Transaction-Based Network Signatures for Text Protocol Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network traffic classification methods, such as port-based approaches, are inaccurate due to the evolution of applications using ephemeral or well-known ports, and payload-based methods are impractical for scalability and manual effort requirements, especially with encrypted applications.
Innovation Solution
A system and method for developing accurate payload content-based signatures without manual intervention, using longest common substrings and ordering in flow payloads to create transaction-based network application signatures, decoupling real-time classification from offline signature generation, and applying these signatures to identify text-based protocols in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If port-based classification is used, then implementation simplicity is maintained, but classification accuracy deteriorates due to applications using ephemeral or well-known ports
Solution Approach 1:
The patent segments the payload content into multiple cells, where each cell represents a portion of the payload. This segmentation allows the system to analyze different parts of the payload independently and combine results, improving classification accuracy while maintaining a structured approach that doesn't overly complicate implementation.
Solution Approach 2:
The patent performs preliminary action by pre-defining cells and their positions in the payload before classification. The cell structure is established in advance, with each cell representing a specific portion of the payload that can be independently analyzed. This preparation work is done offline, so it doesn't add complexity to real-time classification.
2Measurement precision
If payload-based signature generation is performed manually, then signature accuracy is improved, but scalability deteriorates due to manual effort requirements
Solution Approach 1:
The patent implements self-service by enabling the system to automatically generate its own signatures without manual intervention. The signature generation process is automated through algorithms that analyze payload patterns, extract characteristic cells, and create signatures autonomously. This allows the system to scale to new applications automatically as they appear on the network.
Solution Approach 2:
The patent uses parameter changes by adjusting signature matching thresholds and cell selection criteria to optimize classification performance. The system can dynamically modify parameters such as the number of cells to analyze, the similarity threshold for matching, and the weight given to different payload portions, allowing accurate signature generation without manual tuning for each application.
3Speed
If real-time classification is performed without pre-generated signatures, then responsiveness is improved, but accuracy deteriorates
Solution Approach 1:
The patent performs preliminary action by generating signatures and cell structures in advance during an offline training phase. These pre-generated signatures are stored and ready for use during real-time classification. The computationally intensive work of analyzing payload patterns and creating signatures is done beforehand, so real-time classification only needs to perform simple matching operations, maintaining both speed and accuracy.
Solution Approach 2:
The patent segments the classification process into offline signature generation and online real-time matching. The offline phase creates preprocessed signature data structures that are optimized for fast matching. During real-time classification, the system only needs to compare incoming traffic against these pre-generated signatures, which maintains accuracy while ensuring fast responsiveness.
4Adaptability or versatility
If encrypted application traffic is analyzed, then classification coverage is improved, but complexity increases due to decryption requirements
Solution Approach 1:
The patent extracts only the necessary portions of encrypted traffic for analysis - specifically, it extracts payload content cells that can be analyzed without full decryption. The system takes out and analyzes only the portions of encrypted traffic that contain identifiable patterns, avoiding the need to decrypt entire data streams. This maintains classification coverage for encrypted applications while limiting complexity to only what is absolutely necessary.
Data Source
AI summary
A method for profiling network traffic of a network. The method includes extracting cells from bi-directional payloads generated by a network application, wherein each cell comprises at least one direction reversal in a corresponding bi-directional flow, generating a cell group comprising a portion of the cells that are similar, analyzing the cell group to generate a signature of the network application, and classifying, based on the signature of the network application, a new bi-directional flow as being generated by the network application.