Traffic Similarity Matching via Weighted Harmonic Averaging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current deep packet inspection (DPI) technologies face inefficiencies and low accuracy in analyzing and identifying unknown traffic, especially with the rise of intelligent terminals and applications that evade inspection by changing traffic features, leading to challenges in bandwidth management and service charging.
Innovation Solution
A similarity matching method that calculates similarities between unknown traffic and sampled traffic using multiple dimensions, including packet and session characteristics, and performs weighted harmonic averaging to determine matching similarities, improving identification accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual analysis is used to identify unknown traffic, then flexibility in handling new applications is improved, but analysis efficiency and response speed deteriorate
Solution Approach 1:
The patent segments traffic analysis into multiple independent dimensions (packet length, payload content, port number, transmission rate, packet quantity, traffic volume). Each dimension is analyzed separately and then combined through weighted harmonic averaging, allowing automated processing while maintaining comprehensive analysis capability for new applications.
Solution Approach 2:
The patent transitions from traditional single-dimension DPI to multi-dimensional analysis by introducing N dimensions (n1 packet dimensions + n2 session dimensions). This dimensional expansion enables automated systems to capture complex traffic patterns of new applications while maintaining high analysis efficiency through parallel processing of multiple dimensions.
2Reliability
If traditional DPI technology is used for traffic identification, then inspection capability is improved, but accuracy in identifying evasive applications deteriorates
Solution Approach 1:
The patent merges traditional DPI inspection capability with multi-dimensional similarity matching. By combining the reliability of DPI with the precision of multi-dimensional analysis across packet and session dimensions, the system achieves both strong inspection capability and high identification accuracy for evasive applications.
Solution Approach 2:
The patent creates a composite analysis approach that combines traditional DPI methods with multi-dimensional traffic feature analysis. This composite methodology integrates the strengths of both approaches: DPI's reliable protocol inspection and multi-dimensional analysis's precision in detecting subtle traffic pattern variations used by evasive applications.
3Device complexity
If single-dimension matching is used for traffic analysis, then system complexity is reduced, but analysis accuracy deteriorates
Solution Approach 1:
The patent explicitly addresses this contradiction by moving from single-dimension to multi-dimensional analysis (N dimensions where N≥2). The weighted harmonic averaging method efficiently combines multiple dimensions without creating excessive complexity, achieving high analysis accuracy while maintaining manageable system complexity through standardized processing procedures.
Data Source
Figure 1
Figure 2-a~2-b
Figure 2-c~2-d
AI summary
Embodiments of the present invention disclose a similarity matching method and a related device and a communication system. The similarity matching method may include: obtaining unknown traffic; and separately calculating similarities between the unknown traffic and sampled traffic according to N dimensions; and performing weighted harmonic averaging for calculated similarities that are corresponding to the dimensions, to obtain a matching similarity between the unknown traffic and the sampled traffic, where, N is an integer greater than or equal to 2, and the N dimensions include N dimensions of the following dimensions: n1 dimensions related to a packet of the traffic, n2 dimensions related to a session corresponding to the traffic, and n3 dimensions related to the traffic itself, where n1, n2, and n3 are positive integers. With the technical solutions of the present invention. The technical solutions of the embodiments of the present invention help to improve efficiency and accuracy of traffic analysis.