Network Traffic Trust Scoring for Encrypted Fraud Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing encryption of network traffic makes it difficult for network operators to accurately identify and classify traffic types, leading to potential revenue loss and inability to make informed network upgrade decisions, as well as enabling subscribers to fraudulently exploit promotional rates or bypass regulations.
Innovation Solution
A system and method that utilizes a data processing engine to analyze traffic flows using deep packet inspection, DNS data, CDN information, and machine learning to determine a trust score, aggregating multiple data points to identify fraudulent traffic by comparing against stored information and applying appropriate actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to secure network traffic, then security and privacy are improved, but traffic identification and classification become more difficult
Solution Approach 1:
The system segments traffic analysis into multiple independent data sources (DNS data, CDN information, packet data, profile information) and evaluates each separately before aggregating results. This allows deep packet inspection of encrypted traffic without requiring decryption, maintaining security while improving identification accuracy through multi-source validation.
Solution Approach 2:
The system merges multiple data sources (DNS data, CDN information, packet data, profile information) to create a comprehensive trust score. By combining these sources, the system overcomes the limitations of any single source when dealing with encrypted traffic, achieving accurate traffic classification without compromising security.
2Reliability
If multiple data sources are collected and analyzed to improve traffic classification accuracy, then detection reliability is improved, but system complexity increases
Solution Approach 1:
The system uses a universal data collection module that handles multiple data types (DNS data, CDN information, packet data, profile information) through a single unified process. The same data collection framework processes all data sources and feeds them into the scoring mechanism, reducing operational complexity while maintaining comprehensive analysis capabilities.
Solution Approach 2:
The system incorporates feedback mechanisms where determined data and scores are compared against previously stored information and CDN information. This feedback loop allows the system to learn from historical data and improve future classifications, reducing the need for complex real-time analysis and lowering operational complexity.
3Reliability
If deep packet inspection and multiple data sources are used to detect fraudulent traffic, then detection capability is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by collecting and storing CDN information and profile data in advance. This pre-processing allows the main traffic analysis to focus only on comparing current traffic against pre-fetched reference data, significantly reducing real-time processing time while maintaining high detection accuracy through comprehensive data comparison.
Data Source
AI summary
A method for detecting fraudulent traffic in a computer network including: receiving a packet from a traffic flow; determining data associated with the traffic flow; determining a score associated with each piece of determined data; aggregating an overall score for the traffic flow; and determining whether the traffic flow is trusted based on the overall score. A system for detecting fraudulent traffic in a computer network including: a data processing engine configured to receive a packet from a traffic flow; a data collection module configured to determine data associated with the traffic flow; a data correlation module configured to determining a score associated with each piece of determined data and aggregating an overall score for the traffic flow; and a traffic classification module configured to determine whether the traffic flow is trusted based on the overall score.