Data stream classification

• US 8,432,919 B2
• Filed: 02/25/2009
• Issued: 04/30/2013
• Est. Priority Date: 02/25/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Seren, Cetin, Ahlawat, Sharad, Xu, Yingqi, Kasi, Vijaya Sarathy, Wang, Jisheng
• Primary Examiner(s): Phillips, Hassan
• Assistant Examiner(s): CATTUNGAL, AJAY P
• Application Number:
  US12/392,186
• Publication Number:
  US 20100217886A1
• Time in Patent Office: 1,525 Days
• Field of Search: 370/230, 370/235, 370/312, 370/395.2, 370/395.3, 370/488, 370/497, 726/12, 726/13, 726/23, 707/754, 707/755
• US Class Current: 370/395.3
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.

Claims

1. A logic encoded in one or more non-transitory computer-readable tangible storage media for execution and when executed operable to perform a method, the method comprising:

controlling a computer to identify packets associated with a data stream, where the data stream comprises a sequence of packets transmitted from a source device to a destination device and where the data stream was originated by a voice over internet protocol (VoIP) application;

controlling the computer to update a set of characterization data associated with the data stream based, at least in part, on a piece of information associated with the sequence of packets, where the set of characterization data facilitates identifying the VoIP application that originated the data stream;

where the set of characterization data comprises a set of classification statistics computed from data specific to the sequence of packets;

controlling the computer to assign a data stream classifier to the data stream, where the data stream classifier is determined by comparing a portion of the set of characterization data to a set of identification data upon determining that the set of characterization data indicates that a threshold probability that the data stream is able to be classified has been achieved; and

controlling the computer to store an association between the data stream classifier and the data stream and to provide a signal associated with the data stream classifier.

2. The logic of claim 1, where updating the set of characterization data comprises summing a packet size value into a packet size total, summing a square of the packet size value into a square of packet size total, summing an interval between packets value into a packet interval total, and summing a square of the interval between packets value into a square of packet interval total.

3. The logic of claim 2, where determining that the set of characterization data indicates that a threshold probability has been achieved comprises:

calculating a current value of a statistical property based, at least in part, on a total;

modifying a counter based, at least in part on, comparing the current value of the statistical property to a previously calculated value of the statistical property; and

determining whether the counter has achieved a threshold value.

4. The logic of claim 3, where the current value is based on a set of data

associated with a set of N consecutive most recently received packets, and where the previously calculated value is based on a set of data associated with a set of M consecutive packets that are a subset of the set of N consecutive most recently received packets, N and M being integers.

5. The logic of claim 1, where the data stream classifier identifies the stream as originating from the VoIP application and where the VoIP application is one of a VONAGE®

VoIP application and a SKYPE®

VoIP application.

6. The logic of claim 1, where identifying packets associated with the data stream comprises comparing a set of state data associated with the packet to a 5-tuple flow definition that describes the data stream.

7. The logic of claim 6, where comparing the set of state data associated with a packet to the 5-tuple flow definition that describes the data stream comprises:

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream,

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream,

comparing a source port number associated with the packet to a source port number associated with the data stream,

comparing a destination port number associated with the packet to a destination port number associated with the data stream, and

comparing a protocol associated with the packet to a protocol associated with the data stream.

8. The logic of claim 1, where comparing a portion of the set of characterization data to the identification data comprises:

comparing average packet size data,

comparing standard deviation of packet size data,

comparing average interval time between packets data, and

comparing standard deviation of interval time between packets data.

9. The logic of claim 1, where the data stream classifier identifies one of, the VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, and a conferencing application.

10. The logic of claim 9, where the VoIP application is one of, a SKYPE®

VoIP application, a VONAGE®

VoIP application, a GOOGLE TALK®

VoIP application, a TEAMSPEAK VoIP application, a VENTRILO VoIP application, and a CISCO®

internet protocol television (CISCO®

IPTV) VoIP application.

11. The logic of claim 9, where the VoIP application is a video application and the video application is a YOUTUBE®

video application.

12. The logic of claim 1, where the signal associated with the data stream classifier is provided to a network device.

13. The logic of claim 12, comprising controlling the network device to modify a quality of service setting for the data stream based, at least in part, on the signal.

14. The logic of claim 12, comprising controlling the network device to modify a set of bandwidth data associated with the data stream based, at least in part, on the signal.

15. The logic of claim 14, where the set of bandwidth data facilitates, one or more of, determining billing information, analyzing network activity, and reporting on network usage.

16. The logic of claim 1, where the set of identification data is training data.

17. A system, comprising:

a data store to store a set of classification information associated with a data stream, where the set of classification information comprises a set of classification statistics and a data stream classifier, where the data stream comprises a sequence of packets transmitted from a source device to a destination device, and where the data stream was originated by a voice over internet protocol (VoIP) application;

a data recording logic to update the set of classification statistics and a set of characterization data associated with the data stream in the data store, based on lightweight statistical computations performed on data specific to the sequence of packets from the data stream, where a lightweight computation is a computation that relies on properties of the sequence of packets, where the set of characterization data facilitates identifying the VoIP application that originated the data stream;

a classification logic to update the data stream classifier in the data store, where the data stream classifier is updated based, at least in part, on comparing a portion of the set of the classification statistics to a set of identification data upon determining that a portion of the set of the classification statistics indicates that a threshold probability that the data stream is able to be classified has been achieved.

