Flow inspection
View Patent ↗A communication system detects particular application protocols in response to their message traffic patterns, which might be responsive to packet size, average packet rate, burstiness of packet transmissions, or other message pattern features. Selected message pattern features include average packet rate, maximum packet burst, maximum future accumulation, minimum packet size, and maximum packet size. The system maintains a counter of packet tokens, each arriving at a constant rate, and maintains a queue of real packets. Each real packet is released from the queue when there is a corresponding packet token also available for release. Packet tokens overfilling the counter, and real packets overfilling the queue, are discarded. Users might add or alter application protocol descriptions to account for profiles thereof.
1. A method, including steps of
determining a set of message pattern features;
detecting one or more application protocols in response to those message pattern features;
treating one or more packets included in those application protocols in response to those steps of detecting; and
detecting more and more application protocols in response to inspection of packets; and wherein those steps of treating are responsive to those steps of detecting in response to inspection of packets;
wherein those steps of detecting include steps of
first maintaining a counter of messages expected to arrive within a first known time duration;
second maintaining a set of messages actually arriving within a second known time duration, that second known time duration being responsive to that first known time duration; and
comparing a result of those steps of first maintaining with a result of those steps of second maintaining
wherein those steps of first maintaining include steps of
increasing that counter according to a selected distribution, between first selected minimum and maximum counter values; and
decreasing that counter each time a message is released from a queue, between second selected minimum and maximum counter values;
wherein those steps of decreasing that counter include a selected mapping between those steps of increasing and those steps of decreasing.
2. A method as in claim 1 , wherein that set of message pattern features includes at least one of: rate, burstiness, accumulation, size parameters.
3. A method as in claim 1 , wherein those steps of detecting include steps of
identifying whether message traffic adheres to a selected set of message pattern features;
indicating whether one or more packets are included in a set of particular application protocols, in response to at least one result of those steps of identifying.
4. A method as in claim 1 , wherein those steps of detecting include steps of
identifying whether message traffic adheres to a selected set of message pattern features;
indicating whether one or more packets are not included in a set of particular application protocols, in response to at least one result of those steps of identifying.
5. A method as in 1 , wherein those steps of comparing include steps of matching a first number of those counters with a second number of those messages.
6. A method as in claim 1 , wherein those steps of comparing include steps of releasing those messages in response to receipt of a number of those counters.
7. A method as in claim 1 , wherein that selected mapping between those steps of increasing and those steps of decreasing includes a one-to-one mapping between incoming tokens and released packets.
8. A method as in claim 1 , wherein that selected mapping between those steps of increasing and those steps of decreasing includes a mapping between incoming tokens and released packets that is responsive to an amount of time it would take to transmit each such packet.
9. A method as in claim 1 , wherein that selected mapping between those steps of increasing and those steps of decreasing includes a mapping between incoming tokens and released packets that is responsive to a linear function of an amount of time it would take to transmit each such packet.
10. A method as in claim 1 , wherein that selected mapping between those steps of increasing and those steps of decreasing includes a mapping between incoming tokens and released packets that is responsive to a size of each such packet.
11. A method as in claim 1 , wherein that selected mapping between those steps of increasing and those steps of decreasing includes a mapping between incoming tokens and released packets that is responsive to a linear function of a size of each such packet.
12. A method as in claim 1 , wherein that selected distribution includes a constant rate per unit time.
13. A method as in claim 1 , wherein that selected distribution includes a inconstant rate per unit time, averaging a selected rate per unit time.
14. A method as in claim 1 , wherein that selected distribution includes at least one of: a Poisson arrival distribution, a Bernoulli arrival distribution, another nonlinear arrival distribution.
15. A method as in claim 1 , wherein those first and second selected
counter values are identical.
16. A method as in claim 1 , wherein those selected maximum counter values axe finite.
17. A method as in claim 1 , wherein those selected minimum counter values axe nonnegative.
18. A method as in claim 1 , wherein those steps of second maintaining include steps of
adding messages to that set upon arrival; removing messages from that set upon release; and
removing messages from that set upon exceeding a selected maximum number of messages.
19. A method as in claim 18 , wherein that selected maximum number of messages is finite.
20. A method as in claim 1 , wherein those steps of treating include steps of applying distinct rules to messages in response to those steps of detecting.
21. A method as in claim 20 , wherein those steps of treating include steps of discarding packets detected to be included in selected particular application protocols.
22. A method as in claim 20 , wherein those steps of treating include steps of discarding packets detected to not be included in selected particular application protocols.
23. A method as in claim 1 , wherein those steps of treating include steps of
identifying packets between a first set of size bounds as belonging to an identified message traffic pattern,
so long as a selected number of packets between a second set of size bounds arrived with a selected previous time interval.
24. A method as in claim 23 , wherein at least one of those first set of size bounds, second set of size bounds, are constant.
25. A method as in claim 23 , wherein at least one of those first set of size bounds, second set of size bounds, are time-varying.
