Traffic Classification via Packet Size Statistics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for classifying traffic, such as port number-based and payload content-based methods, face challenges in accurately identifying applications, especially with new P2P applications using random port numbers and encrypted data, which complicates scalability and resource allocation.
Innovation Solution
A method and apparatus that classify traffic by analyzing packet size characteristics, including smallest, biggest, and average packet sizes, as well as packet size distributions, to identify applications using correlation coefficients, allowing for accurate classification with limited data and reduced complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If port number based method is used for traffic classification, then the classification process is simple and fast, but the accuracy deteriorates when applications use random port numbers
Solution Approach 1:
The patent changes the classification parameter from port number to packet size characteristics. Instead of relying on static port numbers, the system analyzes dynamic packet size patterns including smallest packet size, biggest packet size, average packet size, and mode set of packet sizes. This parameter transformation maintains classification speed while improving accuracy for applications using random port numbers.
2Measurement precision
If payload content based method is used for traffic classification, then the application identification accuracy is improved, but the device complexity and storage requirements increase significantly
Solution Approach 1:
The patent extracts only the necessary packet size characteristics from the payload content without examining the actual content data. By taking out just the packet size metadata (smallest, biggest, average, and mode set) rather than analyzing the entire payload, the system achieves accurate application identification while avoiding the high storage and processing complexity of content-based methods.
Solution Approach 2:
Instead of analyzing payload content to identify applications, the patent inverts the approach by using packet size characteristics as the primary identification feature. This inversion allows accurate classification without the complexity of content analysis, as packet size patterns are inherently tied to application behavior but require minimal processing to extract.
3Measurement precision
If payload content based method is used for traffic classification, then accurate identification is achieved, but scalability deteriorates when signatures are unavailable or data is encrypted
Solution Approach 1:
The patent enables the system to self-adapt to different applications by automatically learning and extracting packet size characteristics without requiring pre-configured signatures. The mode set of packet sizes is dynamically determined from observed traffic, allowing the system to identify new applications including encrypted and game services without manual signature updates, thereby improving scalability.
Data Source
AI summary
Provided is a method and apparatus for classifying applications in traffic easily and accurately by utilizing only statistical data of traffic at transport layer. A method of the present invention includes determining candidate applications by comparing at least one of smallest packet size, biggest packet size and average packet size of collected packets for a flow with corresponding reference data of potential applications; and comparing mode set of packet size for the collected packets with corresponding reference data of the candidate applications to identify the flow as an application which has identical elements in the same order, the number of the identical elements being equal to or more than a predetermined number.