Method and apparatus for classifying traffic at transport layer
View Patent ↗Provided is a method and apparatus for classifying applications in traffic easily and accurately by utilizing only statistical data of traffic at transport layer. A method of the present invention includes determining candidate applications by comparing at least one of smallest packet size, biggest packet size and average packet size of collected packets for a flow with corresponding reference data of potential applications; and comparing mode set of packet size for the collected packets with corresponding reference data of the candidate applications to identify the flow as an application which has identical elements in the same order, the number of the identical elements being equal to or more than a predetermined number.
1. An apparatus for classifying traffic at transport layer, comprising:
a packet collection section for collecting packets of a flow;
a reference data storage section for storing reference data regarding smallest packet size, biggest packet size, average packet size and mode set of packet size for potential applications;
a candidate application determination section for determining candidate applications by comparing at least one of smallest packet size, biggest packet size and average packet size of packets collected in the packet collection section with the corresponding reference data for the potential applications stored in the reference data storage section; and
a final application determination section for comparing mode set of packet size for the collected packets with the corresponding reference data of the candidate applications to identify the flow as an application which has identical elements in the same order, the number of the identical elements being equal to or more than a predetermined number.
2. The apparatus of claim 1 , wherein the apparatus is configured to:
collect reference data regarding packet size distributions of the candidate applications if the flow is identified as more than one application;
calculate correlation coefficients between packet size distribution of the collected packets and those of the identified applications; and
identify the flow as an application which has the biggest correlation coefficient.
3. The apparatus of claim 1 , wherein the apparatus is configured to collect reference data regarding smallest packet size, biggest packet size, average packet size and mode set of packet size for the potential applications.
4. The apparatus of claim 3 , wherein the reference data is defined as most frequent value for input and output directions, respectively.
5. The apparatus of claim 3 , wherein the reference data of the mode set for the potential applications has equal to or more than elements than the mode set for the collected packets.
6. The apparatus of claim 1 , wherein the apparatus is configured to:
collect reference data regarding packets per second (PPS) and bytes per second (BPS) for the potential applications; and
compare PPS and BPS for the collected packets with PPS and BPS for the potential applications to exclude a potential application from the candidate applications if the difference of PPS or BPS between the potential application and the collected packets is beyond a predetermined value.
7. The apparatus of claim 1 , wherein the apparatus is configured to:
collect reference data regarding packet size distribution of the potential applications;
calculate correlation coefficients between the packet size distribution for the collected packets and those of the potential applications; and
identify the flow as a potential application which has the biggest correlation coefficient, wherein the biggest correlation coefficient is equal to or more than a predetermined value.
8. The apparatus of claim 7 , wherein the packet size distribution is collected by unit of a predetermined packet size.
9. The apparatus of claim 1 , wherein the apparatus is configured to:
configure a flow set with flows of which at least one of elements {departure address, departure port number} and {arrival address, arrival port number} is identical; and
identify all flows of the flow set as a potential application which has the biggest correlation coefficient between the potential applications and the flows of the flow set.
10. An apparatus for classifying traffic at transport layer, comprising:
a packet collection section for collecting packets of a flow;
a reference data storage section for storing reference data regarding mode set of packet size for candidate applications; and
an application determination section for comparing mode set of packet size for the collected packets with the reference data of the candidate applications to identify the flow as an application which has identical elements in the same order, the number of the identical elements being equal to or more than a predetermined number.
11. The apparatus of claim 10 , wherein the apparatus is configured to:
collect reference data regarding packet size distributions of the candidate applications if the flow is identified as more than one application;
calculate correlation coefficients between packet size distribution of the collected packets and those of the identified applications; and
identify the flow as an application which has the biggest correlation coefficient.
12. The apparatus of claim 10 , wherein the apparatus is configured to:
collect reference data regarding smallest packet size, biggest packet size, average packet size, PPS and BPS for the candidate applications; and
compare at least one of smallest packet size, biggest packet size, average packet size, PPS and BPS for the flow with the corresponding reference data for the candidate applications to exclude a candidate application if the difference between the candidate application and the flow is beyond a predetermined value.
13. An apparatus for classifying traffic at transport layer, comprising:
a packet collection section for collecting packets of a flow;
a reference data storage section for storing reference data regarding packet size distribution of candidate applications;
an application determination section for calculating correlation coefficients between packet size distribution for the collected packets and packet size distributions of the candidate applications to identify the flow as an application which has the biggest correlation coefficient.
14. The apparatus of claim 13 , wherein the apparatus is configured to:
collect reference data regarding smallest packet size, biggest packet size, the average packet size of the candidate applications; and
compare at least one of smallest packet size, biggest packet size and average packet size for the flow with the corresponding reference data for the candidate applications to exclude a candidate application if the difference between the candidate application and the flow is beyond a predetermined value.
15. The apparatus of claim 13 , wherein the packet size distribution is collected by unit of a predetermined packet size.
16. The apparatus of claim 13 , wherein the apparatus is configured to:
configure a flow set with flows of which at least one of elements {departure address, departure port number} and {arrival address, arrival port number} is identical; and
identify all flows of the flow set as a application which has the biggest correlation coefficient between the candidate applications and the flows of the flow set.