System and method for categorizing packet flows in a network

Patent metadata

Field	Value
Publication number	US-2016277299-A1
Application number	US-201514660811-A
Country	US
Kind code	A1
Filing date	Mar 17, 2015
Priority date	Mar 17, 2015
Publication date	Sep 22, 2016
Grant date	—

Abstract

A scheme for of categorizing packet flows through a network node, e.g., a proxy or router. In one embodiment, packets of a particular flow arriving at the node are monitored for determining whether there is a specific packet traffic pattern associated with the particular flow. Responsive to the determining, appropriate techniques may be utilized for recognizing the specific packet traffic pattern as belonging to a category of packet flow, e.g., ABR video flow.

First claim

What is claimed is:

1 . A method of categorizing packet flows through a node, the method comprising:
monitoring packets of a particular flow arriving at the node; determining that there is a specific packet traffic pattern associated with the particular flow based on a degree of correspondence between the monitored packets of the particular flow and a reference flow; responsive to the determining, recognizing the specific packet traffic pattern as belonging to a category of packet flow; and associating the category with the particular flow.

2 . The method as recited in claim 1 , further comprising:
transmitting an indication of the category of the particular flow to one or more downstream nodes.

3 . The method as recited in claim 1 , wherein the monitoring of packets is performed after determining that the particular flow belongs to a reference list of flows through the node.

4 . The method as recited in claim 3 , wherein the reference list of flows is determined by identifying flows having a volume greater than a select threshold over a period of time.

5 . The method as recited in claim 4 , wherein the identification of flows further comprises:
performing a volumetric analysis of flows based on source Internet Protocol (IP) addresses and destination IP addresses of all incoming packets; and selecting, based on the volumetric analysis, a flow identified by a source IP and destination IP address pair for inclusion in the reference list.

6 . The method as recited in claim 1 , wherein the degree of correspondence is determined to be a statistically significant correspondence.

7 . The method as recited in claim 1 , wherein the specific packet traffic pattern comprises a substantially periodic pattern of a group of values indicative of arrival of packets of the particular flow followed by a group of values indicative of absence of the packets of the particular flow over a period of time.

8 . The method as recited in claim 7 , wherein the group of values indicative of arrival of packets comprises a series of binary 1's, each binary 1 corresponding to an incoming packet of the particular flow.

9 . The method as recited in claim 8 , wherein the group of values indicative of absence of the packets comprises a series of binary 0's, each binary 0 corresponding to an indication that there is no incoming packet for the particular flow at a given time point in monitoring.

10 . The method as recited in claim 9 , wherein the category of the particular flow is recognized as an adaptive bitrate (ABR) video flow having a duty cycle, and further wherein the group of values indicative of presence of the arrival of packets corresponds to an active phase of the duty cycle and the group of values indicative of absence of the packets corresponds to a sleep phase of the duty cycle.

11 . The method as recited in claim 1 , wherein at least one of the acts of determining that there is a specific packet traffic pattern associated with the particular flow and recognizing the specific packet traffic pattern is performed at a Software-Defined Network (SDN) controller operatively associated with a plurality of data path elements arranged in an SDN.

12 . An apparatus for categorizing packet flows through a node, the apparatus comprising:
one or more processors; and a persistent memory coupled to the one or more processors, wherein the persistent memory includes instructions executable by one or more processors and configured to:
monitor packets of a particular flow arriving at the node;
determine that there is a specific packet traffic pattern associated with the particular flow based on a degree of correspondence between the monitored packets of the particular flow and a reference flow;
responsive to the determining, recognize the specific packet traffic pattern as belonging to a category of packet flow; and
associate the category with the particular flow.

13 . The apparatus as recited in claim 12 , wherein the persistent memory further includes instructions for transmitting an indication of the category of the particular flow to one or more downstream nodes.

14 . The apparatus as recited in claim 12 , wherein the persistent memory further includes comprises instructions for determining that the particular flow belongs to a reference list of flows through the node, and further wherein the monitoring of packets is performed after determining that the particular flow belongs to the reference list.

15 . The apparatus as recited in claim 14 , wherein the reference list of flows is determined by identifying flows having a volume greater than a select threshold over a period of time.

16 . The apparatus as recited in claim 15 , wherein the persistent memory comprises instructions configured to:
perform a volumetric analysis of flows based on source Internet Protocol (IP) addresses and destination IP addresses of all incoming packets; and select, based on the volumetric analysis, a flow identified by a source IP and destination IP address pair for inclusion in the reference list.

17 . The apparatus as recited in claim 12 , wherein the specific packet traffic pattern comprises a substantially periodic pattern of a group of values indicative of arrival of packets of the particular flow followed by a group of values indicative of absence of the packets of the particular flow over a period of time.

18 . The apparatus as recited in claim 17 , wherein the group of values indicative of the arrival of packets comprises a series of binary 1 's, each binary 1 corresponding to an incoming packet of the particular flow.

19 . The apparatus as recited in claim 18 , wherein the group of values indicative of absence of the packets comprises a series of binary 0's, each binary 0 corresponding to an indication that there is no incoming packet for the particular flow at a given time point in monitoring.

20 . The apparatus as recited in claim 19 , wherein the category of the particular flow is recognized as an adaptive bitrate (ABR) video flow having a duty cycle, and further wherein the group of values indicative of presence of the arrival of packets corresponds to an active phase of the duty cycle and the group of values indicative of absence of the packets corresponds to a sleep phase of the duty cycle.

21 . A node, comprising:
one or more processors; one or more ingress ports and one or more egress ports, each ingress port operating to receive incoming packets and each egress port operating to emit outgoing packets based on a routing process executed by the processors; and a packet tracker and pattern recognition module configured to categorize a packet flow having a source Internet Protocol (IP) address and a destination IP address based on observing a specific packet traffic pattern identified for the packet flow.

22 . The node as recited in claim 21 , wherein the packet tracker and pattern recognition module is further configured to categorize the packet flow as an adaptive bitrate (ABR) video flow having a duty cycle, responsive to observing a repetitive pattern of a group of packet arrival indicators followed by a group of packet absence indicators over a period of time.

23 . The node as recited in claim 22 , wherein the node is configured as one of a data center router associated with a content source generating the ABR video flow, an intermediary downstream router, an application-aware Hypertext Transfer Protocol (HTTP) proxy node, a Content Deli

Assignees

• Ericsson Telefon Ab L M

Inventors

• Kadaba Srinivas
• Phillips Chris

Classifications

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title

• H04L12/56

  Packet switching systems · CPC title

• H04L47/12 Primary

  Avoiding congestion; Recovering from congestion · CPC title

• H04L41/509

  wherein the managed service relates to media content delivery, e.g. audio, video or TV · CPC title