Methods, systems and computer program products for identifying traffic on the internet using communities of interest

• US 8,554,948 B2
• Filed: 03/03/2010
• Issued: 10/08/2013
• Est. Priority Date: 03/03/2010
• Status: Expired due to Fees

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Van Der Merwe, Jacobus, Gupta, Minaxi, Kalafut, Andrew
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): KOROBOV, VITALI A
• Application Number:
  US12/716,420
• Publication Number:
  US 20110219445A1
• Time in Patent Office: 1,315 Days
• Field of Search: 709/224, 709/240, 370/235, 370/468, 726/22
• US Class Current: 709/240
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]

Abstract

Methods for identifying wanted traffic on the Internet are provided. The methods include determining a traffic history for a user of the Internet; identifying wanted traffic in a stream of Internet traffic based on the determined traffic history; and prioritizing the identified wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic. Related systems and computer program products are also provided.

Claims

1. A method for identifying wanted traffic on the internet, comprising:

determining a traffic history for a user of the internet;

identifying wanted traffic in a stream of internet traffic based on the traffic history;

prioritizing the wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic, and

defining a heuristic, wherein identifying and prioritizing are performed based on the heuristic and wherein the heuristic comprises;

a low port number heuristic that defines traffic in the stream of internet traffic as wanted traffic if any port numbers involved in a connection are below 1024;

a low packet count heuristic that defines traffic in the stream of internet traffic as wanted traffic if five or fewer packets are seen in a flow; and

a reverse flow seen heuristic that defines traffic in the stream of internet traffic as wanted traffic if a flow has been seen between a same pair of IP addresses in an opposite direction within a previous seven day period,

wherein determining, identifying, prioritizing and defining are performed by at least one processor.

2. The method of claim 1, wherein determining a traffic history comprises:

obtaining historical information from an internet service provider about the user; and

constructing a community of interest for the user from the historical information about the user.

3. The method of claim 2, wherein the historical information from the internet service provider comprises Netflow data.

4. The method of claim 2, wherein constructing a community of interest comprises:

determining flows in the stream of internet traffic that represent wanted traffic using the heuristic; and

modifying the community of interest for the user to include endpoints of the flows including wanted traffic.

5. The method of claim 4, wherein the stream of internet traffic comprises sampled Netflow data and unsampled data.

6. A data processing system for identifying wanted traffic on the internet, comprising:

a processor, the processor comprising;

a history module to determine a traffic history for a user of the internet;

an identification module to identify wanted traffic in a stream of internet traffic based on the traffic history; and

a prioritization module to prioritize the identified traffic such that unwanted traffic is assigned a lower priority than the wanted traffic, wherein the history module further defines a heuristic, wherein the heuristic comprises;

a low port number heuristic that defines traffic in the stream of internet traffic as wanted traffic if any port numbers involved in a connection are below 1024;

a low packet count heuristic that defines traffic in the stream of internet traffic as wanted traffic if five or fewer packets are seen in a flow; and

a reverse flow seen heuristic that defines traffic in the stream of internet traffic as wanted traffic if a flow has been seen between a same pair of IP addresses in an opposite direction within a previous seven day period, wherein the identification module identifies and the prioritization module prioritizes based on the heuristic.

7. The system of claim 6, wherein the history module is further to:

obtain historical information from an internet service provider about the user; and

construct a community of interest for the user from the historical information about the user.

8. The system of claim 6, wherein the historical information from the internet service provider comprises Netflow data.

9. The system of claim 6, wherein the history module is further to:

determine flows in the stream of internet traffic that represent wanted traffic using the heuristic; and

modify the community of interest for the user to include endpoints of the flows including wanted traffic.

10. A computer program product for identifying wanted traffic on the internet, comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code to determine a traffic history for a user of the internet;

computer readable program code to identify wanted traffic in a stream of internet traffic based on the traffic history;

computer readable program code to prioritize the wanted traffic such that unwanted traffic is assigned a lower priority than the wanted traffic; and

computer readable program code to define a heuristic, wherein the computer program code to identify and the computer program code to prioritize are performed based on the heuristic and wherein the heuristic comprises;

a low port number heuristic that defines traffic in the stream of internet traffic as wanted traffic if any port numbers involved in a connection are below 1024;

a low packet count heuristic that defines traffic in the stream of internet traffic as wanted traffic if five or fewer packets are seen in a flow; and

a reverse flow seen heuristic that defines traffic in the stream of internet traffic as wanted traffic if a flow has been seen between a same pair of IP addresses in an opposite direction within a previous seven day period.

11. The computer program product of claim 10, wherein the computer readable program code to determine a traffic history comprises:

computer readable program code configure to obtain historical information from an internet service provider about the user; and

computer readable program code to construct a community of interest for the user from the historical information about the user.

12. The computer program product of claim 11, wherein the historical information from the internet service provider comprises Netflow data.

13. The computer program product of claim 11, wherein the computer readable program code to construct a community of interest comprises:

computer readable program code to determine flows in the stream of internet traffic that represent wanted traffic using the heuristic; and

computer readable program code to modify the community of interest for the user to include endpoints of the flows including wanted traffic.

14. The computer program product of claim 13, wherein the stream of internet traffic comprises sampled Netflow data and unsampled data.