DETECTION AND REPORTING OF KEEPALIVE MESSAGES FOR OPTIMIZATION OF KEEPALIVE TRAFFIC IN A MOBILE NETWORK

• US 20140321448A1
• Filed: 04/30/2014
• Published: 10/30/2014
• Est. Priority Date: 04/30/2013
• Status: Active Grant

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Backholm, Ari, Fleming, Michael, Kokhanovskyi, Andrii, Yoon, Sungwook
• Granted Patent: US 9,271,325 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04W 76/25 Maintenance of established connections

Abstract

Detection of network transactions or keepalives for maintaining long lived connections are disclosed. A keepalive detector can detect keepalive traffic based on keepalive parameters determined from an analysis of socket level network communication log data that record data transfer events including data sent from mobile applications or clients on a mobile device and data received by the mobile applications or clients on the mobile device, timing characteristics, protocol types, etc. Various statistical analyses can be performed on the network communication data to detect keepalives, taking into account variability in intervals of the data transfer events and sizes of data sent and received on each event. The keepalive detector can also detect keepalives from stream data on a mobile device by analyzing socket level communication messages including timing characteristics and amount of data transferred to detect keepalives and report keepalives using a data structure.

Claims

1. A method of identifying keepalives from a Transport Control Protocol (TCP) stream, comprising:

examining patterns of data sent from and received by a mobile application on a mobile device, wherein the patterns have variable intervals and sizes;

performing statistical analyses on the patterns of data sent from and received by the mobile application to detect a pattern that is regular and to detect regular byte sizes; and

identifying the keepalives from the TCP stream occurring over the same TCP session based on information relating to the pattern that is detected as regular and the regular byte sizes.

2. The method of claim 1, wherein the pattern is detected as regular when the pattern occurs more than a minimum number of times during a duration.

3. The method of claim 2, wherein the pattern is detected as regular when intervals between occurrences of the pattern is distributed such that a difference between an interval in a first quartile and an interval in a third quartile is within a threshold percentage of a median of the intervals.

4. The method of claim 2, wherein the pattern is detected as regular when a variance of intervals between a threshold number of sequential occurrences of the pattern is less than a maximum threshold.

5. The method of claim 1, wherein the pattern is detected as regular when the pattern median of the intervals is greater than a minimum threshold.

6. The method of claim 1, wherein the regular byte size is detected when patterns including same sizes of data sent from and received by the mobile application, same sizes of data sent from the mobile application or same sizes of data received by the mobile application are detected as regular.

7. The method of claim 1, wherein the regular byte size is detected by performing a cluster analysis to identify patterns including data sent from and received by the mobile application, data sent from the mobile application or data received by the mobile application having a variance in sizes that is less than a threshold that are detected as regular.

8. A mobile device, comprising:

a memory;

a processor disposed in communication with the memory and configured to execute a plurality of instructions stored in the memory to;

examine data transfer events, each data transfer event characterized by data sent from and received by a mobile application on a mobile device, wherein the data transfer events occur at variable intervals and have variable sizes;

perform statistical analyses on the data transfer events to detect a data transfer event that is regular and to detect regular byte sizes; and

identify network transactions from a Transport Control Protocol (TCP) stream occurring over the same TCP session based on information relating to the data transfer event that is detected as regular and the regular byte sizes.

9. The mobile device of claim 8, wherein the data transfer event is detected as regular when:

the same data transfer event occurs more than a minimum number of times during a duration,

intervals between occurrences of the data transfer event is distributed such that a difference between an interval in a first quartile and an interval in a third quartile is within a threshold percentage of a median of the intervals or a variance of intervals between a threshold number of sequential occurrences of the data transfer event is less than a maximum threshold; and

the pattern median of the intervals is greater than a minimum threshold.

10. The mobile device of claim 9, wherein the regular byte size is detected when data transfer events including same sizes of data sent from and received by the mobile application, same sizes of data sent from the mobile application or same sizes of data received by the mobile application are detected as regular.

11. The mobile device of claim 10, wherein the regular byte size is detected by performing a cluster analysis to identify data transfer events including data sent from and received by the mobile application, data sent from the mobile application or data received by the mobile application having a variance in sizes that is less than a threshold that are detected as regular.

12. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

obtaining one or more network transaction parameters determined from examination of patterns of data sent from and received by a mobile application on a mobile device; and

identifying the network transactions from the TCP stream based on the one or more network transaction parameters,

wherein the network transactions occur over the same TCP session.

13. The method of claim 12, wherein the one or more network transaction parameters include a regular interval and a regular size threshold that is determined from the patterns of data sent from and received by the mobile application based on statistical analysis.

14. The method of claim 12, wherein the one or more network transaction parameters include similar or repeating content within the patterns of data sent from and received by the mobile application.

15. The method of claim 12, wherein the one or more network transaction parameters include content following a certain pattern.

16. The method of claim 12, wherein the patterns of data sent from and received by the mobile application are recorded in a network communication log along with patterns of data sent from and received by other mobile applications on the mobile device.

17. The method of claim 12, wherein the one or more network transaction parameters are determined locally on the mobile device or remotely on a proxy server.

18. A method of detecting keepalives from stream data on a mobile device, comprising:

detecting a message including stream data for a socket;

based on information in the message, determining whether to create or update a connection object, the connection object associated with a data structure including an identifier for the connection object and time the socket was created;

evaluating the connection object to determine whether a keepalive is detected, the data structure further including a flag for indicating whether the keepalive was detected.

19. The method of claim 18, wherein the data structure further includes a keepalive weight that is initialized to a value on creation of the connection object and incremented each time the connection object is updated.

20. The method of claim 18, further comprising:

analyzing the message to determine time the socket was created;

creating the connection object when the socket was created was more than an amount of given time ago.

21. The method of claim 19, further comprising:

analyzing the message to determine the information including an amount of data transferred from a client to a server and from the server to the client and timing characteristics; and

updating the connection object when the amount of data transferred is less than a threshold amount and the timing characteristics indicates that a time interval since the last data transfer event occurred more than a threshold interval.

22. The method of claim 21, wherein evaluating the connection object to determine whether the keepalive is detected includes evaluating the keepalive weight of the connection object upon updating the connection object to determine whether the keepalive weight is higher than a threshold.

23. The method of claim 22, further comprising:

reporting changes to the connection object including a formatted form of the data structure to the server.

24. The method of claim 18, wherein a local proxy on the mobile device detects the keepalives from the stream data.

25. The method of claim 18, wherein the stream data is over a Transport Control Protocol.

26. The method of claim 18, further comprising:

aligning at least some of the keepalives to optimize transfer of the at least some of the keepalives to a wireless network.