Application characterization using transport protocol analysis

1. A computer-implemented method comprising:

obtaining transport protocol state information for each of a first plurality of transport protocol packets received at a network node, each of the first plurality of transport protocol packets including data transferred between a client endpoint and a server endpoint via a transport protocol connection, the first plurality of transport protocol packets including a first plurality of forward packets each including data transferred from the client endpoint to the server endpoint and a first plurality of reverse packets each including data transferred from the server endpoint to the client endpoint;

identifying a first plurality of request/response periods for the transport protocol connection, each of the first plurality of request/response periods being identified based on the transport protocol state information obtained for one or more of the first plurality of forward packets and the transport protocol state information obtained for one or more of the first plurality of reverse packets, the first plurality of request/response periods including first and second request/response periods, and the identifying the first plurality of request/response periods including:

identifying a beginning of the first request/response period based on the transport protocol state information for a first forward packet included in the first plurality of forward packets,

calculating a first expected sequence number based on the transport protocol state information for a reverse packet included in the first plurality of reverse packets, and

identifying an end of the first request/response period and a beginning of the second request/response period based on an acknowledgement value for the second forward packet corresponding to the first expected sequence number;

associating a first application type with the server endpoint based on the first plurality of request/response periods; and

controlling behavior of a communication network for transmission of a second plurality of transport protocol packets transferred to the server endpoint based on the first application type.

2. The method of claim 1 , wherein the second plurality of transport protocol packets each include data transferred between the client endpoint and the server endpoint via the transport protocol connection.

3. The method of claim 2 , further comprising:

obtaining transport protocol state information for each of the second plurality of transport protocol packets, the second plurality of transport protocol packets including a second plurality of forward packets each including data transferred from the client endpoint to the server endpoint and a second plurality of reverse packets each including data transferred from the server endpoint to the client endpoint;

identifying a second plurality of request/response periods for the transport protocol connection, each of the second plurality of request/response periods being identified based on the transport protocol state information obtained for one or more of the second plurality of forward packets and the transport protocol state information obtained for one or more of the second plurality of reverse packets;

associating a second application type with the server endpoint based on the second plurality of request/response periods; and

modifying behavior of the communication network for transmission of data transferred between the client endpoint and the server endpoint via the transport protocol connection in response to the second application type being different than the first application type.

4. The method of claim 1 , further comprising:

determining that request multiplexing was performed by the client endpoint during a request/response period included in the first plurality of request/response periods based on the transport protocol state information; and

associating an interactive application type with the server endpoint based on the determination that request multiplexing was performed by the client endpoint during a request/response period.

5. The method of claim 4 , wherein the determination that request multiplexing was performed by the client endpoint comprises:

calculating a second expected sequence number based on the transport protocol state information for a reverse packet included in the first plurality of reverse packets; and

determining that an acknowledgement value for a forward packet included in the first plurality of forward packets does not correspond to the second expected sequence number.

6. The method of claim 1 , further comprising:

determining an inter-request time for each of the first plurality of request/response periods, the inter-request time indicating an amount of time between a request/response period and a successive request/response period; and

associating a media streaming application type with the server endpoint based on detected periodicity in the inter-request times.

7. The method of claim 1 , further comprising:

determining a request size or a response size for each of the first plurality of request/response periods, the request size based on transport protocol payload sizes for packets included in the first plurality of forward packets and the response sizes based on transport protocol payload sizes for packets included in the first plurality of reverse packets;

determining a mean request size, a maximum request size, a predetermined percentile for request sizes, a mean response size, a maximum response size, or a predetermined percentile for response sizes for the first plurality of request/response periods; and

associating a bulk application type with the server endpoint based on the mean request size, the maximum request size, the predetermined percentile for request sizes, the mean response size, the maximum response size, of the predetermined percentile for response sizes being equal to or greater than a respective threshold value.

8. The method of claim 1 , wherein the controlling behavior of the communication network comprises selectively performing TCP spoofing on the second plurality of transport protocol packets based on the first application type.

9. The method of claim 1 , wherein the controlling behavior of the communication network comprises prioritization or deprioritization for transferring of data via the communication network between the client endpoint and the server endpoint based on the first application type.

10. The method of claim 1 , further comprising:

determining a response size for each of the first plurality of request/response periods;

determining a probability for a size or range of sizes based on a probability distribution based on the response sizes; and

associating a media streaming application type with the server endpoint when the probability for a size or range of sizes exceeds a threshold probability.

11. A nontransitory computer readable medium including instructions which, when executed by one or more processors, cause the one or more processors to perform the method of claim 1 .

