DATA STREAM CLASSIFICATION

• US 20160241628A1
• Filed: 04/25/2016
• Published: 08/18/2016
• Est. Priority Date: 02/25/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: SEREN, CETIN, WANG, JISHENG, AHLAWAT, SHARAD, XU, YINGQI, KASI, VIJAYA SARATHY
• Granted Patent: US 9,686,340 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.

Claims

1. A non-transitory computer-readable storage medium storing one or more instructions which, when executed by one or more processors, cause the one or more processors to perform:

controlling, by a server computer, a network computer to identify data packets associated with a data stream originated by a user application;

controlling, by the server computer, the network computer to update a set of characterization data that facilitates identifying the user application that originated the data stream and comprises a set of classification statistics computed from data specific to the data packets;

based, at least in part, on a portion of the set of characterization data, determining, by the server computer, a data stream classifier for the data stream;

causing the network computer to provide a signal determined based on the data stream classifier;

based, at least in part, on the signal, controlling the network computer to modify a quality of service setting for the data stream.

2. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

based, at least in part, on the signal, determining whether to set the quality of service setting to a high quality of service value;

in response to determining that the quality of service setting is to be set to the high quality of service value, modifying the quality of service setting for the data stream by setting the high quality of service value for the user application.

3. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

based, at least in part, on the signal, determining whether to set the quality of service setting to a low quality of service value;

in response to determining that the quality of service setting is to be set to the low quality of service value, modifying the quality of service setting for the data stream by setting the low quality of service value for the user application.

4. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

based, at least in part, on the signal, determining whether to increase the quality of service setting;

in response to determining that the quality of service setting is to be increased, modifying the quality of service setting for the data stream by increasing the quality of service setting for the user application.

5. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

based, at least in part, on the signal, determining whether to decrease the quality of service setting;

in response to determining that the quality of service setting is to be decreased, modifying the quality of service setting for the data stream by decreasing the quality of service setting for the user application.

6. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

based, at least in part, on the signal, controlling the network computer to modify a set of bandwidth data associated with the data stream;

wherein the set of bandwidth data facilitates one or more of;

determining billing information, analyzing network activity, or reporting network usage.

7. The non-transitory computer-readable storage medium of claim 1,

wherein identifying the data packets associated with the data stream comprises comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream;

wherein comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream comprises performing one or more of;

comparing a source interne protocol (IP) address associated with the packet to a source IP address associated with the data stream;

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream;

comparing a source port number associated with the packet to a source port number associated with the data stream;

or

comparing a destination port number associated with the packet to a destination port number associated with the data stream.

8. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

determining that the set of characterization data indicates that a threshold probability has been achieved by examining the data packets and calculating statistical information for the data packets;

wherein the statistical information for the data packets includes one or more of;

an average packet size, a standard deviation of a packet interval, or a count of packets received during a time period.

9. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

determining the data stream classifier for the data stream by performing one or more of;

comparing average packet size data, comparing standard deviation of packet size data, comparing average interval time between packets data, or comparing standard deviation of interval time between packets data.

10. The non-transitory computer-readable storage medium of claim 1, storing additional instructions which, when executed, cause the one or more processors to perform:

causing the network computer to assign the data stream classifier to the data stream to allow identifying the data packets originated by the user application based on the data stream classifier;

wherein the data stream classifier identifies one of;

an VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, a conferencing application.

11. A computer-implemented, data processing method comprising:

controlling, by a server computer, a network computer to identify data packets associated with a data stream originated by a user application;

controlling, by the server computer, the network computer to update a set of characterization data that facilitates identifying the user application that originated the data stream and comprises a set of classification statistics computed from data specific to the data packets;

based, at least in part, on a portion of the set of characterization data, determining, by the server computer, a data stream classifier for the data stream;

causing the network computer to provide a signal determined based on the data stream classifier;

based, at least in part, on the signal, controlling the network computer to modify a quality of service setting for the data stream.

12. The computer-implemented, data processing method of claim 11, comprising:

based, at least in part, on the signal, determining whether to set the quality of service setting to a high quality of service value;

in response to determining that the quality of service setting is to be set to the high quality of service value, modifying the quality of service setting for the data stream by setting the high quality of service value for the user application.

13. The computer-implemented, data processing method of claim 11, comprising:

based, at least in part, on the signal, determining whether to set the quality of service setting to a low quality of service value;

in response to determining that the quality of service setting is to be set to the low quality of service value, modifying the quality of service setting for the data stream by setting the low quality of service value for the user application.

14. The computer-implemented, data processing method of claim 11, comprising:

based, at least in part, on the signal, determining whether to increase the quality of service setting;

in response to determining that the quality of service setting is to be increased, modifying the quality of service setting for the data stream by increasing the quality of service setting for the user application.

15. The computer-implemented, data processing method of claim 11, comprising:

based, at least in part, on the signal, determining whether to decrease the quality of service setting;

in response to determining that the quality of service setting is to be decreased, modifying the quality of service setting for the data stream by decreasing the quality of service setting for the user application.

16. The computer-implemented, data processing method of claim 11, comprising:

based, at least in part, on the signal, controlling the network computer to modify a set of bandwidth data associated with the data stream;

wherein the set of bandwidth data facilitates one or more of;

determining billing information, analyzing network activity, or reporting network usage.

17. The computer-implemented, data processing method of claim 11,

wherein identifying the data packets associated with the data stream comprises comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream;

wherein comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream comprises performing one or more of;

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream;

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream;

comparing a source port number associated with the packet to a source port number associated with the data stream;

or

comparing a destination port number associated with the packet to a destination port number associated with the data stream.

18. The computer-implemented, data processing method of claim 11, comprising:

determining that the set of characterization data indicates that a threshold probability has been achieved by examining the data packets and calculating statistical information for the data packets;

wherein the statistical information for the data packets includes one or more of;

an average packet size, a standard deviation of a packet interval, or a count of packets received during a time period.

19. The computer-implemented, data processing method of claim 11, comprising:

determining the data stream classifier for the data stream by performing one or more of;

comparing average packet size data, comparing standard deviation of packet size data, comparing average interval time between packets data, or comparing standard deviation of interval time between packets data.

20. The computer-implemented, data processing method of claim 11, comprising:

causing the network computer to assign the data stream classifier to the data stream to allow identifying the data packets originated by the user application based on the data stream classifier;

wherein the data stream classifier identifies one of;

an VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, a conferencing application.