DATA STREAM CLASSIFICATION

• US 20170272497A1
• Filed: 06/07/2017
• Published: 09/21/2017
• Est. Priority Date: 02/25/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: SEREN, CETIN, WANG, JISHENG, AHLAWAT, SHARAD, XU, YINGQI, KASI, VIJAYA SARATHY
• Granted Patent: US 9,876,839 B2
• Time in Patent Office: Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.

Claims

1. A computer-implemented, data processing method comprising:

controlling, by a server computer, a network computer to identify data packets associated with a data stream originated by a user application;

controlling, by the server computer, the network computer to generate a set of characterization data that is associated with the data stream originated by the user application;

comparing the set of characterization data with a set of training characterization data to determine a type of the user application that originated the data stream;

based on the type of the user application that originated the data stream, determining whether to set a quality of service setting to a high quality of service value;

in response to determining that the quality of service setting is to be set to the high quality of service value, modifying the quality of service setting for the data stream by setting the high quality of service value for the user application.

2. The computer-implemented, data processing method of claim 1, further comprising:

based on the type of the user application that originated the data stream, determining whether to set the quality of service setting to a low quality of service value;

in response to determining that the quality of service setting is to be set to the low quality of service value, modifying the quality of service setting for the data stream by setting the low quality of service value for the user application.

3. The computer-implemented, data processing method of claim 2, wherein the type of the user application is one or more of:

a voice over internet protocol application, an online game, a streaming medium, a file transfer application, a file sharing application, or an audio file transfer.

4. The computer-implemented, data processing method of claim 3, further comprising:

identifying data packets associated with a data stream originated by a user application;

controlling, by the server computer, the network computer to update the set of characterization data that facilitates identifying the user application that originated the data stream and comprises a set of classification statistics computed from data specific to the data packets;

based, at least in part, on a portion of the set of characterization data, determining, by the server computer, a data stream classifier for the data stream;

causing the network computer to provide a signal determined based on the data stream classifier;

based, at least in part, on the signal, controlling the network computer to modify the quality of service setting for the data stream.

5. The computer-implemented, data processing method of claim 4, further comprising:

based, at least in part, on the signal, determining whether to increase the quality of service setting;

in response to determining that the quality of service setting is to be increased, modifying the quality of service setting for the data stream by increasing the quality of service setting for the user application.

6. The computer-implemented, data processing method of claim 5, further comprising:

based, at least in part, on the signal, determining whether to decrease the quality of service setting;

in response to determining that the quality of service setting is to be decreased, modifying the quality of service setting for the data stream by decreasing the quality of service setting for the user application.

7. The computer-implemented, data processing method of claim 6, further comprising:

based, at least in part, on the signal, controlling the network computer to modify a set of bandwidth data associated with the data stream;

wherein the set of bandwidth data facilitates one or more of;

determining billing information, analyzing network activity, or reporting network usage.

8. The computer-implemented, data processing method of claim 7, wherein identifying the data packets associated with the data stream comprises comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream;

wherein comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream comprises performing one or more of;

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream;

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream;

comparing a source port number associated with the packet to a source port number associated with the data stream;

or comparing a destination port number associated with the packet to a destination port number associated with the data stream.

9. The computer-implemented, data processing method of claim 8, further comprising:

determining that the set of characterization data indicates that a threshold probability has been achieved by examining the data packets and calculating statistical information for the data packets;

wherein the statistical information for the data packets includes one or more of;

an average packet size, a standard deviation of a packet interval, or a count of packets received during a time period.

10. The computer-implemented, data processing method of claim 9,

wherein the data stream classifier identifies one of:

an VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, a conferencing application.

11. A non-transitory computer-readable storage medium storing one or more computer instructions which, when performed by one or more processors, cause the one or more processors to perform:

controlling, by a server computer, a network computer to identify data packets associated with a data stream originated by a user application;

controlling, by the server computer, the network computer to generate a set of characterization data that is associated with the data stream originated by the user application;

comparing the set of characterization data with a set of training characterization data to determine a type of the user application that originated the data stream;

based on the type of the user application that originated the data stream, determining whether to set a quality of service setting to a high quality of service value;

in response to determining that the quality of service setting is to be set to the high quality of service value, modifying the quality of service setting for the data stream by setting the high quality of service value for the user application.

12. The non-transitory computer-readable storage medium of claim 11, storing additional computer instructions which, when performed by the one or more processors, cause the one or more processors to perform:

based on the type of the user application that originated the data stream, determining whether to set the quality of service setting to a low quality of service value;

in response to determining that the quality of service setting is to be set to the low quality of service value, modifying the quality of service setting for the data stream by setting the low quality of service value for the user application.

13. The non-transitory computer-readable storage medium of claim 12, wherein the type of the user application is one or more of:

a voice over interne protocol application, an online game, a streaming medium, a file transfer application, a file sharing application, or an audio file transfer.

14. The non-transitory computer-readable storage medium of claim 13, storing additional computer instructions which, when performed by the one or more processors, cause the one or more processors to perform:

identifying data packets associated with a data stream originated by a user application;

controlling, by the server computer, the network computer to update the set of characterization data that facilitates identifying the user application that originated the data stream and comprises a set of classification statistics computed from data specific to the data packets;

based, at least in part, on a portion of the set of characterization data, determining, by the server computer, a data stream classifier for the data stream;

causing the network computer to provide a signal determined based on the data stream classifier;

based, at least in part, on the signal, controlling the network computer to modify the quality of service setting for the data stream.

15. The non-transitory computer-readable storage medium of claim 14, storing additional computer instructions which, when performed by the one or more processors, cause the one or more processors to perform:

based, at least in part, on the signal, determining whether to increase the quality of service setting;

in response to determining that the quality of service setting is to be increased, modifying the quality of service setting for the data stream by increasing the quality of service setting for the user application.

16. The non-transitory computer-readable storage medium of claim 15, storing additional computer instructions which, when performed by the one or more processors, cause the one or more processors to perform:

based, at least in part, on the signal, determining whether to decrease the quality of service setting;

in response to determining that the quality of service setting is to be decreased, modifying the quality of service setting for the data stream by decreasing the quality of service setting for the user application.

17. The non-transitory computer-readable storage medium of claim 16, storing additional computer instructions which, when performed by the one or more processors, cause the one or more processors to perform:

based, at least in part, on the signal, controlling the network computer to modify a set of bandwidth data associated with the data stream;

wherein the set of bandwidth data facilitates one or more of;

determining billing information, analyzing network activity, or reporting network usage.

18. The non-transitory computer-readable storage medium of claim 17, wherein identifying the data packets associated with the data stream comprises comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream;

wherein comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream comprises performing one or more of;

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream;

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream;

comparing a source port number associated with the packet to a source port number associated with the data stream;

or comparing a destination port number associated with the packet to a destination port number associated with the data stream.

19. The non-transitory computer-readable storage medium of claim 18, storing additional computer instructions which, when performed by the one or more processors, cause the one or more processors to perform:

determining that the set of characterization data indicates that a threshold probability has been achieved by examining the data packets and calculating statistical information for the data packets;

wherein the statistical information for the data packets includes one or more of;

an average packet size, a standard deviation of a packet interval, or a count of packets received during a time period.

20. The non-transitory computer-readable storage medium of claim 19, wherein the data stream classifier identifies one of:

an VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, a conferencing application.