Network Traffic Classification Model for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cable networks face challenges in detecting and mitigating anomalous network traffic, particularly from infected IoT devices that can generate malicious traffic, leading to issues like denial of service attacks, data exfiltration, and customer dissatisfaction, due to the lack of effective classification and mitigation mechanisms.
Innovation Solution
A method involving a processor-based system that obtains network traffic information, generates a classification model to differentiate between normal and anomalous traffic, and initiates mitigation actions for identified anomalous traffic, using machine learning and deep packet inspection to reduce the processing load and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to detect all malicious traffic, then detection accuracy is improved, but processing load and system complexity increase significantly
Solution Approach 1:
The patent segments traffic detection into two stages: first, a classification model performs lightweight classification of traffic as normal or anomalous based on flow information; second, deep packet inspection is applied only to the small subset of traffic classified as anomalous. This segmentation reduces the processing load on deep packet inspection while maintaining high detection accuracy for malicious traffic.
2Ease of manufacture
If traditional signature-based detection is used, then implementation is simple, but it cannot detect new or unknown malicious traffic patterns
Solution Approach 1:
The patent transitions from signature-based detection to behavior-based detection by changing the detection parameters from static malicious signatures to dynamic traffic flow characteristics. The classification model analyzes parameters such as traffic volume, packet rates, and flow patterns to identify anomalous behavior, enabling detection of new and unknown malicious traffic while maintaining adaptability.
3Reliability
If all network traffic is inspected, then security coverage is improved, but false positives and processing overhead increase
Solution Approach 1:
The patent applies preliminary classification to all network traffic before deep packet inspection. The classification model quickly identifies and filters normal traffic, allowing only potentially malicious traffic to proceed to deep inspection. This preliminary action reduces processing overhead and false positives while maintaining comprehensive security coverage for anomalous traffic.
Data Source
AI summary
Methods, systems, and apparatus for detecting and mitigating anomalous network traffic. With at least one processor in a network, information regarding network traffic flows is obtained and a classification model is generated based on the obtained information, the classification model comprising one or more classification rules for classifying network traffic as normal or anomalous. With the at least one processor in the network, the network traffic is classified as anomalous or normal based on the generated classification model and at least one mitigation action is initiated based on the network traffic being classified as anomalous.