Methods, apparatuses and systems facilitating classification of web services network traffic

• US 7,774,456 B1
• Filed: 02/27/2004
• Issued: 08/10/2010
• Est. Priority Date: 02/27/2004
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Packeteer Incorporated (Gen Digital Inc.)
• Inventors: Bruck, Edward G., Lownsbrough, Derek Leigh
• Primary Examiner(s): Phillips; Hassan
• Assistant Examiner(s): Tiv; Backhean
• Application Number:
  US10/788,646
• Time in Patent Office: 2,356 Days
• Field of Search: 709/224, 709/225
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 41/5083 wherein the managed service relates to web hosting
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Methods, apparatuses and systems that facilitate the classification of web services network traffic. In one implementation, the present invention processes interface definitions corresponding to a given Web service to construct a traffic classification configuration for the Web service, including one or more traffic classes and corresponding matching rules or attributes for each traffic class. In one implementation, the present invention automatically creates traffic classes and matching rules that allow for differentiation between the operations supported by a Web service. Implementations of the present invention provide a mechanism allowing for classification of Web services network traffic on a granular basis to enhance network monitoring and analysis tasks, as well as network control functions, such as bandwidth management, security and other functions.

Claims

1. A method facilitating the classification of web services network traffic, comprising:

discovering, at a network device, one or more web services based on web service invocation messages received at the network device;

maintaining a tracking list data structure comprising, for each discovered web service, a web service identifier corresponding to the web service and a transaction count associated with the web service;

incrementing, responsive to a message indicating a new web services network transaction, a transaction count associated with the web service identified in the message;

presenting, in a user interface, one or more of the web service identifiers and corresponding transaction counts, wherein the user interface allows for selection of one or more web service identifiers; and

configuring, responsive to selection of a web service identifier, a network traffic classification mechanism to identify the web service corresponding to the web service identifier, comprising;

creating a traffic class identifier corresponding to the web service;

creating at least one matching rule defining an attribute of the web service;

associating the at least one matching rule to the traffic class identifier in the traffic classification mechanism;

receiving an interface definition document defining the attributes of the web service;

processing the interface definition document to identify at least one traffic class corresponding to the web service, comprising;

defining a first traffic class corresponding to the web service;

defining at least a second traffic class corresponding to a binding supported by the web service; and

associating at least the second traffic class as a child traffic class of the first traffic class in a hierarchical traffic classification scheme; and

configuring a network traffic classification mechanism to identify the at least one traffic class based on at least one attribute obtained from the web services definition document.

2. A method facilitating the classification of web services network traffic, comprising:

discovering, at a network device, one or more web services based on web service invocation messages received at the network device;

maintaining a tracking list data structure comprising, for each discovered web service, a web service identifier corresponding to the web service and a transaction count associated with the web service;

incrementing, responsive to a message indicating a new web services network transaction, a transaction count associated with the web service identified in the message;

presenting, in a user interface, one or more of the web service identifiers and corresponding transaction counts, wherein the user interface allows for selection of one or more web service identifiers; and

configuring, responsive to selection of a web service identifier, a network traffic classification mechanism to identify the web service corresponding to the web service identifier, comprising;

creating a traffic class identifier corresponding to the web service;

creating at least one matching rule defining an attribute of the web service;

associating the at least one matching rule to the traffic class identifier in the traffic classification mechanism;

receiving an interface definition document defining the attributes of the web service;

processing the interface definition document to identify at least one traffic class corresponding to the web service, comprising;

defining a first traffic class corresponding to the web service;

defining at least a second traffic class corresponding to an operation of the web service; and

associating at least the second traffic class as a child traffic class of the first traffic class in a hierarchical traffic classification scheme; and

configuring a network traffic classification mechanism to identify the at least one traffic class based on at least one attribute obtained from the web services definition document.

3. The method of claim 2 wherein the web services interface definition document is a WSDL document.

4. The method of claim 2 wherein the attribute in the second creating step is the web service identifier corresponding to the web service.

5. The method of claim 4 further comprising creating at least one additional matching rule defining an attribute of the web service.

