Classification of HTTP multimedia traffic per session
First Claim
1. A method for session based classification, the method comprising:
- detecting an initialization of a certain transmission communication protocol (TCP) connection;
maintaining a connection table comprising one or more TCP connection descriptors for TCP connections detected in traffic;
maintaining, by a classifier, a set of session descriptors for open sessions;
defining the certain TCP connection as an active TCP connection in the connection table;
receiving, by the classifier, an incoming packet that belongs to a session for transfer of a media asset that comprises at least one of audio content and video content, the transfer comprising conveying the media asset using a HyperText Transfer Protocol (HTTP) as an application layer protocol;
determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection based upon its presence in the connection table;
generating and iteratively updating, by the classifier, a plurality of mappings wherein each mapping is between a session and an active TCP connection in the connection table, the plurality of mappings comprising data for maintaining an association graph, wherein the updating of the plurality of mappings is based upon calculating estimations of likelihood of an association corresponding to a respective mapping, the calculating comprising considering a plurality of traffic properties for each TCP connection and checking for each of the traffic properties how well the traffic property matches a corresponding property of each session;
if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming packet to a session that is associated with the certain active TCP connection based upon the mapping between sessions and active TCP connections maintained by the connection table; and
processing the incoming packet using a first logic for performing work per packet, the first logic comprising matching the incoming packet to a corresponding session included in a corresponding mapping of the plurality of mappings, wherein the matching of the incoming packet is based upon the active TCP connection of the corresponding mapping;
wherein the step of iteratively updating comprises;
processing an incoming notification message, the incoming notification message indicative of an initiation or a termination of a TCP connection, using a second logic for performing work per TCP connection being initiated or terminated, the second logic comprising performing an iteration of the updating step.
9 Assignments
0 Petitions
Accused Products
Abstract
A non-transitory computer readable medium and a method for session based classification. The method may include detecting an initialization of a certain TCP connection; defining the certain TCP connection as an active TCP connection; receiving, by a classifier, an incoming packet that belongs to a session that involves conveying a media asset using a HTTP as an application layer protocol; determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection or not; and if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming to a session that is associated with the certain active TCP connection based upon a mapping between sessions and active TCP connections.
-
Citations
17 Claims
-
1. A method for session based classification, the method comprising:
-
detecting an initialization of a certain transmission communication protocol (TCP) connection; maintaining a connection table comprising one or more TCP connection descriptors for TCP connections detected in traffic; maintaining, by a classifier, a set of session descriptors for open sessions; defining the certain TCP connection as an active TCP connection in the connection table; receiving, by the classifier, an incoming packet that belongs to a session for transfer of a media asset that comprises at least one of audio content and video content, the transfer comprising conveying the media asset using a HyperText Transfer Protocol (HTTP) as an application layer protocol; determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection based upon its presence in the connection table; generating and iteratively updating, by the classifier, a plurality of mappings wherein each mapping is between a session and an active TCP connection in the connection table, the plurality of mappings comprising data for maintaining an association graph, wherein the updating of the plurality of mappings is based upon calculating estimations of likelihood of an association corresponding to a respective mapping, the calculating comprising considering a plurality of traffic properties for each TCP connection and checking for each of the traffic properties how well the traffic property matches a corresponding property of each session; if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming packet to a session that is associated with the certain active TCP connection based upon the mapping between sessions and active TCP connections maintained by the connection table; and processing the incoming packet using a first logic for performing work per packet, the first logic comprising matching the incoming packet to a corresponding session included in a corresponding mapping of the plurality of mappings, wherein the matching of the incoming packet is based upon the active TCP connection of the corresponding mapping; wherein the step of iteratively updating comprises; processing an incoming notification message, the incoming notification message indicative of an initiation or a termination of a TCP connection, using a second logic for performing work per TCP connection being initiated or terminated, the second logic comprising performing an iteration of the updating step. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A method for session based classification, the method comprising:
-
maintaining a connection table comprising one or more TCP connection descriptors for TCP connections detected in traffic; maintaining, by a classifier, a set of session descriptors for open sessions; receiving, by the classifier, a session identification message that is indicative of a certain session for transfer of a media asset that comprises at least one of audio content and video content, the certain session comprising conveying the media asset over a certain transmission communication protocol (TCP) connection, using a protocol family that comprises Internet Protocol (IP), TCP and HyperText Transfer Protocol (HTTP); and associating each incoming packet that is conveyed over the certain TCP connection as belonging to the certain session by including the incoming packet in a connection table; generating and iteratively updating, by the classifier, a plurality of mappings wherein each mapping is between a session and an active TCP connection in the connection table, the plurality of mappings comprising data for maintaining an association graph, wherein the updating of the plurality of mappings is based upon calculating estimations of likelihood of an association corresponding to a respective mapping, the calculating comprising considering a plurality of traffic properties for each TCP connection and checking for each of the traffic properties how well the traffic property matches a corresponding property of each session; and processing each incoming packet associated with the certain session using a first logic for performing work per packet, the first logic comprising matching the incoming packet to a corresponding session included in a corresponding mapping of the plurality of mappings, wherein the matching of the incoming packet is based upon the active TCP connection of the corresponding mapping; wherein the step of iteratively updating comprises; processing an incoming notification message, the incoming notification message indicative of an initiation or a termination of a TCP connection, using a second logic for performing work per TCP connection being initiated or terminated, the second logic comprising performing an iteration of the updating step. - View Dependent Claims (10, 11, 12)
-
-
13. A non-transitory computer readable medium that stores instructions for:
-
detecting an initialization of a certain transmission communication protocol (TCP) connection; maintaining a connection table comprising one or more TCP connection descriptors for TCP connections detected in traffic; maintaining, by a classifier, a set of session descriptors for open sessions; defining the certain TCP connection as an active TCP connection in the connection table; receiving, by the classifier, an incoming packet that belongs to a session for transfer of a media asset that comprises at least one of audio content and video content, the session comprising conveying the media asset using a HyperText Transfer Protocol (HTTP) as an application layer protocol; generating and iteratively updating, by the classifier, a plurality of mappings wherein each mapping is between a session and an active TCP connection in the connection table, the plurality of mappings comprising data for maintaining an association graph, wherein the updating of the plurality of mappings is based upon calculating estimations of likelihood of an association corresponding to a respective mapping, the calculating comprising considering a plurality of traffic properties for each TCP connection and checking for each of the traffic properties how well the traffic property matches a corresponding property of each session; determining whether the incoming packet belongs to the certain active TCP connection based upon its inclusion in the connection table; if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming packet to a session that is associated with the certain active TCP connection based upon the mapping between sessions and active TCP connections maintained by the connection table; and processing the incoming packet using a first logic for performing work per packet, the first logic comprising matching the incoming packet to a corresponding session included in a corresponding mapping of the plurality of mappings, wherein the matching of the incoming packet is based upon the active TCP connection of the corresponding mapping; wherein the instructions for iteratively updating comprise instructions for; processing an incoming notification message, the incoming notification message indicative of an initiation or a termination of a TCP connection, using a second logic for performing work per TCP connection being initiated or terminated, the second logic comprising performing an iteration of the updating. - View Dependent Claims (14, 15, 16)
-
-
17. A non-transitory computer readable medium that stores instructions for:
-
maintaining a connection table comprising one or more TCP connection descriptors for TCP connections detected in traffic; maintaining, by a classifier, a set of session descriptors for open sessions; receiving a session identification message that is indicative of a certain session for transfer of a media asset that comprises at least one of audio content and video content, the certain session comprising conveying the media asset over a certain transmission communication protocol (TCP) connection, using a protocol family that comprises Internet Protocol (IP), TCP and HyperText Transfer Protocol (HTTP); generating and iteratively updating, by the classifier, a plurality of mappings wherein each mapping is between a session and an active TCP connection in the connection table, the plurality of mappings comprising data for maintaining an association graph, wherein the updating of the plurality of mappings is based upon calculating estimations of likelihood of an association corresponding to a respective mapping, the calculating comprising considering a plurality of traffic properties for each TCP connection and checking for each of the traffic properties how well the traffic property matches a corresponding property of each session; associating each incoming packet that is conveyed over the certain TCP connection as belonging to the certain session; and processing each incoming packet associated with the certain session using a first logic for performing work per packet, the first logic comprising matching the incoming packet to a corresponding session included in a corresponding mapping of the plurality of mappings, wherein the matching of the incoming packet is based upon the active TCP connection of the corresponding mapping; wherein the instructions for iteratively updating comprise instructions for; processing an incoming notification message, the incoming notification message indicative of an initiation or a termination of a TCP connection, using a second logic for performing work per TCP connection being initiated or terminated, the second logic comprising performing an iteration of the updating.
-
Specification