Methods and systems for optimizing wireless network performance using behavioral profiling of network devices
Computer-implemented methods and systems are disclosed for optimizing the performance of wireless networks by automatically capturing wireless traffic and other radio frequency (RF) signal data in the network and analyzing the data to identify network anomalies and to determine one or more solutions, without human intervention.
1. A computer-implemented method of collecting data in a wireless network to be analyzed for optimizing network performance, said wireless network including one or more known wireless infrastructure devices providing a network service and one or more known client devices consuming a network service, the method comprising the steps of:
(a) capturing a stream of radio frequency (RF) signal data in the network for said one or more known wireless infrastructure devices and said one or more known client devices;
(b) dividing each stream of RF signal data by time into periodic intervals per location;
(c) converting the divided RF signal data into events of interest, each event of interest defined by attributes including at least the time when the event happened and a unique identifier comprising a media control access (MAC) address of a wireless infrastructure device and/or a client device generating the event;
(d) repeating (a), (b), and (c) a plurality of times;
(e) detecting a change in one of the events of interest from a known wireless infrastructure device and/or a known client device; and
(f) providing the change in the event of interest detected in (e) to an analyzer for identifying anomalies in the network for use in determining a corrective action to improve network performance, wherein the network performance is characterized by one or more of the following attributes: connectivity, throughput, responsiveness, retry percentage, coverage, signal strength, and percentage utilization of the wireless spectrum across multiple wireless technologies.
2. The method of claim 1 , wherein step (a) comprises capturing a stream of RF signal data by an on-board capture device.
3. The method of claim 2 , wherein step (b) is performed by a forensic data recorder, and wherein the on-board capture device streams data over a local memory bus to the forensic data recorder, wherein the stream of data is in a format mutually agreed upon between the on-board capture device and the forensic data recorder.
4. The method of claim 3 , wherein the stream of data is used for offline forensic analysis and/or to troubleshoot network issues.
5. The method of claim 1 , wherein step (a) comprises capturing a stream of RF signal data by an off-board capture device.
6. The method of claim 5 , wherein step (b) is performed by a forensic data recorder, and wherein the off-board capture device streams data to the forensic data recorder, wherein the stream of data is in a format mutually agreed upon between the off-board capture device and the forensic data recorder.
7. The method of claim 6 , wherein the stream of data is used for offline forensic analysis and/or to troubleshoot network issues.
8. The method of claim 1 , wherein steps (a) to (f) are performed by an integrated device.
9. The method of claim 1 , wherein steps (a) and (b) are performed by a first device, and steps (c) and (e) are performed by a different second device.
10. The method of claim 1 , wherein each event of interest includes at least one of the following additional attributes: type of wireless packet, and a connection state.
11. The method of claim 1 , wherein the change in the event of interest is in a structured data format and suitable for storage in a conventional relational database.
12. The method of claim 1 , wherein the events of interest can comprise one or more of the following: (1) a presence_eoi containing information about presence or absence of client devices or infrastructure devices, (2) a connection_eoi containing information about the handshake between a client device and an infrastructure device, and whether the handshake was successful or not, (3) a stats_eoi including statistics about client and/or infrastructure devices over a period of time, and (4) a capability_eoi including information about capability of client devices and infrastructure devices.
13. The method of claim 1 , wherein a ratio of event data to the RF signal data is less than 1/10.
14. The method of claim 1 , further comprising deleting captured RF signal data after generation of the events of interest.
15. The method of claim 1 , further comprising storing captured RF signal data after generation of the events of interest.
16. The method of claim 1 , wherein at least some of the events of interest comprise capability events of interest (capability_eoi) for one or more client devices and infrastructure devices, and the method further comprises periodically saving the capability events of interest.
17. The method of claim 16 , further comprising comparing capability events of interest for one or more client devices and infrastructure devices with previously stored capability events of interest at a bit-by-bit level.
18. The method of claim 17 , further comprising updating a local copy of the capabilities for a client device or an infrastructure device with merged capabilities from the first copy of the capabilities and newly stored capabilities.
19. The method of claim 18 , further comprising updating a local copy of the capabilities for a client device or an infrastructure device as its capabilities change, and generating an event each time a change happens, and not generating an event if no change in capability is detected.
20. The method of claim 1 , wherein the analyzer correlates events of interest from multiple data collectors.
21. A computer system for collecting data in a wireless network to be analyzed for optimizing network performance, said wireless network including one or more known wireless infrastructure devices providing a network service and one or more known client devices consuming a network service, the system comprising:
one or more radios for capturing a stream of radio frequency (RF) signal data in the network for said one or more known wireless infrastructure devices and said one or more known client devices;
at least one processor;
memory associated with the at least one processor; and
a program supported in the memory containing a plurality of instructions which, when executed by the at least one processor, cause the at least one processor to:
(a) divide each stream of RF signal data by time into periodic intervals per location;
(b) convert the divided RF signal data into events of interest, each event of interest defined by attributes including at least the time when the event happened and a unique identifier comprising a media control access (MAC) address of a known wireless infrastructure device and/or a known client device generating the event;
(c) repeat (a) and (b) a plurality of times for captured RF streams;
(d) detect a change in one of the events of interest from a known wireless infrastructure device and/or a known client device; and
(e) provide the change in the event of interest detected in (d) to an analyzer for identifying anomalies in the network for use in determining a corrective action to improve network performance, wherein the network performance is characterized by one or more of the following attributes: connectivity, throughput, responsiveness, retry percentage, coverage, signal strength, and percentage utilization of the wireless spectrum across multiple wireless technologies.
22. The system of claim 21 , wherein the system comprises an on-board capture device for capturing the streams of RF signal data.
23. The system of claim 22 , wherein the system comprises a forensic data recorder for dividing each stream of RF signal data, and wherein the on-board capture device streams data over a local memory bus to the forensic data recorder, wherein the stream of data is in a format mutually agreed upon between the on-board capture device and the forensic data recorder.
24. The system of claim 21 , wherein the system comprises an off-board capture device for capturing the streams of RF signal data.
25. The system of claim 24 , wherein the system comprises a forensic data recorder for dividing each stream of RF signal data, and wherein the off-board capture device streams data to the forensic data recorder, wherein the stream of data is in a format mutually agreed upon between the off-board capture device and the forensic data recorder.