Methods and apparatus to credit streaming activity using domain level bandwidth information

1. An apparatus comprising:

at least one memory;

computer readable instructions; and

processor circuitry to execute the instructions to:

determine domain data of data packets collected from a network interface;

determine to disregard ones of the domain data not corresponding to a bandwidth usage event meeting a threshold bandwidth usage;

associate bandwidth usage values with the domain data that corresponds to the bandwidth usage event meeting the threshold bandwidth usage to define bandwidth usage data by domain;

categorize ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data; and

store the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.

2. The apparatus as defined in claim 1 , wherein the processor circuitry is to execute the instructions to determine at least one of the domain data based on domain name server (DNS) data.

3. The apparatus as defined in claim 2 , wherein the processor circuitry is to execute the instructions to determine at least one of the domain data based on a DNS request.

4. The apparatus as defined in claim 1 , wherein the bandwidth usage data includes histogram data separated by ones of multiple domains.

5. The apparatus as defined in claim 4 , wherein the histogram data is time-based.

6. The apparatus as defined in claim 1 , wherein the processor circuitry is to execute the instructions to extract the domain data from the data packets via a deep packet inspection of the data packets.

7. The apparatus as defined in claim 1 , wherein the processor circuitry is to execute the instructions to group ones of the domain data based on similar IP address ranges.

8. The apparatus as defined in claim 1 , wherein the processor circuitry is to execute the instructions to determine the at least one of the domains based on a DNS request.

9. The apparatus as defined in claim 1 , wherein the processor circuitry is to execute the instructions to resolve adjacent events of the domain data that corresponds to the bandwidth usage event.

10. A method of metering internet usage, the method comprising:

determining, by executing instructions with at least one processor, domain data of collected data packets;

determining, by executing instructions with the at least one processor, to disregard ones of the domain data not corresponding to a bandwidth usage event meeting a threshold bandwidth usage;

associating, by executing instructions with the at least one processor, bandwidth usage values with the domain data that corresponds to the bandwidth usage event meeting the threshold bandwidth usage to define bandwidth usage data by domain;

categorizing, by executing instructions with the at least one processor, ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data; and

storing, by executing instructions with the at least one processor, the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.

11. The method as defined in claim 10 , wherein the domain data is determined based on aggregating domains of decrypted packets.

12. The method as defined in claim 10 , wherein the domain data is determined based on domain name server (DNS) data.

13. The method as defined in claim 10 , further including generating, by executing instructions with the at least one processor, histogram data based on the domain data.

14. The method as defined in claim 10 , further including associating, by executing instructions with the at least one processor, at least one domain of the domain data with a type of data content to define the bandwidth usage data.

15. The method as defined in claim 10 , wherein the bandwidth usage data by domain includes bandwidth usage values at different times.

16. A non-transitory machine readable medium comprising instructions, which when executed, cause at least one processor to at least:

determine domain data of collected data packets;

determine to disregard ones of the domain data not corresponding to a bandwidth usage event meeting a threshold bandwidth usage;

associate bandwidth usage values with the domain data that corresponds to the bandwidth usage event meeting the threshold bandwidth usage to define bandwidth usage data by domain;

categorize ones of the domain data with a respective type of activity, the type of activity corresponding to categories of use-types of the ones of the domain data; and

store the associated bandwidth usage data by domain, the stored associated bandwidth usage data separated by the categories of use-types of the ones of the domain data.

17. The non-transitory machine readable medium as defined in claim 16 , wherein the domain data is determined based on aggregating domains of decrypted packets.

18. The non-transitory machine readable medium as defined in claim 16 , wherein the domain data is determined based on domain name server (DNS) data.

19. The non-transitory machine readable medium as defined in claim 16 , wherein the instructions cause the at least one processor to generate histogram data based on the domain data.

20. The non-transitory machine readable medium as defined in claim 16 , wherein the instructions cause the at least one processor to associate domain data with a type of data content to define the bandwidth usage data.