DATA STREAM CLASSIFICATION

• US 20100217886A1
• Filed: 02/25/2009
• Published: 08/26/2010
• Est. Priority Date: 02/25/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: KASI, Vijaya Sarathy, WANG, Jisheng, AHLAWAT, Sharad, XU, Yingqi, SEREN, Cetin
• Granted Patent: US 8,432,919 B2
• Time in Patent Office: Days
• US Class Current: 709/231
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.

Claims

1. A logic encoded in one or more tangible media for execution and when executed operable to perform a method, the method comprising:

controlling a computer to identify packets associated with a data stream, where the data stream comprises a sequence of packets transmitted from a source device to a destination device and where the data stream is associated with an application;

controlling the computer to update a set of characterization data associated with the data stream based, at least in part, on a piece of information associated with a packet, where the set of characterization data facilitates identifying the application with which the data stream is associated;

controlling the computer to assign a data stream classifier to the data stream, where the data stream classifier is determined by comparing a portion of the set of characterization data to a set of identification data upon determining that the set of characterization data indicates that a threshold probability that the data stream is able to be classified has been achieved; and

controlling the computer to store an association between the data stream classifier and the data stream and to provide a signal associated with the data stream classifier.

2. The logic of claim 1, where updating the set of characterization data comprises summing a packet size value into a packet size total, summing a square of the packet size value into a square of packet size total, summing an interval between packets value into a packet interval total, and summing a square of the interval between packets value into a square of packet interval total.

3. The logic of claim 2, where determining that the set of characterization data indicates that a threshold probability has been achieved comprises:

calculating a current value of a statistical property based, at least in part, on a total;

modifying a counter based, at least in part on, comparing the current value of the statistical property to a previously calculated value of the statistical property; and

determining whether the counter has achieved a threshold value.

4. The logic of claim 3, where the current value is based on a set of data associated with a set of N consecutive most recently received packets, and where the previously calculated value is based on a set of data associated with a set of M consecutive packets that are a subset of the set of N consecutive most recently received packets, N and M being integers.

5. The logic of claim 1, where the data stream classifier identifies the stream as originating from a voice over internet protocol (VoIP) application and where the VoIP application is one of a VONAGE®

VoIP application and a SKYPE®

VoIP application.

6. The logic of claim 1, where identifying packets associated with the data stream comprises comparing a set of state data associated with the packet to a 5-tuple flow definition that describes the data stream.

7. The logic of claim 6, where comparing the set of state data associated with a packet to the 5-tuple flow definition that describes the data stream comprises:

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream,

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream,

comparing a source port number associated with the packet to a source port number associated with the data stream,

comparing a destination port number associated with the packet to a destination port number associated with the data stream, and

comparing a protocol associated with the packet to a protocol associated with the data stream.

8. The logic of claim 1, where comparing a portion of the set of characterization data to the identification data comprises:

comparing average packet size data,

comparing standard deviation of packet size data,

comparing average interval time between packets data, and

comparing standard deviation of interval time between packets data.

9. The logic of claim 1, where the data stream classifier identifies the data stream as originating from an application.

10. The logic of claim 9, where the application is one of, a voice over internet protocol (VoIP) application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, and a conferencing application.

11. The logic of claim 10, where the application is a VoIP application and where the VoIP application is one of, a SKYPE®

VoIP application, a VONAGE®

VoIP application, a GOOGLE TALK®

VoIP application, a TEAMSPEAK VoIP application, a VENTRILO VoIP application, and a CISCO®

internet protocol television (CISCO®

IPTV) VoIP application.

12. The logic of claim 10, where the application is a video application and the video application is a YOUTUBE®

video application.

13. The logic of claim 1, where the signal associated with the data stream classifier is provided to a network device.

14. The logic of claim 13, comprising controlling the network device to modify a quality of service setting for the data stream based, at least in part, on the signal.

15. The logic of claim 13, comprising controlling the network device to modify a set of bandwidth data associated with the data stream based, at least in part, on the signal.

16. The logic of claim 15, where the set of bandwidth data facilitates, one or more of, determining billing information, analyzing network activity, and reporting on network usage.

17. The logic of claim 1, where the set of identification data is training data.

18. A system, comprising:

a data store to store a set of classification information associated with a data stream, where the set of classification information comprises a set of classification statistics and a data stream classifier, where the data stream comprises a sequence of packets transmitted from a source device to a destination device, and where the data stream is associated with an application;

a data recording logic to update the set of classification statistics in the data store based on lightweight computations performed on one or more packets from the data stream, where a lightweight computation is a computation that relies on a property of a packet;

a classification logic to update the data stream classifier in the data store, where the data stream classifier is updated based, at least in part, on comparing a portion of the set of the classification statistics to a set of identification data upon determining that a portion of the set of the classification statistics indicates that a threshold probability that the data stream is able to be classified has been achieved.

19. The system of claim 18, comprising a quality of service logic to control packet handling in the data stream based, at least in part, on the data stream classifier.

20. The system of claim 18, where the data stream is associated with a voice over internet protocol (VoIP) application and where the VoIP application is one of a VONAGE®

VoIP application and a SKYPE®

VoIP application.

21. The system of claim 18, where the lightweight computations include computing a packet size and computing an interval time between two packets.

22. The system of claim 18, where comparing a portion of the set of the classification statistics to the set of identification data comprises:

comparing average packet size data,

comparing standard deviation of packet size data,

comparing average interval time between packets data, and

comparing standard deviation of interval time between packets data.

23. The system of claim 18, where comparing a portion of the set of classification statistics to the set of identification data comprises comparing one or more of, average packet size data, standard deviation of packet size data, average interval time between packets data, standard deviation of interval time between packets data, histogram data, cross correlation data, and packet distribution data.

24. The system of claim 18, where the identification data comprises a value that is a function of one or more of, a set of average packet size data, a set of average interval time between packets data, a set of standard deviation of packet size data, and a set of standard deviation of interval time between packets data.

25. A system, comprising:

means for storing a set of classification statistics associated with a data stream and for storing a data stream classifier;

means for updating the set of classification statistics based on data associated with the packets from the data stream; and

means for transforming the data stream classifier by comparing a portion of the set of classification statistics to a set of identification data upon determining that the set of classification statistics indicates that that a threshold probability that the data stream is able to be classified has been achieved.