Detection and reporting of keepalive messages for optimization of keepalive traffic in a mobile network

• US 9,271,325 B2
• Filed: 04/30/2014
• Issued: 02/23/2016
• Est. Priority Date: 04/30/2013
• Status: Expired due to Fees

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Inventors: Backholm, Ari, Fleming, Michael, Kokhanovskyi, Andrii, Yoon, Sungwook
• Primary Examiner(s): Javaid, Jamal
• Application Number:
  US14/266,759
• Publication Number:
  US 20140321448A1
• Time in Patent Office: 664 Days
• Field of Search: 370/338, 370/229, 370/230, 370/252, 370/401
• US Class Current: 1/1
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04W 76/25 Maintenance of established connections

Abstract

Detection of network transactions or keepalives for maintaining long lived connections are disclosed. A keepalive detector can detect keepalive traffic based on keepalive parameters determined from an analysis of socket level network communication log data that record data transfer events including data sent from mobile applications or clients on a mobile device and data received by the mobile applications or clients on the mobile device, timing characteristics, protocol types, etc. Various statistical analyses can be performed on the network communication data to detect keepalives, taking into account variability in intervals of the data transfer events and sizes of data sent and received on each event. The keepalive detector can also detect keepalives from stream data on a mobile device by analyzing socket level communication messages including timing characteristics and amount of data transferred to detect keepalives and report keepalives using a data structure.

Claims

1. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

using at least a processor and memory for;

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from the TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein the one or more network transaction parameters include a regular interval and a regular size, both determined from the patterns of data sent from and received by the mobile application based on the statistical analysis.

2. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

using at least a processor and memory for;

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from the TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining a number of times a pattern occurs during a time interval;

performing a comparison of the number of times the pattern occurs to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

3. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

using at least a processor and memory for;

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from the TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining intervals between occurrences of a pattern;

determining a variance of the intervals;

performing a comparison of the variance to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

4. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

using at least a processor and memory for;

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from the TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining intervals between occurrences of a pattern;

determining a median of the intervals;

performing a comparison of the median to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

5. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

using at least a processor and memory for;

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from the TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining a number of times a pattern occurs sequentially;

performing a comparison of the number of times the pattern occurs sequentially to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

6. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:

using at least a processor and memory for;

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from the TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein optimizing in real-time the data sent further comprises;

minimizing a frequency of keepalive messages.

7. The method of claim 6 wherein the one or more network transaction parameters include similar or repeating content within the patterns of data sent from and received by the mobile application.

8. The method of claim 6 wherein the patterns of data sent from and received by the mobile application are recorded in a network communication log along with patterns of data sent from and received by other mobile applications on the mobile device.

9. The method of claim 6 wherein examining patterns of data further comprises:

storing the one or more network transaction parameters.

10. The method of claim 6 wherein examining, using statistical analysis, patterns of data, further comprises:

determining intervals between occurrences of a pattern;

determining a first quartile and a third quartile based on the determined intervals;

determining a difference between the first quartile and the third quartile;

determining a variance based on the difference and a median interval;

performing a comparison of the variance to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

11. The method of claim 6 wherein the identified network transactions are keepalive messages.

12. A device comprising:

a communication interface operable to communicatively couple the device to a network; and

a processor and a memory storing program codes, coupled to the communication interface, operable to;

examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determine one or more network transaction parameters based on the examination;

identify network transactions from a TCP stream based on the one or more network transaction parameters; and

optimize in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to;

determine a number of times a pattern occurs during a time interval;

perform a comparison of the number of times the pattern occurs to a threshold; and

based on the comparison, determine whether the pattern has been detected as regular.

13. A device comprising:

a communication interface operable to communicatively couple the device to a network; and

a processor and a memory storing program codes, coupled to the communication interface, operable to;

examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determine one or more network transaction parameters based on the examination;

identify network transactions from a TCP stream based on the one or more network transaction parameters; and

optimize in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to;

determine intervals between occurrences of a pattern;

determine a variance of the intervals;

perform a comparison of the variance to a threshold; and

based on the comparison, determine whether the pattern has been detected as regular.

14. A device comprising:

a communication interface operable to communicatively couple the device to a network; and

a processor and a memory storing program codes, coupled to the communication interface, operable to;

examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determine one or more network transaction parameters based on the examination;

identify network transactions from a TCP stream based on the one or more network transaction parameters; and

optimize in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to;

determine intervals between occurrences of a pattern;

determine a median of the intervals;

perform a comparison of the median to a threshold; and

based on the comparison, determine whether the pattern has been detected as regular.

15. A device comprising:

a communication interface operable to communicatively couple the device to a network; and

a processor and a memory storing program codes, coupled to the communication interface, operable to;

examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determine one or more network transaction parameters based on the examination;

identify network transactions from a TCP stream based on the one or more network transaction parameters; and

optimize in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to;

determine a number of times a pattern occurs sequentially;

perform a comparison of the number of times the pattern occurs sequentially to a threshold; and

based on the comparison, determine whether the pattern has been detected as regular.

16. A device comprising:

a communication interface operable to communicatively couple the device to a network; and

a processor and a memory storing program codes, coupled to the communication interface, operable to;

examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determine one or more network transaction parameters based on the examination;

identify network transactions from a TCP stream based on the one or more network transaction parameters; and

optimize in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, where in order to optimize in real-time the data sent the device is further operable to;

minimize a frequency of keepalive messages.

17. The device of claim 16 where in order to examine, using statistical analysis, patterns of data, the device is further operable to:

determine intervals between occurrences of a pattern;

determine a first quartile and a third quartile based on the determined intervals;

determine a difference between the first quartile and the third quartile;

determine a variance based on the difference and a median interval;

perform a comparison of the variance to a threshold; and

based on the comparison, determine whether the pattern has been detected as regular.

18. The device of claim 16 wherein the identified network transactions are keepalive messages.

19. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from a TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining a number of times a pattern occurs during a time interval;

performing a comparison of the number of times the pattern occurs to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

20. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from a TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining intervals between occurrences of a pattern;

determining a variance of the intervals;

performing a comparison of the variance to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

21. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from a TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining intervals between occurrences of a pattern;

determining a median of the intervals;

performing a comparison of the median to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

22. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from a TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises;

determining a number of times a pattern occurs sequentially;

performing a comparison of the number of times the pattern occurs sequentially to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

23. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:

examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device;

determining one or more network transaction parameters based on the examination;

identifying network transactions from a TCP stream based on the one or more network transaction parameters; and

optimizing in real-time data sent over a mobile network based on the identified network transactions,

wherein the network transactions occur over a same TCP session, and

wherein the one or more network transaction parameters include content following a certain pattern, wherein optimizing in real-time the data sent further comprises;

minimizing a frequency of keepalive messages.

24. The non-transitory computer-readable storage medium of claim 23 wherein examining, using statistical analysis, patterns of data, further comprises:

determining intervals between occurrences of a pattern;

determining a first quartile and a third quartile based on the determined intervals;

determining a difference between the first quartile and the third quartile;

determining a variance based on the difference and a median interval;

performing a comparison of the variance to a threshold; and

based on the comparison, determining whether the pattern has been detected as regular.

25. The non-transitory computer-readable storage medium of claim 23 wherein the identified network transactions are keepalive messages.