6. The method of claim 5 wherein the attribute in the third creating step is a protocol associated with the web service.

7. The method of claim 6 wherein the protocol is a web services protocol.

8. The method of claim 6 wherein the protocol is the SOAP protocol.

9. The method of claim 6 wherein the protocol is the HTTP protocol.

10. The method of claim 2 further comprising maintaining a count of a number of data flows corresponding to each web service traversing the communications path.

11. The method of claim 2 wherein the web service identifier comprises a host name.

12. The method of claim 2 wherein the web service identifier comprises a host name and a uniform resource indicator.

13. The method of claim 2 wherein the configuring step is performed in response to a command from an end user.

14. The method of claim 2 wherein the monitoring step comprises

upon detection of a new data flow,

parsing at least one packet in the data flow to identify the protocol attributes corresponding to the data flow;

matching the identified protocol attributes to a predetermined set of web services protocol attributes to determine whether the data flow is web services web services data flow.

15. The method of claim 14 wherein the parsing step comprises parsing the at least one packet in the data flow into a flow specification, wherein the flow specification contains at least one instance of any one of the following:

a protocol family designation, a direction of packet flow designation, a protocol type designation, a binding type, a pair of hosts, a pair of ports, a pointer to a MIME type, a pointer to an application-specific attribute.

16. The method of claim 2 further comprising

subsequent to the configuring step, processing the latest interface definition document corresponding to the web service to determine whether changes to the configuration of the network traffic classification mechanism are required.

17. The method of claim 2 wherein the tracking list data structure comprises a hash table including one or more entries, wherein each entry comprises a key value and a transaction count, wherein the key value is generated by applying a hashing function to a host name and URI pair identified in messages initiating web services network transactions.

18. The method of claim 2 further comprising applying one or more bandwidth utilization controls to data flows based on the web services traffic classes associated with the data flows by the traffic classification mechanism.

19. An apparatus facilitating the classification of web services network traffic, comprising

a packet processor operative to

detect data flows in network traffic traversing a network;

a traffic classification database operative to

match data flows against a plurality of traffic classes, wherein each traffic class in the plurality of traffic classes is defined by at least one matching attribute;

a web services classification module operative to

identify web services in the data flows traversing the network;

discover one or more web services based on web service invocation messages received at the packet processor;

maintain a tracking data structure comprising, for each discovered web service, a web service identifier corresponding to the web service and a count of the number of web services network transactions detected in the data flows traversing the network;

increment, responsive to a message indicating a new web services network transaction, a transaction count associated with the web service identified in the message;

present, in a user interface, one or more of the web service identifiers and corresponding transaction counts, wherein the user interface allows for selection of one or more web service identifiers; and

create, responsive to selection of a web service identifier, a traffic class in the traffic classification database for a selected web service in the data structure, wherein at least one matching rule associated with the traffic class includes the web service identifier associated with the web service;

receive an interface definition document defining the attributes of the selected web service and an operation of the selected web service;

process the interface definition document to identify at least a first traffic class corresponding to the selected web service and at least a second traffic class corresponding to the operation of the selected web service; and

create the at least the first traffic class and the second traffic class in the traffic classification database, wherein at least one matching rule associated with the corresponding first traffic class and second traffic class is based on one or more of the attributes in the interface definition document.

20. The apparatus of claim 19 wherein the at least one traffic class is identified relative to the bindings identified in the interface definition document.

21. The apparatus of claim 19 wherein, to process the interface definition document, the web services classification module is further operative to

define a first traffic class corresponding to the web service;

define at least a second traffic class corresponding to an attribute of the web service; and

associate the at least a second traffic class as a child traffic class of the first traffic class in a hierarchical traffic classification scheme.

22. The apparatus of claim 21 wherein the attribute in the second defining step is an operation of the web service.

23. The apparatus of claim 21 wherein the attribute in the second defining step is a binding supported by the web service.

24. The apparatus of claim 19 wherein the tracking data structure comprises a hash table including one or more entries, wherein each entry comprises a key value and a transaction count, wherein the key value is generated by applying a hashing function to a host name and URI pair identified in messages initiating web services network transactions.