Line-rate, real-time-traffic detector
View Patent ↗A line-rate, real-time-traffic detector classifies a network traffic flow as real-time when it determines the smoothness of the packet arrival rate of the network traffic flow is bounded by an empirically derived bound. In some embodiments, to improve performance, a tighter smoothness bound is applied to the smoothness calculations performed on a first set of packet arrival times, while a looser smoothness bound is applied to a second set of packet arrival times, the second set inclusive of and larger than the first.
1. A machine-implemented method for classifying a traffic flow in a network, the method comprising:
(a) determining a first smoothness value for a specified first number of packets of the traffic flow;
(b) comparing the first smoothness value to a specified first smoothness bound;
(c) classifying the traffic flow as a real-time traffic flow based on the comparison of step (b);
(d) determining a second smoothness value for a specified second number of packets of the traffic flow, if the first smoothness value is above the first smoothness bound;
(e) comparing the second smoothness value to a specified second smoothness bound; and
(f) classifying the traffic flow as a real-time traffic flow, if the second smoothness value is below the second smoothness bound; and
(g) classifying the traffic flow as a non-real-time traffic flow, if the second smoothness value is above the second smoothness bound.
2. The invention of claim 1 , wherein the second number of packets is greater than the first number of packets.
3. The invention of claim 1 , wherein the second smoothness bound is greater than the first smoothness bound.
4. The invention of claim 1 , wherein packets of the second number of packets include the packets of the first number of packets.
5. The invention of claim 1 , wherein:
the second number of packets is greater than the first number of packets;
the second smoothness bound is greater than the first smoothness bound; and
the first smoothness value and the second smoothness value are generated based on packet arrival times.
6. The invention of claim 1 , wherein the first smoothness value is generated based on packet arrival times.
7. The invention of claim 1 , wherein determining the first smoothness value comprises computing the variance of the packet arrival times for at least a consecutive two packet arrival times of the specified first number of packets of the traffic flow.
8. The invention of claim 1 , wherein determining the first smoothness value comprises computing the first and second moments of the packet arrival times for at least a consecutive two packet arrival times of the specified first number of packets of the traffic flow.
9. The invention of claim 1 , wherein determining the first smoothness value comprises updating a smoothness equation derived by optimizing a value for a packet inter-arrival gap α such that a variance of a difference sequence of arrival times of the packets of the traffic flow is minimized, wherein the arrival times of the packets of the traffic flow are represented by X=(x 1 , x 2 , . . . , x n ), where n is a positive integer representing the number of packets in the flow and the difference sequence is ΔX=(x 1 −α, x 2 −2α, x 3 −3α, . . . , x n −nα).
10. Apparatus for classifying a traffic flow in a network, the apparatus comprising a network interface that receives packets from the network, a processor and memory that process the packets, compute values, compare values, and report results, the apparatus further:
(a) computes a first smoothness value for a specified first number of packets of the traffic flow;
(b) compares the first smoothness value to a specified first smoothness bound; and
(c) reports that the traffic flow is a real-time traffic flow based on the comparison;
(d) determines a second smoothness value for a specified second number of packets of the traffic flow, if the first smoothness value is above the first smoothness bound;
(e) compares the second smoothness value to a specified second smoothness bound; and
(f) classifies the traffic flow as a real-time traffic flow, if the second smoothness value is below the second smoothness bound; and
(g) classifies the traffic flow as a non-real-time traffic flow, if the second smoothness value is above the second smoothness bound.
11. Apparatus for classifying a traffic flow in a network, the apparatus comprising:
(a) means for determining a first smoothness value for a specified first number of packets of the traffic flow;
(b) means for comparing the first smoothness value to a specified first smoothness bound;
(c) means for classifying the traffic flow as a real-time traffic flow based on the comparison of means (b);
(d) means for determining a second smoothness value for a specified second number of packets of the traffic flow, if the first smoothness value is above the first smoothness bound;
(e) means for comparing the second smoothness value to a specified second smoothness bound; and
(f) means for classifying the traffic flow as a real-time traffic flow, if the second smoothness value is below the second smoothness bound; and
(g) means for classifying the traffic flow as a non-real-time traffic flow, if the second smoothness is above the second smoothness bound.
12. The invention of claim 11 , wherein the second number of packets is greater than the first number of packets.
13. The invention of claim 11 , wherein the second smoothness bound is greater than the first smoothness bound.
14. The invention of claim 11 , wherein packets of the second number of packets include the packets of the first number of packets.
15. The invention of claim 11 , wherein:
the second number of packets is greater than the first number of packets;
the second smoothness bound is greater than the first smoothness bound; and
the first smoothness value and the second smoothness value are generated based on packet arrival times.
16. The invention of claim 11 , wherein the first smoothness value is generated based on packet arrival times.
17. The invention of claim 11 , wherein determining the first smoothness value comprises computing the variance of the packet arrival times for at least a consecutive two packet arrival times of the specified first number of packets of the traffic flow.
18. The invention of claim 11 , wherein determining the first smoothness value comprises computing the first and second moments of the packet arrival times for at least a consecutive two packet arrival times of the specified first number of packets of the traffic flow.
19. A machine-implemented method for classifying a traffic flow in a network, the method comprising:
(a) determining a first smoothness value for a specified first number of packets of the traffic flow;
(b) comparing the first smoothness value to a specified first smoothness bound; and
(c) classifying the traffic flow as a real-time traffic flow based on the comparison of step (b), wherein determining the first smoothness value comprises updating a smoothness equation derived by optimizing a value for a packet inter-arrival gap a such that a variance of a difference sequence of arrival times of the packets of the traffic flow is minimized, wherein the arrival times of the packets of the traffic flow are represented by X=(x 1 , x 2 , . . . , x n ), where n is a positive integer representing the number of packets in the flow and the difference sequence is ΔX=(x 1 −α, x 2 −2α, x 3 −3α, . . . , x n −nα).