Efficient classification of network packets

• US 20050286522A1
• Filed: 06/21/2005
• Published: 12/29/2005
• Est. Priority Date: 06/23/2004
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Rose, Gregory Gordon, Paddon, Michael, Hawkes, Philip Michael
• Granted Patent: US 8,027,330 B2
• Time in Patent Office: Days
• US Class Current: 370/389
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Embodiments describe a system and/or method for efficient classification of network packets. According to an aspect a method includes describing a packet as a feature vector and mapping the feature vector to a feature space. The method can further include defining a feature prism, classifying the packet relative to the feature prism, and determining if the feature vector matches the feature prism. If the feature vector matches the feature prism the packet is passed to a data recipient, if not, the packet is blocked. Another embodiment is an apparatus that includes an identification component that defines at least one feature of a packet and a classification component that classifies the packet based at least in part upon the at least one defined feature.

Claims

1. A method of classifying a packet, comprising:

describing a packet as a feature vector; and

mapping the feature vector to a feature space.

2. The method of claim 1, further comprising:

defining a feature prism;

classifying the packet relative to the feature prism; and

determining if the feature vector matches the feature prism.

3. The method of claim 2, further comprising:

allowing the packet to be transmitted through a packet filter if the feature vector matches the feature prism.

4. The method of claim 2, further comprising:

blocking the packet with a packet filter if the feature vector does not match the feature prism.

5. The method of claim 2, a feature vector v of the packet matches a feature prism P if there exists a prism p that encloses vector v.

6. The method of claim 1, the feature vector is an n-dimensional feature vector.

7. The method of claim 1, the feature space is an n-dimensional feature space.

8. The method of claim 1, the feature vector comprises features represented by a number.

9. The method of claim 8, the features are represented by a number within a predetermined range.

10. The method of claim 8, the number is a generated number based on at least one feature of the packet.

11. The method of claim 1, describing the packet as a feature vector is described based on packet classification criteria.

12. An apparatus for classifying a packet, comprising:

an identification component that defines at least one feature of a packet; and

a classification component that classifies the packet based at least in part upon the at least one defined feature.

13. The apparatus of claim 12, the identification component defines the at least one feature of the packet as a number that is included within a predetermined range.

14. The apparatus of claim 12, further comprising:

a prognosis component that generates a stateful feature based, at least in part on, information from previous packets.

15. The apparatus of claim 12, further comprising:

a comparison component that applies matching techniques to facilitate categorizing the data access of the packet.

16. The apparatus of claim 12, the at least one feature is an included feature that is present in the packet.

17. The apparatus of claim 12, the at least one feature is a generated feature that is represented by an undefined value.

18. The apparatus of claim 17, the undefined value is an element of the feature'"'"'s range.

19. The apparatus of claim 12, the at least one feature is a stateful feature.

20. The apparatus of claim 12 is a mobile phone.

21. The apparatus of claim 12 is a personal data assistant.

22. The apparatus of claim 12 is a personal computer.

23. A system for classifying a data packet, comprising:

means for identifying a data packet as a feature vector; and

means for corresponding the feature vector to a feature space.

24. The system of claim 23, further comprising:

means for defining a feature prism;

means for categorizing the data packet in relation to the feature prism; and

means for matching the feature vector to the feature prism.

25. The system of claim 24, further comprising:

means for allowing the data packet to pass to a recipient if the feature vector matches the feature prism.

26. The system of claim 24, further comprising:

means for blocking the data packet from a recipient if the feature vector does not match the feature prism.

27. The system of claim 23, the feature vector comprises features representable by a number.

28. The system of claim 27, the features are representable by a number within a predetermined range.

29. The system of claim 27, the number is a generated number based on at least one feature of the packet.

30. The system of claim 23, the feature vector is an n-dimensional feature vector.

31. The system of claim 23, the feature space is an n-dimensional feature space.

32. A portable communication device comprising the system of claim 23.

33. A processor that executes instructions for applying packet matching, the instructions comprising:

constructing a spatial index;

inserting prisms into the spatial index; and

matching packets against prisms by performing point queries on the spatial index.