Lightweight Application Classification for Network Management

• US 20100014420A1
• Filed: 07/21/2008
• Published: 01/21/2010
• Est. Priority Date: 07/21/2008
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Ge, Zihui, Jiang, Hongbo, Jin, Shudong, Moore, Andrew W., Wang, Jia
• Granted Patent: US 8,095,635 B2
• Time in Patent Office: Days
• US Class Current: 370/229
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

Managing network traffic to improve availability of network services by classifying network traffic flows using flow-level statistical information and machine learning estimation, based on a measurement of at least one of relevance and goodness of network features. Also, determining a network traffic profile representing applications associated with the classified network traffic flows, and managing network traffic using the network traffic profile. The flow-level statistical information includes packet-trace information and is available from at least one of Cisco NetFlow, NetStream or cflowd records. The classification of network flows includes tagging packet-trace flow record data based on defined packet content information. The classifying of network flows can result in the identification of a plurality of clusters based on the measurement of the relevance of the network features. Also, the classification of network traffic can use a correlation-based measure to determine the goodness of the network features.

Claims

1. A method of managing network traffic to improve availability of network services comprising:

classifying network traffic flows using flow-level statistical information and a machine learning estimation, the network traffic flow classification based on a measurement of at least one of a relevance and a goodness of network features;

determining a network traffic profile representing applications associated with the classified network traffic flows; and

managing network traffic using the network traffic profile.

2. The method of claim 1, wherein the flow-level statistical information includes packet-trace information and is available from at least one of Cisco NetFlow, NetStream or cflowd records.

3. The method of claim 1, wherein the classifying of network flows further comprises tagging packet-trace flow record data based on defined packet content information.

4. The method of claim 1, wherein the classifying of network flows results in the identification of a plurality of clusters based on the measurement of the relevance of the network features, wherein the measurement is calculated in accordance with:

$U<br><br>\left(A_i,C\right)=2<br><br>\frac{H<br><br>\left(A_i\right)+H<br><br>\left(C\right)-H<br><br>\left(A_i,C\right)}{H<br><br>\left(A_i\right)+H<br><br>\left(C\right)}$

wherein H(·

) is the entropy function and C is the flow class.

5. The method of claim 1, further comprising:

classifying network traffic using a correlation-based measure to determine the goodness of the network features, wherein the correlation-based measurement is calculated in accordance with;

$\underset{A_j\in <br><br>S}{\sum <br><br>}<br><br>U<br><br>\left(A_j,C\right)/\sqrt{\underset{A_i\in <br><br>S}{\sum <br><br>}<br><br>\underset{A_j\in <br><br>S}{\sum <br><br>}<br><br>U<br><br>\left(A_i,A_j\right)}$

6. The method of claim 5, wherein the classification of network flows compares at least two of the baseline feature set, the entire feature set, the entire feature set excluding srcIP/dstIP, the entire feature set excluding srcIP/dstIP, sTime, eTime and tcpFlag;

and the feature set derived from the algorithm.

7. The method of claim 5, wherein the feature set derived from the algorithm includes at least low-port, tos and tcpFlag features.

8. A computer-readable medium comprising instructions,

wherein execution of the instructions by at least one computing device manages network traffic to improve availability of network services by:

classifying network traffic flows using flow-level statistical information and a machine learning estimation, the network traffic flow classification based on a measurement of at least one of a relevance and a goodness of network features;

determining a network traffic profile representing applications associated with the classified network traffic flows; and

managing network traffic using the network traffic profile.

9. The computer-readable medium comprising instructions defined by claim 8, wherein the flow-level statistical information includes packet-trace information and is available from at least one of Cisco NetFlow, NetStream or cflowd records.

10. The computer-readable medium comprising instructions defined by claim 8, wherein the classifying of network flows further comprises tagging packet-trace flow record data based on defined packet content information.

11. The computer-readable medium comprising instructions defined by claim 8, wherein the classifying of network flows results in the identification of a plurality of clusters based on the measurement of the relevance of a the network features, wherein the measurement is calculated in accordance with:

$U<br><br>\left(A_i,C\right)=2<br><br>\frac{H<br><br>\left(A_i\right)+H<br><br>\left(C\right)-H<br><br>\left(A_i,C\right)}{H<br><br>\left(A_i\right)+H<br><br>\left(C\right)}$

wherein (H·

) is the entropy function and C is the flow class.

12. The computer-readable medium comprising instructions defined by claim 8, wherein execution of the instructions by at least one computing device further manages network traffic to improve availability of network services by:

classifying network traffic using a correlation-based measure to determine the goodness of the network features, wherein the correlation-based measurement is calculated in accordance with;

$\underset{A_j\in <br><br>S}{\sum <br><br>}<br><br>U<br><br>\left(A_j,C\right)/\sqrt{\underset{A_i\in <br><br>S}{\sum <br><br>}<br><br>\underset{A_j\in <br><br>S}{\sum <br><br>}<br><br>U<br><br>\left(A_i,A_j\right)}$

13. The computer-readable medium comprising instructions defined by claim 12, wherein the classification of network flows compares at least two of the baseline feature set, the entire feature set, the entire feature set excluding srcIP/dstIP, the entire feature set excluding srcIP/dstIP, sTime, eTime and tcpFlage;

and the feature set derived from the algorithm.

14. The computer-readable medium comprising instructions defined by claim 12, wherein the feature set derived from the algorithm includes at least low-port, tos and tcpFlag features.

15. A system for managing network traffic to improve availability of network services, the system comprising:

a network router for collecting network traffic flow information; and

a data measurement device coupled to the network router, the data measurement device classifying network traffic flows using flow-level statistical information and a machine learning estimation, the network traffic flow classification based on a measurement of at least one of a relevance and a goodness of network features;

determining a network traffic profile representing applications associated with the classified network traffic flows; and

managing network traffic using the network traffic profile.

16. The system as defined by claim 15, wherein the flow-level statistical information includes packet-trace information and is available from at least one of Cisco NetFlow, NetStream or cflowd records.

17. The system as defined by claim 15, wherein the classifying of network flows further comprises tagging packet-trace flow record data based on defined packet content information.

18. The system as defined by claim 15, wherein the classifying of network flows results in the identification of a plurality of clusters based on the measurement of the relevance of the network features, wherein the measurement is calculated in accordance with:

$U<br><br>\left(A_i,C\right)=2<br><br>\frac{H<br><br>\left(A_i\right)+H<br><br>\left(C\right)-H<br><br>\left(A_i,C\right)}{H<br><br>\left(A_i\right)+H<br><br>\left(C\right)}$

wherein H(·

) is the entropy function and C is the flow class.

19. The system as defined by claim 15, wherein the data measurement device further classifying network traffic using a correlation-based measure to determine the goodness of the network features, wherein the correlation-based measurement is calculated in accordance with:

$\underset{A_j\in <br><br>S}{\sum <br><br>}<br><br>U<br><br>\left(A_j,C\right)/\sqrt{\underset{A_i\in <br><br>S}{\sum <br><br>}<br><br>\underset{A_j\in <br><br>S}{\sum <br><br>}<br><br>U<br><br>\left(A_i,A_j\right)}$

20. The system as defined by claim 19, wherein the classification of network flows compares at least two of the baseline feature set, the entire feature set, the entire feature set excluding srcIP/dstIP, the entire feature set excluding srcIP/dstIP, sTime, eTime and tcpFlage;

and the feature set derived from the algorithm.