Methods, Systems and Computer Program Products for Identifying Traffic on the Internet Using Communities of Interest

• US 20110219445A1
• Filed: 03/03/2010
• Published: 09/08/2011
• Est. Priority Date: 03/03/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Kalafut, Andrew, Gupta, Minaxi, Van Der Merwe, Jacobus
• Granted Patent: US 8,554,948 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]

Abstract

Methods for identifying wanted traffic on the Internet are provided. The methods include determining a traffic history for a user of the Internet; identifying wanted traffic in a stream of Internet traffic based on the determined traffic history; and prioritizing the identified wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic. Related systems and computer program products are also provided.

Claims

1. A method for identifying wanted traffic on the Internet, comprising:

determining a traffic history for a user of the Internet;

identifying wanted traffic in a stream of Internet traffic based on the determined traffic history; and

prioritizing the identified wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic.

2. The method of claim 1, wherein determining a traffic history comprises:

obtaining historical information from an internet service provider (ISP) about the user; and

constructing a community of interest (COI) for the user from the obtained historical information about the user.

3. The method of claim 2, wherein the historical information obtained from the ISP comprises Netflow data.

4. The method of claim 2, wherein constructing a community of interest comprises:

defining at least one heuristic;

determining flows in the stream of internet traffic that represent wanted traffic using the at least one defined heuristic; and

modifying the COI for the user to include the endpoints of the flows determined to include wanted traffic.

5. The method of claim 4, wherein the defined at least one heuristic comprises a low port number heuristic, a low packet count heuristic, a reverse flow seen heuristic, a recent history heuristic, a non-recent history heuristic and/or no heuristic.

6. The method of claim 5, wherein the defined at least one heuristic is a combination of at least two heuristics.

7. The method of claim 4, wherein the stream of Internet traffic comprises sampled Netflow data and/or unsampled data.

8. A data processing system for identifying wanted traffic on the Internet, comprising:

a history module configured to determine a traffic history for a user of the Internet;

an identification module configured to identify wanted traffic in a stream of Internet traffic based on the determined traffic history; and

a prioritization module configured to prioritize the identified wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic.

9. The system of claim 8, wherein the history module is further configured to:

obtain historical information from an internet service provider (ISP) about the user; and

construct a community of interest (COI) for the user from the obtained historical information about the user.

10. The system of claim 8, wherein the historical information obtained from the ISP comprises Netflow data.

11. The system of claim 8, wherein the history module is further configure to:

define at least one heuristic;

determine flows in the stream of internet traffic that represent wanted traffic using the defined at least one heuristic; and

modify the COI for the user to include the endpoints of the flows determined to include wanted traffic.

12. The system of claim 11, wherein the defined at least one heuristic comprises a low port number heuristic, a low packet count heuristic, a reverse flow seen heuristic, a recent history heuristic, a non-recent history heuristic and/or no heuristic.

13. The method of claim 12, wherein the defined at least one heuristic is a combination of at least two heuristics.

14. A computer program product for identifying wanted traffic on the Internet, comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to determine a traffic history for a user of the Internet;

computer readable program code configured to identify wanted traffic in a stream of Internet traffic based on the determined traffic history; and

computer readable program code configured to prioritize the identified wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic.

15. The computer program product of claim 14, wherein the computer readable program code configured to determine a traffic history comprises:

computer readable program code configure to obtain historical information from an internet service provider (ISP) about the user; and

computer readable program code configured to construct a community of interest (COI) for the user from the obtained historical information about the user.

16. The computer program product of claim 15, wherein the historical information obtained from the ISP comprises Netflow data.

17. The computer program product of claim 15, wherein the computer readable program code configured to construct a community of interest comprises:

computer readable program code configured to define at least one heuristic;

computer readable program code configured to determine flows in the stream of internet traffic that represent wanted traffic using the defined heuristic; and

computer readable program code configured to modify the COI for the user to include the endpoints of the flows determined to include wanted traffic.

18. The computer program product of claim 17, wherein the defined at least one heuristic comprises a low port number heuristic, a low packet count heuristic, a reverse flow seen heuristic, a recent history heuristic, a non-recent history heuristic and/or no heuristic.

19. The computer program of claim 18, wherein the defined at least one heuristic is a combination of at least two heuristics.

20. The computer program product of claim 17, wherein the stream of Internet traffic comprises sampled Netflow data and/or unsampled data.