IP Library Granted Patent US 9,716,644
Granted Patent B2
US 9,716,644 · App. 13/795,283 · Granted Jul 25, 2017

Systems and methods for content type classification

Inventors: Shaohong Wei (Sunnyvale, CA); Zhong Qiang Chen (Sunnyvale, CA); Ping Ng (Milpitas, CA); Gang Duan (San Jose, CA)
Assignee: Fortinet, Inc.
H04L43/18G06F21/554H04L43/08H04L69/22
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,716,644
App. No.
13/795,283
Granted
Jul 25, 2017
Kind
B2
Abstract

Various embodiments illustrated and described herein include systems, methods and software for content type classification. Some such embodiments include determining a potential state of classification for packets associated with a session based at least in part on a packet associated with the session that is a packet other than the first packet of the session.

Claims (26)

1. A computer-implemented method for determining a type of content for packets of a data network, comprising:

receiving an input of a string pattern from a user interface as a parameter for classification;

receiving, at a first port of a plurality of ports, a first packet from the data network that is associated with a first session of packets, wherein the first port is configured to receive a plurality of distinctive content types;

eliminating at least one potential classification from a group of potential classifications for the first packet without identifying a classification for the first packet associated with the first session;

receiving a second packet associated with the first session;

determining whether a content type has been determined for the first packet associated with the first session;

responsive to the content type of the first packet associated with the first session having been determined, classifying the second packet to be the content type based at least in part on the determined content type without expending further classification resources;

responsive to the content type of the first packet not having been determined, classifying the second packet based on the input string pattern without consideration of the at least one identified potential classification that has been eliminated with respect to the first packet and without consideration for identification of the first port;

processing data associated with the first session based on the determined content type; and

controlling flow of the first session based on the determined content type.

2. The method of claim 1 , wherein the content type for the first packet has been determined.

3. The method of claim 1 , wherein the content type for the first packet has not been determined, and the method further comprises receiving one or more additional packets.

4. The method of claim 3 , wherein the act of classifying the packet comprises analyzing one of the one or more additional packets to determine if the one or more additional packets satisfy a prescribed criteria.

5. The method of claim 1 , wherein the content type has been determined for the first packet associated with the session to not be at least one ruled out classification.

6. The method of claim 1 , wherein the content type has been determined for the first packet associated with the session to potentially be of a particular classification.

7. A computer product includes a non-transitory computer-readable medium, the non-transitory computer-readable medium having a set of stored instructions, an execution of which causes a method for determining a type of content for packets of a data network to be performed, the method comprising:

receiving, at a first port of a plurality of ports, a first packet and a second packet from the data network that is associated with a first session of packets, wherein the first port is configured to receive a plurality of content types for the packets associated with the session without identifying classification of respective port numbers of the packets;

eliminating at least one potential classification from a group of potential classifications for the first packet without identifying a classification for the first packet associated with the first session;

determining whether a content type has been determined for the first packet associated with the session;

responsive to the content type of the first packet associated with the session having been determined, classifying the second packet to be the content type based at least in part on the determined content type without expending further classification resources; and

responsive to the content type of the first packet not having been determined, classifying the second packet without consideration of the at least one identified potential classification that has been eliminated with respect to the first packet.

8. The computer product of claim 7 , wherein the content type for the first packet has been determined.

9. The computer product of claim 7 , wherein the content type for the first packet has not been determined, and the method further comprises receiving one or more additional packets.

10. The computer product of claim 9 , wherein the act of classifying the packet comprises analyzing one of the one or more additional packets to determine if the one or more additional packets satisfy a prescribed criteria.

11. The computer product of claim 7 , wherein the content type has been determined for the first packet associated with the session to not be at least one ruled out classification.

12. The computer product of claim 7 , wherein the content type has been determined for the first packet associated with the session to potentially be of a particular classification.

Continuity (4)
Continuation 13409141 · Mar 1, 2012
Continuation 12503100 · Jul 15, 2009
Continuation 11357654 · Feb 16, 2006
Related Publication 20130258863A1 · Oct 3, 2013