P2P ACTIVITY DETECTION AND MANAGEMENT

• US 20120297051A1
• Filed: 05/17/2011
• Published: 11/22/2012
• Est. Priority Date: 05/17/2011
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: KAKADIA, Deepak, LEE, Jay J., TAN, Thomas H.
• Granted Patent: US 8,806,002 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A network device may receive a peer-to-peer (P2P) activity record corresponding to a P2P data flow of P2P activity in a network. The P2P data flow may include content information communicated from a first user equipment device (UE) to a second UE via the network, and the P2P activity record may include information identifying the P2P data flow. The network device may insert the information identifying the P2P data flow into a P2P activity map and compare the P2P activity map to a P2P pattern of interest. The network device may also determine a P2P activity of interest probability based on the comparison of the P2P activity map to the P2P pattern of interest, which may describe the likelihood that P2P activity of interest is occurring in the network. The network device may also generate a system response based on the P2P activity of interest probability.

Claims

1. A network device, comprising:

a communication interface to receive a first peer-to-peer (P2P) activity record corresponding to a first P2P data flow of P2P activity in a network, the first P2P data flow comprising content information communicated from a first user equipment device (UE) to a second UE via the network, the first P2P activity record comprising information identifying the first P2P data flow; and

a processor, connected to the communication interface, to;

insert the information identifying the first P2P data flow into a first P2P activity map,

compare the first P2P activity map to a P2P pattern of interest,

determine a first P2P activity of interest probability based on the comparison of the first P2P activity map with the P2P pattern of interest, the first P2P activity of interest probability comprising a probability that P2P activity of interest is occurring in the network; and

generate a system response based on the first P2P activity of interest probability.

2. The network device of claim 1, where:

the first P2P activity record comprises a subscriber ID and a flow ID, the subscriber ID comprising an identity of the first UE, and the flow ID comprising an identity corresponding to the content information of the first P2P data flow, and

the processor is to;

associate the first P2P activity map with the subscriber ID and the flow ID of first P2P activity record.

3. The network device of claim 2, where,

when determining the first P2P activity of interest probability, the processor is to perform at least one of the following:

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the P2P activity type, and determine a rate of occurrence for the P2P activity type based on the P2P activity history;

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the subscriber ID, and determine a rate of occurrence of the subscriber ID being associated with the P2P activity type based on the P2P activity history;

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the flow ID of the first P2P activity record, determine a rate of occurrence of the flow ID being associated with the P2P activity type based on the P2P activity history;

or

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the P2P activity type, identify peak activity times of the P2P activity type, and determine whether timing information of the first P2P activity record corresponds to peak activity times of the P2P activity type.

4. The network device of claim 2, where, when

generating the system response, the processor is to perform at least one of:

identify a P2P activity type corresponding to the P2P pattern of interest, identify a threat level associated with the P2P activity type, ascertain a level of network congestion in the network, and modify the threat level based on the current level of network congestion;

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the P2P activity type, and determine a rate of occurrence for the P2P activity type based on the P2P activity history;

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the subscriber ID, and determine a rate of occurrence of the subscriber ID being associated with the P2P activity type based on the P2P activity history;

or

identify a P2P activity type corresponding to the P2P pattern of interest, access a P2P activity history corresponding to the flow ID of the first P2P activity record, determine a rate of occurrence of the flow ID being associated with the P2P activity type based on the P2P activity history.

5. The network device of claim 2, where, when

generating the system response, the processor is to perform at least one of:

communicate an alert message to at least one network device, the alert message comprising a level of severity corresponding to the P2P activity,

communicate a warning message to the first UE or the second UE,

reduce a bandwidth corresponding to the first UE or the second UE,

terminate network connections corresponding to the first UE or the second UE,

update a P2P activity history with information corresponding to the P2P activity,

prohibit P2P data flows involving the same or similar flow ID,

expedite identification and evaluation of one or more other P2P activity maps, or

determine whether to continue tracking the P2P activity.

6. The network device of claim 1, where the processor is to:

receive a second P2P activity record corresponding to a second P2P data flow of the P2P activity in the network, the second P2P data flow comprising content information communicated from the second UE to a third UE via the network, where the content information of the second P2P data flow matches the content information of the first P2P data flow,

the second P2P activity record comprising information identifying the second P2P data flow,

determine that the information identifying the second P2P data flow matches the information identifying the first P2P data flow,

insert the information identifying the second P2P data flow into the first P2P activity map to obtain an updated first P2P activity map,

compare the first P2P activity map with the P2P pattern of interest,

determine a second P2P activity of interest probability based on the comparison of the updated first P2P activity map to the P2P pattern of interest, the second P2P activity of interest probability comprising a probability that the first UE is participating in the P2P activity of interest, and

generate a second system response based on the second P2P activity of interest probability.

7. The network device of claim 6, where:

the second P2P activity record comprises a subscriber ID and a flow ID, the subscriber ID comprising an identity of the second UE, and the flow ID comprising an identity corresponding to the content information of the second P2P data flow, and

the processor is to;

associate the subscriber ID and the flow ID of the second P2P activity record with a second P2P activity map,

insert the information identifying the second P2P data flow into the second P2P activity map,

compare the second P2P activity map with the P2P pattern of interest,

determine a third P2P activity of interest probability based on the comparison of the second P2P activity map with the P2P pattern of interest, the third P2P activity of interest probability comprising a probability that the second UE is participating in the P2P activity of interest, and

generate a third system response based on the third P2P activity of interest probability.

8. The network device of claim 2, where the processor is to:

compare the first P2P activity map with multiple P2P patterns of interest that each corresponds to the P2P activity of interest, each of the multiple P2P patterns of interest comprising a distinct series of P2P data flows, and

where the first P2P activity interest probability is based on the comparison of the first P2P activity map to the multiple P2P patterns of interest.

9. A method, comprising:

receiving, by a network device, a peer-to-peer (P2P) activity record comprising information identifying a P2P data flow of P2P activity in a network, the P2P data flow comprising content information communicated from a first user equipment device (UE) to a second UE via the network;

determining, by the network device, whether any of a plurality of P2P activity maps are associated with the information identifying the P2P data flow;

when a P2P activity map associated with the information identifying the P2P data flow is identified,

inserting the information identifying the P2P data flow into the identified P2P activity map, and

when a P2P activity map associated with the information identifying the P2P data flow is not identified,

associating the information identifying the P2P data flow with a new P2P activity map, and

inserting the information identifying the P2P data flow into the new P2P activity map.

10. The method of claim 9, where:

the information identifying the P2P data flow comprises a subscriber ID, the subscriber ID comprising an identity of the first UE, and the P2P activity record further comprising a flow ID, the flow ID comprising an identity corresponding to the content information of the P2P data flow,

the method further comprising;

searching the plurality of P2P activity maps for P2P activity maps associated with the flow ID; and

when P2P activity maps associated with the flow ID are identified,

inserting information identifying the P2P data flow into the P2P activity maps associated with the flow ID.

11. The method of claim 10, further comprising:

comparing each of the P2P activity maps associated with the flow ID with at least one P2P pattern of interest, the at least one P2P pattern of interest comprising information associated with a sequence of data flows;

determining a P2P activity of interest probability, for each of the P2P activity maps associated with the flow ID, based on the comparison of each of the P2P activity maps associated with the flow ID with the at least one P2P pattern of interest, the P2P activity of interest probability comprising a probability that P2P activity of interest is occurring in the network; and

generating a system response for each of the P2P activity maps associated with the flow ID based on the P2P activity of interest probability for each of the P2P activity maps associated with the flow ID.

12. The method of claim 11, where:

determining the P2P activity of interest probability for each of the P2P activity maps associated with the flow ID is based on at least one of;

identifying a P2P activity type corresponding to the P2P pattern of interest, accessing a P2P activity history corresponding to the P2P activity type, determining a rate of occurrence for the P2P activity type based on the P2P activity history;

identifying a P2P activity type corresponding to the P2P pattern of interest, accessing a P2P activity history corresponding to the subscriber ID for each of the P2P activity maps associated with the flow ID, and determining a rate of occurrence of the subscriber ID being associated with the P2P activity type;

identifying a P2P activity type corresponding to the P2P pattern of interest, accessing a P2P activity history corresponding to the flow ID, determining a rate of occurrence of the flow ID being associated with the P2P activity type;

or

identifying a P2P activity type corresponding to the P2P pattern of interest, accesses a P2P activity history corresponding to the P2P activity type, identifying peak activity times of the P2P activity type, and determine whether timing information of the P2P activity record corresponds to peak activity times of the P2P activity type.

13. The method of claim 11, where:

generating the system response is also based on at least one of;

identifying a P2P activity type corresponding to the P2P pattern of interest, identifying a threat level associated the P2P activity type, ascertaining a level of network congestion in the network, and modifying the threat level associated with the P2P activity type based on the current level of network congestion;

identifying a P2P activity type corresponding to the P2P pattern of interest, accessing a P2P activity history corresponding to the P2P activity type, determining a rate of occurrence for the P2P activity type based on the P2P activity history corresponding to the P2P activity type;

identifying a P2P activity type corresponding to the P2P pattern of interest, accessing a P2P activity history corresponding to a subscriber ID for each of the P2P activity maps associated with the flow ID, and determining a rate of occurrence of each subscriber ID being associated with the P2P activity type;

or

identifying a P2P activity type corresponding to the P2P pattern of interest, accessing a P2P activity history corresponding to the flow ID, determining a rate of occurrence of the flow ID being associated with the P2P activity type.

