Transport Protocol Analysis for Encrypted Network Traffic Characterization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for network traffic characterization and classification, especially in encrypted environments, are resource-intensive and costly, and struggle to accurately identify applications due to the limitations of deep-packet inspection techniques and the increasing use of encryption.
Innovation Solution
The implementation of a network architecture that collects and classifies transport protocol state information for connection-oriented transport protocols, using techniques such as TCP segment analysis and proxy-based spoofing to identify and classify connections, enabling effective classification even in encrypted environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep-packet inspection techniques are used to identify applications, then application characterization accuracy is improved, but computational resource demands and costs increase significantly
Solution Approach 1:
The patent extracts only the essential transport protocol state information (sequence numbers, acknowledgment numbers, timestamps, window sizes) from TCP segments, rather than performing full deep-packet inspection of application layer content. This extraction approach maintains characterization accuracy while significantly reducing computational resource consumption by focusing only on the minimal necessary data elements.
Solution Approach 2:
The patent segments the traffic analysis process into distinct phases: collecting transport protocol state information from TCP segments, processing this information through machine learning classifiers, and generating application characterizations. This segmentation allows each component to be optimized independently, reducing overall computational burden while maintaining accuracy.
2Measurement precision
If deep-packet inspection is used to read higher layer protocol headers or packet payload, then application identification accuracy is improved, but the technique becomes ineffective in encrypted environments
Solution Approach 1:
The patent uses transport protocol state information as an intermediary that bridges the gap between encrypted application data and application identification. By analyzing TCP segment metadata (sequence numbers, acknowledgments, timestamps, window sizes) that remains visible even when application payload is encrypted, the system achieves application characterization without needing to decrypt the actual content.
Solution Approach 2:
The patent shifts the analysis from the application layer content dimension to the transport layer metadata dimension. Instead of examining encrypted application data directly, the system analyzes transport protocol state information from a different dimensional space where the data remains unencrypted and analyzable, yet still contains sufficient patterns for accurate application identification.
3Use of energy by moving object
If machine-learning tools with flow-statistics are used to classify connections, then computational resource demands are reduced, but classification accuracy decreases compared to DPI techniques
Solution Approach 1:
The patent changes the parameters fed into machine-learning classifiers from traditional flow statistics (connection duration, bytes transferred) to transport protocol state information (sequence number patterns, acknowledgment patterns, timestamp intervals, window size variations). This parameter transformation enables machine-learning models to achieve higher classification accuracy while maintaining low computational resource requirements.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Characterizing transport protocol connections and controlling behavior of a communication network based on the characterizations, including obtaining transport protocol state information for transport protocol packets on a transport protocol connection; identifying request/response periods for the transport protocol connection based on the transport protocol state information, the identifying including identifying a beginning of a first request/response period based on the transport protocol state information for a first forward packet, and identifying an end of the first request/response period and a beginning of a second request/response period based on the transport protocol state information for a second forward packet; associating an application type with a server endpoint based on the identified request/response periods; and controlling behavior of the communication network based on the application type.