Statistical, Signature-Based Approach to IP Traffic Classification

• US 20100085889A1
• Filed: 12/10/2009
• Published: 04/08/2010
• Est. Priority Date: 01/23/2004
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Spatscheck, Oliver, Sen, Subhabrata, Roughan, Matthew, Duffield, Nicholas G.
• Granted Patent: US 8,031,599 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service

Abstract

A signature-based traffic classification method maps traffic into preselected classes of service (CoS). By analyzing a known corpus of data that clearly belongs to identified ones of the preselected classes of service, in a training session the method develops statistics about a chosen set of traffic features. In an analysis session, relative to traffic of the network where QoS treatments are desired (target network), the method obtains statistical information relative to the same chosen set of features for values of one or more predetermined traffic attributes that are associated with connections that are analyzed in the analysis session, yielding a statistical features signature of each of the values of the one ore more attributes. A classification process then establishes a mapping between values of the one or more predetermined traffic attributes and the preselected classes of service, leading to the establishment of QoS treatment rules.

Claims

1. A method for assigning packets belonging to traffic of a network to one of preselected classes of service, comprising the steps of

in a training session

observing a corpus of traffic data that are known to belong to specific ones of said classes of service;

performing statistical analysis of the observed corpus of traffic data, relative to preselected traffic attributes,

creating a set of rules, that map traffic to said specific classes of service based on values of said preselected traffic attributes in said traffic.

following said training session

receiving a packet that belongs to a flow of a connection, and

assigning the packet to one of said classes of service, in accordance with said set of f rules, based on one or more of said preselected traffic attributes that pertain to said packet.

2. The method of claim 1 where said preselected traffic attributes pertain to packet-level features, taken from a class that includes size and moments of said size.

3. The method of claim 1 where said preselected traffic attributes includes root mean square of packets'"'"' size.

4. The method of claim 1 where said preselected traffic attributes pertain to flow-level attribute, where a flow is a unidirectional sequence of packets that have some filed value in common.

5. The method of claim 4 where said flow-level attributes are taken from a set that includes flow duration, data volume, number of packets, and moments of said flow duration, data volume and number of packets.

6. The method of claim 5 where one moment of an attribute is root mean square of said attribute and another moment of an attribute is variance of said attribute.

7. The method of claim 1 where said step of performing statistical analysis, comprises forming a vector of statistics, S^C(i), is formed for each connection i, where the elements of the vector are said preselected traffic features, and executing the following pseudocode.

8. The method of claim 1 where said preselected traffic attributes pertain to connection-level attributes.

9. The method of claim 8 where said connection level attributes are taken from a set that includes amount of symmetry of a connection, advertised window sizes, and throughput distribution.

10. The method of claim 1 where said preselected traffic attributes pertain to statistics about packets within a flow, and moments.

11. The method of claim 10 where said statistics about packets within a flow includes statistics of inter-arrival times between packets in said flow.

12. The method of claim 1 where said preselected traffic attributes pertain to multi-flow attributes.