26. A method as in claim 23 , wherein that selected previous time interval is constant.
27. A method as in claim 23 , wherein that selected previous time interval is substantially time-varying.
28. A physical non-transitory medium including information interpretable by a computing device, the information including
instructions determining a set of message pattern features;
instructions detecting one or more application protocols in response to those message pattern features;
instructions treating one or more packets included in those application protocols in response to those instructions detecting,
instructions detecting more and more application protocols in response to inspection of packets; and
and wherein those instructions treating are responsive to those instructions detecting in response to inspection of packets;
wherein those instructions detecting include information interpretable by a computing device, the information including
instructions first maintaining a counter of messages expected to arrive within a first known time duration;
instructions second maintaining a set of messages actually arriving with\-in a second known time duration, that second known time duration being responsive to that first known time duration; and
instructions comparing a result of those instructions first maintaining with a result of those instructions second maintaining;
wherein those instructions first maintaining include information interpretable by a computing device, the information including
instructions increasing that counter according to a selected distribution, between first selected minimum and maximum counter values; and
instructions decreasing that counter each time a message is released from that queue, between second selected minimum and maximum counter values;
wherein those instructions de\-creasing that counter include a selected mapping between increasing and decreasing.
29. A physical medium as in claim 28 , wherein that set of message pattern features includes at least one of: rate, burstiness, accumulation, size parameters.
30. A physical medium as in claim 28 , wherein those instructions detecting include information interpretable by a computing device, the information including
instructions identifying whether message traffic adheres to a selected set of message pattern features;
instructions indicating whether one or more packets are included in a set of particular application protocols, in response to those instructions identifying.
31. A physical medium as in 28 , wherein those instructions detecting include information interpretable by a computing device, the information including
instructions identifying whether message traffic adheres to a selected set of message pattern features;
instructions indicating whether one or more packets are not included in a set of particular application protocols, in response to those instructions identifying.
32. A physical non-transitory medium as in claim 28 , wherein those instructions comparing include information interpretable by a computing device, the information including instructions matching a first number of those counters with a second number of those messages.
33. A physical non-transitory medium as in claim 28 , wherein those instructions comparing include information interpretable by a computing device, the information including instructions releasing those messages in response to receipt of a number of those counters.
34. A physical non-transitory medium as in claim 28 , wherein that selected mapping between increasing and decreasing includes a one-to-one mapping between incoming tokens and released packets.
35. A physical non-transitory medium as in claim 28 , wherein that selected mapping between increasing and decreasing includes a mapping between incoming tokens and released packets that is responsive to an amount of time it would take to transmit each such packet.
36. A physical non-transitory medium as in claim 28 , wherein that selected mapping between increasing and decreasing includes a mapping between incoming tokens and released packets that is responsive to a linear function of an amount of time it would take to transmit each such packet.
37. A physical non-transitory medium as in claim 28 , wherein that selected mapping between increasing and decreasing includes a mapping between incoming tokens and released packets that is responsive to a size of each such packet.
38. A physical non-transitory medium as in claim 28 , wherein that selected mapping between increasing and decreasing includes a mapping between incoming tokens and released packets that is responsive to a linear function of a size of each such packet.
39. A physical non-transitory medium as in claim 28 , wherein that selected distribution includes a substantially constant rate per unit time.
40. A physical non-transitory medium as in 28 , wherein that selected distribution includes a inconstant rate per unit time, averaging a selected rate per unit time.
41. A physical non-transitory medium as in claim 28 , wherein that selected distribution includes at least one of a Poisson arrival distribution, a Bernoulli arrival distribution, another nonlinear arrival distribution.
42. A physical non-transitory medium as in claim 28 , wherein those first and second selected counter values are substantially identical.
43. A physical non-transitory medium as in claim 28 , wherein those selected maximum counter values are substantially finite.
44. A physical non-transitory medium as in claim 28 , wherein those selected minimum counter values are substantially nonnegative.
45. A physical non-transitory medium as in claim 28 , wherein those instructions second maintaining include information interpretable by a computing device, the information including
instructions adding messages to that set upon arrival; instructions removing messages from that set upon release; and
instructions removing messages from that set upon exceeding a selected maximum number of messages.
46. A physical non-transitory medium as in claim 45 , wherein that selected maximum number of messages is finite.
47. A physical medium as in 28 , wherein those instructions treating include information interpretable by a computing device, the information including instructions applying distinct rules to messages in response to those instructions detecting.
48. A physical medium as in claim 47 , wherein those instructions treating include information interpretable by a computing device, the information including instructions discarding packets detected to be included in selected particular application protocols.
49. A physical medium as in claim 47 , wherein those instructions treating include information interpretable by a computing device, the information including instructions discarding packets detected to not be included in selected particular application protocols.
50. A physical medium as in claim 47 , wherein those instructions treating include
instructions identifying packets between a first set of size bounds as belonging to an identified message traffic pattern,
so long as a selected number of packets between a second set of size bounds arrived with a selected previous time interval.
