Systems and methods for traffic classification

Systems and methods for classifying a traffic flow on a network to determine a policy are described herein. The systems and methods enable a network to use aspects of an encrypted traffic flow and compare those aspects against a training set of data to classify the traffic flow. The classification helps the network determine and enforce policies associated with traffic flows from various services, even if the traffic flows are encrypted (obfuscated).

BACKGROUND

Traffic over wireless, wired, and cellular networks has increasingly shifted to encrypted protocols. While the increased use of encrypted protocols can help increase the security and safety of traffic over these networks, the use of encrypted protocols has created several issues for those networks. For example, various services that are provided over these networks may have policies that regulate the use of the networks. An example of this may be a video streaming service or a social media network that is provided with a certain amount of bandwidth, quality of service, and the like by the network. However, if those services and others increasingly use encrypted traffic, it may be difficult to classify traffic associated with those services in order to ensure a service level as well as enforcing a policy associated with the service.

DETAILED DESCRIPTION

Examples of the present disclosure comprise systems and methods for network traffic classification. In some examples, the classification of traffic can provide information to enforce various policies established by a network, and in some examples, provide for a higher level of user engagement or user experience. In conventional systems, encrypted traffic may have been classified using information available to the network, such as an analysis of the 5-tuple flow patterns, domain/server name identification (“SNI”), and/or shallow packet inspection. While these methods may still be used in some contexts, conventional methods of classifying traffic may be hindered based on new encryption techniques as well as newer network traffic technology. For example, some technologies encrypt the SNI, further obfuscating the traffic type. Additionally, malware may utilize encryption technologies to hide the traffic associated with the malware, often going undetected. In some examples, network traffic is purposefully encrypted to get around limitations associated with agreed upon policies.

To overcome some limitations found in conventional systems, the presently disclosed subject matter uses various traffic flow patterns to create categories of traffic, such as video traffic. By increasing the amount of data associated with the traffic pattern, the traffic may be categorized and associated with a particular service. Various examples of the presently disclosed subject matter store traffic patterns associated with particular flows and/or services and analyze incoming traffic against those patterns. Some of the traffic patterns include, but are not limited to, the active time of the upload, the active bytes of the upload, the number of active sessions, and the number of uplink packets greater than a specific size after a Transport Layer Security (“TLS”) or Secure Socket Layer (“SSL”) handshake.

By classifying traffic, a network may allocate the required or desired resources for that traffic. For example, a large social media web site may be allocated a certain amount of bandwidth at a minimum video resolution as part of an agreed upon policy between the social media website and the network. However, if the social media website desires an increased service level beyond that which the policy allocates, the social media website may cause its video traffic to be encrypted. Thus, the network may not know the video traffic is traffic from the social media website and may erroneously provide a level of service above the agreed upon policy. This can cause undesired taxing of network resources, while giving the social media website more resources than agreed upon.

As shown inFIG.1, examples of the present disclosure can comprise a system100used to detect application behavior using network traffic. Illustrated inFIG.1are user devices102A-102B (hereinafter referred to generically as “user devices102,” and individually as “user device102A,” and “user device102B”). The user devices102have installed thereon application104A, the user device102A has installed thereon application104B, and the user device B has installed thereon application104C. Applications104A,104B, and104C are nonspecific applications that, when executed, cause the reception and transmission of data to and from the user device102upon which the application is installed and executing. The data may be either encrypted or unencrypted data.

Also illustrated inFIG.1are application servers106A-106C (hereinafter referred to generically as “application servers106,” and individually as “application server106A,” “application server106B,” and “application server106C”). The application servers106are servers that provide data and receive data when the user devices102execute one or applications104on the user devices102. For example, the application server106A is a server that serves various functions provided by the application104A. The application server106B is a server that serves various functions provided by the application104B. The application server106C is a server that serves various functions provided by the application104B. The movement of data to and from the application servers106may be termed “traffic flow.”

The application servers106may be associated with various services or websites accessed by the user devices102through the use of a cellular network108. The cellular network108may be various types of networks that provide communication access between one or more of the user devices102and one or more of the application servers106. It should be noted that the presently disclosed subject matter is not limited to the use of cellular networks. The systems and methods discussed herein are discussed generally with respect to user devices102such as cellular UEs, tablets, computers, and the like, and in terms of components (e.g., network entities) associated with Wi-Fi networks, Bluetooth networks, wired networks, fourth-generation (4G) and fifth-generation (5G) cellular networks, and other types of networks. The systems and methods can be used with other types of equipment and on other types of networks, however, where users may wish to have increased flexibility in sending and receiving calls, video calls, and messages. Thus, the systems and methods described herein are described in terms of the 4G and 5G networks merely because these networks represent the state of the current art. One of skill in the art will recognize, however, the systems and methods could also be used on other networks that provide video calling such as, for example, Internet of Things (IoT), machine-to-machine (M2M), sixth-generation (6G), and other current and future networks.

Returning toFIG.1, when one or more of the applications104are executed by the user devices102, data is transmitted to the one or more application servers106through the cellular network108. The transmission of data from and to the application servers is stored as data records110. The data records110may be collected for the applications104executed by one or more of the user devices102.

