CLASSIFICATION OF HTTP MULTIMEDIA TRAFFIC PER SESSION

• US 20120311121A1
• Filed: 04/20/2012
• Published: 12/06/2012
• Est. Priority Date: 04/21/2011
• Status: Active Grant

• Current Assignee: ARRIS Enterprises LLC (CommScope Holding Company, Inc.)
• Original Assignee: ARRIS Solutions, Inc. (CommScope Holding Company, Inc.)
• Inventors: SHAFRIR, Alon, ESHET, Amit, CHAMBERS, Jay
• Granted Patent: US 9,712,592 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A non-transitory computer readable medium and a method for session based classification. The method may include detecting an initialization of a certain TCP connection; defining the certain TCP connection as an active TCP connection; receiving, by a classifier, an incoming packet that belongs to a session that involves conveying a media asset using a HTTP as an application layer protocol; determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection or not; and if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming to a session that is associated with the certain active TCP connection based upon a mapping between sessions and active TCP connections.

Claims

1. A method for session based classification, the method comprising:

detecting an initialization of a certain transmission communication protocol (TCP) connection;

defining the certain TCP connection as an active TCP connection;

receiving, by a classifier, an incoming packet that belongs to a session that involves conveying a media asset using a HyperText Transfer Protocol (HTTP) as an application layer protocol;

determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection or not; and

if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming to a session that is associated with the certain active TCP connection based upon a mapping between sessions and active TCP connections.

2. The method according to claim 1, comprising determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection, to another active TCP connection or not to any active TCP connection;

if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming to a session that is associated with the certain active TCP connection based upon the mapping between sessions and active TCP connections; and

if it is determined that the incoming packet belongs to the other active TCP connection then classifying the incoming packet to another session that is associated with the other active TCP connection, based upon the mapping between sessions and active TCP connections.

5. The method according to claim 1, comprising generating or updating the mapping between sessions and active TCP connections.

6. The method according to claim 1, comprising estimating a mapping between the certain TCP connection and a certain session, if the mapping lacks a fully resolved mapping between the certain TCP connection and any session.

7. The method according to claim 1, comprising maintaining by a first circuit of the classifier a data structure indicative of active TCP connections and performing the classifying by a second circuit of the classifier.

8. The method according to claim 1, comprising generating the mapping between sessions and active TCP connections in response to HTTP attributes of an incoming packet and information about a user that is either a destination of the incoming packet or a source of the incoming packet.

9. The method according to claim 1, comprising generating the mapping based upon an estimation of likelihood of a mapping between each TCP connection and each session.

10. The method according to claim 1, comprising detecting an initialization of a certain TCP connection only in one direction out of upstream and downstream.

3. The method according to claim 3, wherein if it is determined that the incoming packet does not belong to any active TCP connection then delaying a classification of the incoming packet.

4. The method according to claim 3, wherein if it is determined that the incoming packet does not belong to any active TCP connection then tagging the incoming packet as belonging to an unclassified session.

11. A method for session based classification, the method comprising:

receiving, by a classifier, a session identification message that is indicative of a certain session that is conveyed over a certain (transmission communication protocol) TCP connection, using a protocol family that comprises Internet Protocol (IP), TCP and HyperText Transfer Protocol (HTTP); and

associating each incoming packet that is conveyed over the certain TCP connection as belonging to the certain session.

12. The method according to claim 11, wherein the session identification message is generated by a user that is either a destination of the incoming packet or a source of the incoming packet.

13. The method according to claim 11, wherein the session identification message is generated by a content preparation device that is coupled to an HTTP server that is either a destination of the incoming packet or a source of the incoming packet.

14. The method according to claim 11, wherein the session identification message is embedded in a HTTP entity tag.

15. A non-transitory computer readable medium that stores instructions for:

detecting an initialization of a certain (transmission communication protocol) TCP connection;

defining the certain TCP connection as an active TCP connection;

receiving an incoming packet that belongs to a session that involves conveying a media asset using a HyperText Transfer Protocol (HTTP) as an application layer protocol;

determining whether the incoming packet belongs to the certain active TCP connection or not; and

if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming to a session that is associated with the certain active TCP connection based upon a mapping between sessions and active TCP connections.

16. The non-transitory computer readable medium according to claim 15, storing instructions for determining whether the incoming packet belongs to the certain active TCP connection, to another active TCP connection or not to any active TCP connection;

if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming to a session that is associated with the certain active TCP connection based upon the mapping between sessions and active TCP connections; and

if it is determined that the incoming packet belongs to the other active TCP connection then classifying the incoming packet to another session that is associated with the other active TCP connection, based upon the mapping between sessions and active TCP connections.

17. The non-transitory computer readable medium according to claim 16, storing instructions for delaying a classification of the incoming packet if it is determined that the incoming packet does not belong to any active TCP connection.

18. The non-transitory computer readable medium according to claim 15, storing instructions for generating or updating the mapping between sessions and active TCP connections.

19. The non-transitory computer readable medium according to claim 15, storing instructions for estimating a mapping between the certain TCP connection and a certain session, if the mapping lacks a fully resolved mapping between the certain TCP connection and any session.

20. A non-transitory computer readable medium that stores instructions for:

receiving a session identification message that is indicative of a certain session that is conveyed over a certain (transmission communication protocol) TCP connection, using a protocol family that comprises Internet Protocol (IP), TCP and HyperText Transfer Protocol (HTTP); and

associating each incoming packet that is conveyed over the certain TCP connection as belonging to the certain session.