Data stream classification

• US 9,106,432 B2
• Filed: 04/29/2013
• Issued: 08/11/2015
• Est. Priority Date: 02/25/2009
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Seren, Cetin, Wang, Jisheng, Ahlawat, Sharad, Xu, Yingqi, Kasi, Vijaya Sarathy
• Primary Examiner(s): CATTUNGAL, AJAY P
• Application Number:
  US13/872,960
• Publication Number:
  US 20130242980A1
• Time in Patent Office: 834 Days
• US Class Current: 1/1
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 47/2483 involving identification of individual flows
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 65/60 Network streaming of media packets
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.

Claims

1. A non-transitory computer-readable storage medium storing one or more instructions which, when executed by one or more processors, cause the one or more processors to perform:

controlling a computer to identify packets associated with a data stream originated by a voice over internet protocol (VoIP) application;

wherein the VoIP application is one of;

a SKYPE®

VoIP application, a VONAGE®

VoIP application, a GOOGLE TALK®

VoIP application, a TEAMSPEAK VoIP application, a VENTRILO VoIP application, a CISCO®

internet protocol television (CISCO®

IPTV) VoIP application, a YOUTUBE®

video application;

controlling the computer to update a set of characterization data that facilitates identifying the VoIP application that originated the data stream and comprises a set of classification statistics computed from data specific to the packets;

controlling the computer to assign a data stream classifier to the data stream;

wherein the data stream classifier is determined by comparing a portion of the set of characterization data to a set of identification data.

2. The non-transitory computer-readable storage medium of claim 1, wherein the instructions that cause updating the set of characterization data further comprise instructions which, when executed, cause the one or more processors to perform:

summing a packet size value into a packet size total, summing a square of the packet size value into a square of packet size total, summing an interval between packets value into a packet interval total, and summing a square of the interval between packets value into a square of packet interval total.

3. The non-transitory computer-readable storage medium of claim 2, further comprising instructions which, when executed, cause the one or more processors to perform:

determining that the set of characterization data indicates that a threshold probability has been achieved by;

calculating a current value of a statistical property based, at least in part, on a total, modifying a counter based, at least in part, on comparing the current value of the statistical property to a previously calculated value of the statistical property, and determining whether the counter has achieved a threshold value.

4. The non-transitory computer-readable storage medium of claim 3, wherein the current value is based on a set of data associated with a set of N consecutive most recently received packets, and where the previously calculated value is based on a set of data associated with a set of M consecutive packets that are a subset of the set of N consecutive most recently received packets, N and M being integers.

5. The non-transitory computer-readable storage medium of claim 1, further comprising instructions which, when executed, cause the one or more processors to perform:

controlling the computer to store an association between the data stream classifier and the data stream, and to provide a signal associated with the data stream classifier;

wherein the data stream classifier identifies the data stream as originating from the VoIP application;

wherein the data stream classifier identifies one of;

the VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, a conferencing application.

6. The non-transitory computer-readable storage medium of claim 5, further comprising instructions which, when executed, cause the one or more processors to perform:

controlling the computer to modify a quality of service setting for the data stream based, at least in part, on the signal;

controlling the computer to modify a set of bandwidth data associated with the data stream based, at least in part, on the signal;

wherein the set of bandwidth data facilitates one or more of;

determining billing information, analyzing network activity, reporting on network usage.

7. The non-transitory computer-readable storage medium of claim 6, wherein the instructions that cause comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream further comprise instructions which, when executed, cause the one or more processors to perform:

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream;

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream;

comparing a source port number associated with the packet to a source port number associated with the data stream;

comparing a destination port number associated with the packet to a destination port number associated with the data stream;

comparing a protocol associated with the packet to a protocol associated with the data stream.

8. The non-transitory computer-readable storage medium of claim 1, wherein the instructions that cause identifying packets associated with the data stream further comprise instructions which, when executed cause the one or more processors to perform:

comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream.

9. The non-transitory computer-readable storage medium of claim 1, wherein the instructions that cause comparing a portion of the set of characterization data to a set of identification data further comprise instructions which, when executed, cause the one or more processors to perform:

comparing average packet size data, comparing standard deviation of packet size data, comparing average interval time between packets data, and comparing standard deviation of interval time between packets data.

10. The non-transitory computer-readable storage medium of claim 1, wherein the set of identification data is training data.

11. A method comprising:

controlling a computer to identify packets associated with a data stream originated by a voice over internet protocol (VoIP) application;

wherein the VoIP application is one of;

a SKYPE®

VoIP application, a VONAGE®

VoIP application, a GOOGLE TALK®

VoIP application, a TEAMSPEAK VoIP application, a VENTRILO VoIP application, a CISCO®

internet protocol television (CISCO®

IPTV) VoIP application, a YOUTUBE®

video application;

controlling the computer to update a set of characterization data that facilitates identifying the VoIP application that originated the data stream and comprises a set of classification statistics computed from data specific to the packets;

controlling the computer to assign a data stream classifier to the data stream;

wherein the data stream classifier is determined by comparing a portion of the set of characterization data to a set of identification data;

wherein the method is performed by one or more computing devices.

12. The method of claim 11, wherein updating the set of characterization data comprises:

summing a packet size value into a packet size total, summing a square of the packet size value into a square of packet size total, summing an interval between packets value into a packet interval total, and summing a square of the interval between packets value into a square of packet interval total.

13. The method of claim 12, further comprising:

determining that the set of characterization data indicates that a threshold probability has been achieved by;

calculating a current value of a statistical property based, at least in part, on a total, modifying a counter based, at least in part, on comparing the current value of the statistical property to a previously calculated value of the statistical property, and determining whether the counter has achieved a threshold value.

14. The method of claim 13, wherein the current value is based on a set of data associated with a set of N consecutive most recently received packets, and where the previously calculated value is based on a set of data associated with a set of M consecutive packets that are a subset of the set of N consecutive most recently received packets, N and M being integers.

15. The method of claim 11, further comprising:

controlling the computer to store an association between the data stream classifier and the data stream, and to provide a signal associated with the data stream classifier;

wherein the data stream classifier identifies the data stream as originating from the VoIP application;

wherein the data stream classifier identifies one of;

the VoIP application, a file sharing application, a file transfer protocol (FTP) application, an internet browser, a chat application, a gaming application, a video application, an audio application, a conferencing application.

16. The method of claim 15, further comprising:

controlling the computer to modify a quality of service setting for the data stream based, at least in part, on the signal;

controlling the computer to modify a set of bandwidth data associated with the data stream based, at least in part, on the signal;

wherein the set of bandwidth data facilitates one or more of;

determining billing information, analyzing network activity, reporting on network usage.

17. The method of claim 16, wherein comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream comprises:

comparing a source internet protocol (IP) address associated with the packet to a source IP address associated with the data stream;

comparing a destination IP address associated with the packet to a destination IP address associated with the data stream;

comparing a source port number associated with the packet to a source port number associated with the data stream;

comparing a destination port number associated with the packet to a destination port number associated with the data stream;

comparing a protocol associated with the packet to a protocol associated with the data stream.

18. The method of claim 11, wherein identifying packets associated with the data stream comprises comparing a set of state data associated with a packet to a 5-tuple flow definition that describes the data stream.

19. The method of claim 11, wherein comparing a portion of the set of characterization data to a set of identification data comprises:

comparing average packet size data, comparing standard deviation of packet size data, comparing average interval time between packets data, and comparing standard deviation of interval time between packets data.

20. The method of claim 11, wherein the set of identification data is training data.