12. A system comprising:

one or more processors; and

one or more nontransitory computer readable media including instructions which, when executed by one or more processors, cause the one or more processors to:

obtain transport protocol state information for each of a first plurality of transport protocol packets received at a network node, each of the first plurality of transport protocol packets including data transferred between a client endpoint and a server endpoint via a transport protocol connection, the first plurality of transport protocol packets including a first plurality of forward packets each including data transferred from the client endpoint to the server endpoint and a first plurality of reverse packets each including data transferred from the server endpoint to the client endpoint;

identify a first plurality of request/response periods for the transport protocol connection, each of the first plurality of request/response periods being identified based on the transport protocol state information obtained for one or more of the first plurality of forward packets and the transport protocol state information obtained for one or more of the first plurality of reverse packets, the first plurality of request/response periods including first and second request/response periods, and the identifying the first plurality of request/response periods including:

identify a beginning of the first request/response period based on the transport protocol state information for a first forward packet included in the first plurality of forward packets,

calculate a first expected sequence number based on the transport protocol state information for a reverse packet included in the first plurality of reverse packets, and

identify an end of the first request/response period and a beginning of the second request/response period based on an acknowledgement value for the second forward packet corresponding to the first expected sequence number;

associate a first application type with the server endpoint based on the first plurality of request/response periods; and

control behavior of a communication network for transmission of a second plurality of transport protocol packets transferred to the server endpoint based on the first application type.

13. The system of claim 12 , wherein the second plurality of transport protocol packets each include data transferred between the client endpoint and the server endpoint via the transport protocol connection.

14. The system of claim 13 , wherein the instructions further cause the one or more processors to:

obtain transport protocol state information for each of the second plurality of transport protocol packets, the second plurality of transport protocol packets including a second plurality of forward packets each including data transferred from the client endpoint to the server endpoint and a second plurality of reverse packets each including data transferred from the server endpoint to the client endpoint;

identify a second plurality of request/response periods for the transport protocol connection, each of the second plurality of request/response periods being identified based on the transport protocol state information obtained for one or more of the second plurality of forward packets and the transport protocol state information obtained for one or more of the second plurality of reverse packets;

associate a second application type with the server endpoint based on the second plurality of request/response periods; and

modify behavior of the communication network for transmission of data transferred between the client endpoint and the server endpoint via the transport protocol connection in response to the second application type being different than the first application type.

15. The system of claim 12 , wherein the instructions further cause the one or more processors to:

determine that request multiplexing was performed by the client endpoint during a request/response period included in the first plurality of request/response periods based on the transport protocol state information; and

associate an interactive application type with the server endpoint based on the determination that request multiplexing was performed by the client endpoint during a request/response period.

16. The system of claim 15 , wherein the determination that request multiplexing was performed by the client endpoint comprises:

calculating a second expected sequence number based on the transport protocol state information for a reverse packet included in the first plurality of reverse packets; and

determining that an acknowledgement value for a forward packet included in the first plurality of forward packets does not correspond to the second expected sequence number.

17. The system of claim 12 , wherein the instructions further cause the one or more processors to:

determine an inter-request time for each of the first plurality of request/response periods, the inter-request time indicating an amount of time between a request/response period and a successive request/response period; and

associate a media streaming application type with the server endpoint based on detected periodicity in the inter-request times.

18. The system of claim 12 , wherein the instructions further cause the one or more processors to:

determine a request size and a response size for each of the first plurality of request/response periods, the request size based on transport protocol payload sizes for packets included in the first plurality of forward packets and the response sizes based on transport protocol payload sizes for packets included in the first plurality of reverse packets;

determine a mean request size, a maximum request size, a predetermined percentile for request sizes, a mean response size, a maximum response size, and a predetermined percentile for response sizes for the first plurality of request/response periods; and

associate a bulk application type with the server endpoint based on the mean request size, the maximum request size, the predetermined percentile for request sizes, the mean response size, the maximum response size, of the predetermined percentile for response sizes being equal to or greater than a respective threshold value.

19. The system of claim 12 , wherein the controlling behavior of the communication network comprises prioritization or deprioritization for transferring of data via the communication network between the client endpoint and the server endpoint based on the first application type.

20. The system of claim 12 , wherein the instructions further cause the one or more processors to:

determine a response size for each of the first plurality of request/response periods;

determine a probability for a size or range of sizes based on a probability distribution based on the response sizes; and

associate a media streaming application type with the server endpoint when the probability for a size or range of sizes exceeds a threshold probability.