14. The method of claim 9, where:

generating the system response corresponding to each of the P2P activity maps comprises at least one of;

communicating an alert message, corresponding to the P2P activity, to at least one network device, the alert message comprising one of a plurality of levels of severity,

communicating a warning message to the first UE or the second UE;

reducing a bandwidth corresponding to the first UE or the second UE;

terminating network connections corresponding to the first UE or the second UE;

updating a P2P activity history with information corresponding to the P2P activity;

prohibiting P2P data flows involving the same or similar P2P activity record information;

expediting identification and evaluation of one or more P2P activity maps;

or

determining whether to continue tracking the P2P activity.

15. A method, comprising:

monitoring, by a network device, a first peer-to-peer (P2P) data flow, the first P2P data flow comprising content information communicated from a first user equipment device (UE) to a second UE via a network;

obtaining, by the network device, a subscriber identifier (ID) of the first P2P data flow, the subscriber ID comprising an identity of the first UE;

producing, by the network device, a flow ID of the first P2P data flow, based on the content information of the first P2P data flow;

identifying, by the network device, timing information of the first P2P data flow, the timing information comprising a time associated with when the first P2P data flow was communicated by the first UE;

creating a first P2P activity record corresponding to the first P2P data flow, the first P2P activity record comprising the subscriber ID of the first UE, the flow ID of the first P2P data flow, and the timing information of the first P2P data flow; and

communicating the first P2P activity record to a network management server via the network.

16. The method of claim 15, where:

obtaining the subscriber ID of the first P2P data flow comprises;

identifying a source address of the first P2P data flow, the source address corresponding to the first UE,

communicating the source address to a network authentication server, and

receiving the subscriber ID of the first P2P data flow from the network authentication server.

17. The method of claim 16, further comprising:

obtaining a second subscriber ID of the first P2P data flow, the second subscriber ID comprising an identity of the second UE, and the obtaining of the second subscriber ID of the first P2P data flow comprises;

identifying a destination address of the P2P data flow, the destination address corresponding to the second UE,

communicating the destination address to the network authentication server, and

receiving the second subscriber ID of the first P2P data flow from the network authentication server; and

including the second subscriber ID in the first P2P activity record prior to communicating the first P2P activity record to the network management server.

18. The method of claim 15, further comprising:

monitoring a second P2P data flow, the second P2P data flow comprising content information communicated from the second UE to a third UE via the network, the content information of the second P2P data flow matching the content information of the first P2P data flow;

obtaining a subscriber ID of the second P2P data flow, the subscriber ID comprising an identity of the second UE;

producing a flow ID of the second P2P data flow, based on the content information of the second P2P data flow, the flow ID of the second P2P data flow matching the flow ID of the first P2P data flow;

identifying timing information for the second P2P data flow, the timing information comprising a time associated with when the second P2P data flow was communicated by the second UE;

creating a second P2P activity record corresponding to the second P2P data flow, the second P2P activity record comprising the subscriber ID of the second UE, the flow ID of the second P2P data flow, and timing information of the second P2P data flow; and

communicating the second P2P activity record to the network management server via the network.

19. The method of claim 15, further comprising:

receiving an alarm message from the network management server, the alarm message comprising a command to expedite creation of P2P activity records corresponding to the flow ID of the first P2P data flow; and

allocating additional system resources to expedite creation of P2P activity records corresponding to the flow ID of the first P2P data flow.

20. A method, comprising:

monitoring, by a network device, a peer-to-peer (P2P) data flow, the P2P data flow comprising content information communicated from a first user equipment device (UE) to a second UE via a network;

identifying a source address of the P2P data flow, the source address corresponding to the first UE;

communicating, by the network device, the source address to a network authentication server of the network;

receiving, by the network device, a subscriber ID comprising an identifier (ID) of the first UE;

producing, by the network device, a flow ID of the P2P data flow, based on the content information of the P2P data flow;

identifying, by the network device, timing information of the first P2P data flow, the timing information comprising a time associated with when the P2P data flow was communicated by the first UE;

creating, by the network device, a P2P activity record corresponding to the P2P data flow, the P2P activity record comprising the subscriber ID of the first UE, the flow ID of the P2P data flow, and the timing information of the P2P data flow; and

communicating, by the network device, the P2P activity record to a network management server via the network.