Patent ID: 7751334
Filing Date: 2010-07-06
Classification: H04L

Abstract:
1. A Skype traffic detection system, SDE, for analyzing network traffic comprising a plurality of flows with each flow of said plurality of flows comprising a plurality of packets consisting of encrypted payload related to a proprietary peer to peer protocol, said system comprising: (a) Feature Extraction Element, for extracting a plurality of histogram based feature vectors, wherein a histogram based feature vector of said plurality of histogram based feature vectors is associated with a sequence of packets of the plurality of packets of a flow of said plurality of flows, said feature extraction element comprises a procedure to compute said histogram based feature vector from said sequence of packets, wherein said computing comprises: obtaining a payload from each of said sequence of packets, computing a frequency of occurrence of each byte pattern in said payload from each of said sequence of packets, and determining histogram of two hundred and fifty six byte values based on said frequency of occurrence of each byte pattern as said histogram based feature vector; (b) Training Element for generating a traffic model based on a plurality of training flows of said plurality of flows and a plurality of training feature vectors of said plurality of histogram based feature vectors, wherein each of said plurality of training feature vectors is associated with a sequence of packets of a plurality of packets of a training flow of said plurality of training flows; and (c) Detection Element for detecting Skype traffic in a flow of said plurality of flows based on said traffic model, wherein said Detection Element comprises a procedure to detect Skype traffic packets in said plurality of packets associated with said flow, said detecting comprises: grouping said plurality of packets into a plurality of packet sequences, determining the number of sequences in said plurality of packet sequences, determining a distortion of each of said plurality of packet sequences based on said traffic model, and determining traffic type of each of said plurality of packet sequences based on said distortion.