Communication traffic type determination devices and methods
Communication traffic type determination devices and methods are disclosed. A received block of communication traffic is concurrently analyzed relative to multiple traffic type definitions, and indications of whether the received block of communication traffic conforms to the traffic type definitions are provided. Concurrent analysis of the same traffic block relative to different traffic type definitions can reduce the amount of time that might otherwise be involved in determining a type of the traffic block. Evaluation of traffic against multiple definitions may also allow traffic to be classified or verified more specifically than would be possible based solely on explicit type indications provided in traffic overhead.
1. A device comprising:
an interface for receiving blocks of communication traffic;
a plurality of analysis modules operatively coupled to the interface and operable to concurrently analyze a received block of communication traffic relative to respective traffic type definitions, each analysis module of the plurality of analysis modules being further operable to provide an indication of whether the received block of communication traffic conforms to its respective traffic type definition; and
a definition set selector operatively coupled to the interface and to the plurality of analysis modules,
wherein the respective traffic type definitions comprise definitions associated with a level in a multi-level traffic type definition,
wherein the level comprises a predetermined level in a hierarchy of the multi-level traffic type definition,
wherein the definition set selector is operable to detect, in overhead of the received block of communication traffic, an indication of a type of the received block of communication traffic at a level of the multi-level traffic type definition that is higher in the hierarchy than the predetermined level,
wherein the hierarchy comprises groups of types at the predetermined level associated with respective types at the higher level, and wherein the plurality of analysis modules comprises respective groups of analysis modules corresponding to the groups of types.
2. The device of claim 1 , wherein the plurality of analysis modules comprises at least one analysis module implemented in software for execution by a processing element.
3. The device of claim 1 , wherein the definition set selector is further operable to determine by which analysis modules the received block of communication traffic is to be analyzed.
4. The device of claim 1 , wherein each indication of whether the received block of communication traffic conforms to a respective traffic type definition comprises a likelihood indication.
5. The device of claim 4 , wherein the indication further comprises, where the likelihood indication for a traffic type definition is below a threshold, an indication of differences between the received block of communication traffic and the traffic type definition.
6. The device of claim 4 , further comprising a filter operatively coupled to the plurality of analysis modules and operable to provide as a traffic type decision output a set of one or more highest likelihood indications among the indications.
7. The device of claim 1 , wherein each of the blocks of communication traffic comprises a packet.
8. The device of claim 1 , further comprising:
a replicator operatively coupled to the interface and operable to replicate the received block of communication traffic, and to provide replicated copies of the received block of communication traffic to the plurality of analysis modules.
9. A device comprising:
an interface for receiving blocks of communication traffic;
a plurality of analysis modules operatively coupled to the interface and operable to concurrently analyze a received block of communication traffic relative to respective traffic type definitions, each analysis module of the plurality of analysis modules being further operable to provide an indication of whether the received block of communication traffic conforms to its respective traffic type definition, wherein the respective traffic type definitions comprise definitions associated with a level in a multi-level traffic type definition;
a plurality of further analysis modules operatively coupled to the interface and operable to concurrently analyze the received block of communication traffic relative to respective further traffic type definitions associated with a different level in the multi-level traffic type definition, and to provide an indication of whether the received block of communication traffic conforms to each of the respective further traffic type definitions; and
a definition set selector operatively coupled to the interface, to the plurality of analysis modules, and to the plurality of further analysis modules, the definition set selector being operable to detect, in overhead of the received block of communication traffic, an indication of a type of the received block of communication traffic at a level of the multi-level traffic type definition, and to determine, based on the detected indication and a hierarchy of the multi-level traffic type definition, whether the received block of communication traffic is to be analyzed by the analysis modules or by the further analysis modules.
10. The device of claim 9 , further comprising:
a replicator operatively coupled to the interface and operable to replicate the received block of communication traffic, and to provide replicated copies of the received block of communication traffic to the plurality of analysis modules.
11. A device comprising:
an interface for receiving blocks of communication traffic;
a plurality of analysis modules operatively coupled to the interface and operable to concurrently analyze a received block of communication traffic relative to respective traffic type definitions, each analysis module of the plurality of analysis modules being further operable to provide an indication of whether the received block of communication traffic conforms to its respective traffic type definition; and
a parameter input interface operatively coupled to the plurality of analysis modules and operable to receive and provide to the plurality of analysis modules a type determination parameter, the plurality of analysis modules comprising an analysis module that is operable to determine whether the received block of communication traffic conforms to its respective traffic type definition based on the received block of communication traffic and the received type determination parameter,
wherein the type determination parameter comprises at least one of: a time of day, an alert associated with a communication system through which the communication traffic is received, a communication traffic history, and, where the respective traffic type definitions comprise definitions associated with a level in a multi-level traffic type definition, an indication of whether the received block of communication traffic conforms to a further traffic type definition associated with a different level in the multi-level traffic type definition.
12. The device of claim 11 , further comprising:
a replicator operatively coupled to the interface and operable to replicate the received block of communication traffic, and to provide replicated copies of the received block of communication traffic to the plurality of analysis modules.
13. A method comprising:
receiving a block of communication traffic;
a plurality of analysis modules, comprising at least one analysis module implemented using a processing element, performing a parallel analysis of the received block of communication traffic relative to a plurality of traffic type definitions, the plurality of analysis modules being operable to concurrently analyze the received block of communication traffic relative to respective traffic type definitions of the plurality of traffic type definitions; and
each analysis module of the plurality of analysis modules providing a respective indication of whether the received block of communication traffic conforms to its respective traffic type definition of the plurality of traffic type definitions,
wherein the plurality of traffic type definitions comprises definitions associated with a predetermined level in a hierarchy of a multilevel traffic type definition,
the method further comprising, where the hierarchy comprises groups of types at the predetermined level associated with respective types at a higher level in the hierarchy, determining a type of the received block of communication traffic at the higher level,
wherein performing comprises the plurality of analysis modules analyzing the received block of communication traffic relative to each traffic type definition corresponding to a type in the group of types associated with the determined type.
14. The method of claim 13 , further comprising:
detecting, in overhead of the received block of communication traffic, an indication of a type of the received block of communication traffic at a level in a hierarchy of a multi-level traffic type definition; and
selecting the plurality of traffic type definitions, from traffic type definitions associated with a plurality of levels in the hierarchy, based on the detected indication.
15. The method of claim 13 , wherein providing comprises:
each analysis module of the plurality of analysis modules providing a likelihood indication; and
each analysis module of the plurality of analysis modules providing an indication of differences between the received block of communication traffic and its respective traffic type definition where the likelihood indication provided by the analysis module is below a threshold.
16. The method of claim 13 , further comprising:
receiving a type determination parameter; and
determining whether the received block of communication traffic conforms to a traffic type definition of the plurality of traffic type definitions based on the received block of communication traffic and the received type determination parameter.
17. The method of claim 13 , further comprising:
replicating the received block of communication traffic; and
providing replicated copies of the received block of communication traffic to the plurality of analysis modules.