51. A physical non-transitory medium as in claim 50 , wherein at least one of those first set of size bounds, second set of size bounds, are constant.
52. A physical non-transitory medium as in claim 50 , wherein at least one of those first set of size bounds, second set of size bounds, are time-varying.
53. A physical non-transitory medium as in claim 50 , wherein that selected previous time interval is substantially constant.
54. A physical non-transitory medium as in claim 50 , wherein that selected previous time interval is substantially time-varying.
55. Apparatus as in claim 28 , wherein that selected distribution includes a inconstant rate per unit time, averaging a selected rate per unit time.
56. Apparatus as in claim 28 , wherein that selected distribution includes at least one of: a Poisson arrival distribution, a Bernoulli arrival distribution, another nonlinear arrival distribution.
57. Apparatus including a computing device, the computing device including
component determining a set of message pattern features;
component detecting one or more application protocols in response to those message pattern features;
component treating one or more packets included in those application protocols in response to those means for detecting;
component detecting more and more application protocols in response to inspection of packets; and
wherein that computing device treating is responsive to those instructions detecting in response to inspection of packets;
wherein that computing device detecting includes
component maintaining a counter of messages expected to arrive within a first known time duration;
component maintaining a set of messages actually arriving within a second known time duration, that second known time duration being responsive to that first known time duration; and
a comparator coupled to that counter of messages and that set of messages,
wherein that component maintaining a counter includes
a counter incrementor operating according to a selected distribution, between first selected minimum and maximum counter values; and
a counter decrementor operating each time a message is released from that queue, between second selected minimum and maximum counter values;
a selected mapping between that incrementor and that decrementor.
58. Apparatus as in claim 57 , wherein that set of message pattern features includes at least one of: rate, burstiness, accumulation, size parameters.
59. Apparatus as in claim 57 , wherein that logic detecting include
logic identifying whether message traffic adheres to a selected set of message pattern features;
logic indicating whether one or more packets are included in a set of particular application protocols, in response to that logic identifying.
60. Apparatus as in claim 57 , wherein that logic detecting includes
logic identifying whether message traffic adheres to a selected set of message pattern features;
logic indicating whether one or more packets are not included in a set of particular application protocols, in response to those means for identifying.
61. Apparatus as in claim 28 , wherein that comparator includes component matching a first number of those counters with a second number of those messages.
62. Apparatus as in claim 57 , including logic releasing those messages in response to an output of that comparator.
63. Apparatus as in claim 57 , wherein that selected mapping between that incrementor and that decrementor includes a one-to-one mapping between incoming tokens and released packets.
64. Apparatus as in claim 57 , wherein that selected mapping between that incrementor and that decrementor includes a mapping between incoming tokens and released packets that is responsive to an amount of time it would take to transmit each such packet.
65. Apparatus as in claim 57 , wherein that selected mapping between that incrementor and that decrementor includes a mapping between incoming tokens and released packets that is responsive to a linear function of an amount of time it would take to transmit each such packet.
66. Apparatus as in claim 57 , wherein that selected mapping between that incrementor and that decrementor includes a mapping between incoming tokens and released packets that is responsive to a size of each such packet.
67. Apparatus as in claim 57 , wherein that selected mapping between that incrementor and that decrementor includes a mapping between incoming tokens and released packets that is responsive to a linear function of a size of each such packet.
68. Apparatus as in claim 57 , wherein that selected distribution includes a constant rate per unit time.
69. Apparatus as in claim 57 , wherein those first and second selected counter values are identical.
70. Apparatus as in claim 57 , wherein those selected maximum counter values are finite.
71. Apparatus as in claim 57 , wherein those selected minimum counter values are nonnegative.
72. Apparatus as in claim 57 , wherein that component maintaining a set of messages includes
component adding messages to that set upon arrival;
component removing messages from that set upon release; and
component removing messages from that set upon exceeding a selected maximum number of messages.
73. Apparatus as in claim 72 , wherein that selected maximum number of messages is finite.
74. Apparatus as in claim 73 , wherein that logic treating includes logic applying distinct rules to messages in response to that logic detecting.
75. Apparatus as in claim 74 , wherein that logic treating includes logic discarding packets detected to be included in selected particular application protocols.
76. Apparatus as in claim 74 , wherein that logic treating includes logic discarding packets detected to not be included in selected particular application protocols.
77. Apparatus as in claim 75 , wherein that logic treating includes
logic identifying packets between a first set of size bounds as belonging to an identified message traffic pattern,
so long as a selected number of packets between a second set of size bounds arrived with a selected previous time interval.
78. Apparatus as in claim 77 , wherein at least one of those first set of size bounds, second set of size bounds, are constant.
79. Apparatus as in claim 77 , wherein at least one of those first set of size bounds, second set of size bounds, are time-varying.
80. Apparatus as in claim 77 , wherein that selected previous time interval is constant.
81. Apparatus as in claim 77 , wherein that selected previous time interval is time-varying.