application according to such parameters in the subsequent traffic, such as remote host, local host, domain name, or port number. The subsequent traffic is associated with an application without requiring deep packet inspection (DPI). In particular, an application may be associated with a session based on evaluation of a single packet of the session.