18. The system of claim 17, comprising a quality of service logic to control packet handling in the data stream based, at least in part, on the data stream classifier.

19. The system of claim 17, where the VoIP application is one of a VONAGE®

VoIP application and a SKYPE®

VoIP application.

20. The system of claim 17, where the lightweight computations include computing a packet size and computing an interval time between two packets.

21. The system of claim 17, where comparing a portion of the set of the classification statistics to the set of identification data comprises:

comparing average packet size data,

comparing standard deviation of packet size data,

comparing average interval time between packets data, and

comparing standard deviation of interval time between packets data.

22. The system of claim 17, where comparing a portion of the set of classification statistics to the set of identification data comprises comparing one or more of, average packet size data, standard deviation of packet size data, average interval time between packets data, standard deviation of interval time between packets data, histogram data, cross correlation data, and packet distribution data.

23. The system of claim 17, where the identification data comprises a value that is a function of one or more of, a set of average packet size data, a set of average interval time between packets data, a set of standard deviation of packet size data, and a set of standard deviation of interval time between packets data.

24. A system, comprising:

means for storing a set of classification statistics associated with a data stream and for storing a data stream classifier;

where the set of classification statistics is computed from data specific to a sequence of packets included in the data stream;

means for updating the set of classification statistics and a set of characterization data associated with the data stream based, at least in part, on a piece of information associated with the sequence of packets from the data stream, where the data set of characterization data facilitates identifying a VoIP application with which the data stream is associated; and

means for transforming the data stream classifier by comparing a portion of the set of classification statistics to a set of identification data upon determining that the set of classification statistics indicates that that a threshold probability that the data stream is able to be classified has been achieved.

25. The system of claim 24, where the means for updating the set of classification statistics further comprises means for summing a packet size value into a packet size total, summing a square of the packet size value into a square of packet size total, summing an interval between packets value into a packet interval total, and summing a square of the interval between packets value into a square of packet interval total.

26. The system of claim 25, where the means for determining that the set of classification statistics indicates that a threshold probability has been achieved further comprises:

means for calculating a current value of a statistical property based, at least in part, on a total;

means for modifying a counter based, at least in part on, comparing the current value of the statistical property to a previously calculated value of the statistical property; and

means for determining whether the counter has achieved a threshold value.

27. The system of claim 26, where the current value is based on a set of data associated with a set of N consecutive most recently received packets, and where the previously calculated value is based on a set of data associated with a set of M consecutive packets that are a subset of the set of N consecutive most recently received packets, N and M being integers.

28. The system of claim 24, where the data stream classifier identifies the stream as originating from the VoIP application and where the VoIP application is one of a VONAGE®

VoIP application and a SKYPE®

VoIP application.

29. A method comprising:

controlling a computer to identify packets associated with a data stream, where the data stream comprises a sequence of packets transmitted from a source device to a destination device and where the data stream was originated by a voice over internet protocol (VoIP) application;

controlling the computer to update a set of characterization data associated with the data stream based, at least in part, on a piece of information associated with the sequence of packets, where the set of characterization data facilitates identifying the VoIP application that originated the data stream, where the set of characterization data comprises a set of classification statistics computed from data associated with the sequence of packets;

controlling the computer to assign a data stream classifier to the data stream, where the data stream classifier is determined by comparing a portion of the set of characterization data to a set of identification data upon determining that the set of characterization data indicates that a threshold probability that the data stream is able to be classified has been achieved; and

controlling the computer to store an association between the data stream classifier and the data stream and to provide a signal associated with the data stream classifier;

wherein the method is performed by one or more computing devices.

30. The method of claim 29, where updating the set of characterization data comprises summing a packet size value into a packet size total, summing a square of the packet size value into a square of packet size total, summing an interval between packets value into a packet interval total, and summing a square of the interval between packets value into a square of packet interval total.

31. The method of claim 30, where determining that the set of characterization data indicates that a threshold probability has been achieved comprises:

calculating a current value of a statistical property based, at least in part, on a total;

modifying a counter based, at least in part on, comparing the current value of the statistical property to a previously calculated value of the statistical property; and

determining whether the counter has achieved a threshold value.

32. The method of claim 31, where the current value is based on a set of data associated with a set of N consecutive most recently received packets, and where the previously calculated value is based on a set of data associated with a set of M consecutive packets that are a subset of the set of N consecutive most recently received packets, N and M being integers.

33. The method of claim 29, where the data stream classifier identifies the stream as originating from the VoIP application and where the VoIP application is one of a VONAGE®

VoIP application and a SKYPE®

VoIP application.