Patent ID: 9712592
Date: 2017-07-18
CPC Classifications: H04L

Claim:
1. A method for session based classification, the method comprising: detecting an initialization of a certain transmission communication protocol (TCP) connection; maintaining a connection table comprising one or more TCP connection descriptors for TCP connections detected in traffic; maintaining, by a classifier, a set of session descriptors for open sessions; defining the certain TCP connection as an active TCP connection in the connection table; receiving, by the classifier, an incoming packet that belongs to a session for transfer of a media asset that comprises at least one of audio content and video content, the transfer comprising conveying the media asset using a HyperText Transfer Protocol (HTTP) as an application layer protocol; determining, by the classifier, whether the incoming packet belongs to the certain active TCP connection based upon its presence in the connection table; generating and iteratively updating, by the classifier, a plurality of mappings wherein each mapping is between a session and an active TCP connection in the connection table, the plurality of mappings comprising data for maintaining an association graph, wherein the updating of the plurality of mappings is based upon calculating estimations of likelihood of an association corresponding to a respective mapping, the calculating comprising considering a plurality of traffic properties for each TCP connection and checking for each of the traffic properties how well the traffic property matches a corresponding property of each session; if it is determined that the incoming packet belongs to the certain active TCP connection then classifying the incoming packet to a session that is associated with the certain active TCP connection based upon the mapping between sessions and active TCP connections maintained by the connection table; and processing the incoming packet using a first logic for performing work per packet, the first logic comprising matching the incoming packet to a corresponding session included in a corresponding mapping of the plurality of mappings, wherein the matching of the incoming packet is based upon the active TCP connection of the corresponding mapping; wherein the step of iteratively updating comprises: