Network Traffic Mirroring for Dynamic Anomaly Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network devices struggle to dynamically detect and mirror traffic associated with anomalous operations in user devices, leading to issues like packet loss and network delays, as current tools fail to initiate specific and timely traffic filtering and analysis.
Innovation Solution
Network devices equipped with a traffic analysis tool that maintains a mapping data structure (MDS) to identify atypical movement and packet-generation patterns, allowing for dynamic traffic filtering and selection of a target device for anomaly detection and analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network devices use existing anomaly detection tools, then they can detect network issues like packet loss and delays, but they fail to dynamically detect and mirror traffic associated with anomalous operations before issues occur
Solution Approach 1:
The system performs preliminary actions by maintaining a mapping data structure that pre-establishes filters and target devices before anomalies occur. When anomalous patterns are detected, the system immediately mirrors traffic to pre-configured target devices without delay, eliminating the time loss associated with real-time filter creation and target selection.
2Productivity
If network devices implement dynamic traffic filtering and mirroring, then they can proactively detect and analyze anomalous operations, but the system complexity increases due to mapping data structures and dynamic target selection
Solution Approach 1:
The system segments the traffic analysis function by creating a mapping data structure that associates anomaly patterns with specific filters and target devices. This segmentation allows the network device to maintain a simplified local mapping table rather than implementing complex real-time analysis logic, thereby reducing overall system complexity while improving productivity.
Solution Approach 2:
The mapping data structure serves as an intermediary between traffic monitoring and analysis functions. It pre-establishes the relationship between detected anomaly patterns, corresponding filters, and target devices, eliminating the need for complex real-time decision logic and reducing system complexity while maintaining high detection efficiency.
3Loss of information
If network devices mirror all traffic for analysis, then they ensure complete data availability, but the analysis load becomes overwhelming and packet loss increases
Solution Approach 1:
The system extracts only the necessary traffic data by using pre-defined filters that selectively mirror only the relevant portions of traffic associated with detected anomaly patterns. This extraction approach ensures complete information availability for analysis while minimizing the volume of mirrored traffic, thereby reducing packet loss and network delays caused by excessive data copying.
Data Source
AI summary
A network device is provided. During operation, the network device determines the device type of a respective user device associated with the network device. The network device monitors a movement pattern of the user device indicating the number of times the network device has learned its layer-2 address within a period. The network device also monitors a traffic pattern indicating the type and volume of traffic of the user device. The network device determines whether their combination matches an anomalous operation. If it matches, the network device selects a traffic filter mapped to the anomalous operation and applies the traffic filter to select a corresponding subset of traffic. The network device then selects, from a set of target devices, a target device based on a volume of the subset of the traffic and mirrors it to the target device, which can facilitate analysis of the subset of the traffic.