In order to improve upon conventional classification methods, additional information about the data (the traffic flow) may be required. In conventional systems, often the traffic flow is defined as a “5-tuple” flow, whereby the number “5” refers to a set of five (5) different values of a Transmission Control Protocol/Internet Protocol (TCP/IP) connection. The values are: source IP address, source IP port number, destination IP address, destination IP port number, and the protocol used. The source address is the IP address of the network that creates and sends a data packet, and the destination address is the recipient. For example, if the application104A is a social media application and a user of the user device102A requests a video to be provided by the application server106A, the application server106A may be the source IP address and the user device102A may be the destination IP address.

The requested video will be received and provided to the user device102A according to policies agreed upon between the network108and the application server106A. The network108can extract the source IP address and determine that a policy applies to the transmission. However, as noted above, it is becoming increasingly common for services, such as those provided by the application server106A, to obfuscate (encrypt) its source IP address. Therefore, in some examples, the network108may be unaware that a policy exists, and thus, transmit the requested video using more network108resources than otherwise agreed to. In this example, additional information may be needed to classify the network traffic appropriately.

In this regard, the data records110determine and store additional information about the traffic flow. Illustrated inFIG.1are the following information: active time112, active bytes114, active sessions116, and large uplink count118. The information is information relating to the traffic flow. It should be noted that, in some examples, more information or less information may be used. However, the use of more information, such as those illustrated inFIG.1, can help increase the accuracy of the traffic classification. The active time112is a measure of the length of the traffic flow from the first to last packet (or other unit of measurement). The active bytes114are a measure of the bytes of data associated with a flow. The active sessions116are the number of sessions currently being transmitted in a flow. The large uplink count118is a count of uplink packets in a traffic flow, typically from the application servers106, that are above a certain data size threshold.

For graphical illustration of some aspects of traffic flows that may be used as information to classify the traffic flows,FIG.2is provided.FIG.2is an illustration showing different types of flows to illustrate the various information listed above. Illustrated inFIG.2are flows202A,202B, and202C (hereinafter referred to generically as “traffic flows202,” and individually as “traffic flow202A,” “traffic flow202B,” and “traffic flow202C”). The horizontal axis for the traffic flows202are time and the vertical axis for the traffic flows202is commenced (indicating a peak) or waiting (no peak). The traffic flow202A may be representative of a video streaming service. In the traffic flow202A, data portions204A-C are indicated by a “dot” in the respective flow portion206A.

In some examples, the data portions204A-C, as well as those not identified but are illustrated as a dot in their respective flow portion, may be a relatively large uplink packet. For example, a video streaming service may be uploading or streaming video, which may be relatively larger data chunks than text or pictures. In flow portions206B and206C, one large uplink packet is illustrated for each flow portion206B and206C, respectively. As used herein, the flow portions206, either together or individually, are used to define a flow and its classification. For example, the flow202B has three flow portions206D-F, like the flow202A, whereas the flow202C has a single flow portion,206G used to define the flow202C. The traffic flows202may be classified based on all the flow portions206associated with their respective traffic flows202or one or more of the flow portions206, e.g. a subset of the flow portions, associated with the traffic flows202. A match against a training set of data can involve matching all the flow portions of the traffic flow to the training set of data or matching a subset of the flow portions of the traffic flow to the training set of data. While matching all the flow portions may increase the accuracy of the matching process, the matching process may be relatively long and slow down traffic flows, whereas matching a subset of the flow portions may be less accurate, the time required to find a match may be reduced, thereby increasing the speed of finding an appropriate policy. In some examples, matching would occur based on one or more characteristics of flow and packets. For example, a video flow may have a few large upload (UL) packets then a large chunk of download (DL) packets, followed by a single (or multiple) large UL packets and then another large DL packets. The timing between the requests would be similar for all similar flows.

Also illustrated inFIG.2are active times208A and208B. As illustrated, the active time208A is the time in which the flow portion206A is active. The active time208B is the time in which the flow portion206B is active. The active times, such as the active times208A and208B, may be used to further identify and classify a traffic flow. For example, both the flows202A and202B have three flow portions. If an attempt is made to classify the flows202A and202B only using the number of flow portions, flows202A and202B may be determined to be from the same source and of the same type. Rather, as illustrated, the flow202A has one flow portion with a relatively longer active time and two flow portions with relatively shorter active times, whereas, the flow202B has three flow portions with the same, relatively longer active time. Further, the flow202C has one flow portion with one relatively longer active time. These aspects of the flows202, including the number of large uplink packets may be used to classify the flow.

Returning toFIG.1, the cellular network108further includes a training set of data120. The training set of data120are data that is collected from multiple traffic flows and are used to identify new traffic flows against previously identified traffic flows. For example, referring back toFIG.2, the traffic flow202A may have been identified as a pattern of traffic flow coming from a specific social media website. Thus, even if in the future the social media website starts encrypting their traffic flow, including the source IP address, the training set of data120may be used to compare the new, encrypted traffic flow against. To perform the comparison, a classification engine122is provided. The classification engine122receives traffic flows from the application servers106or the user devices102. The classification engine122determines information about the incoming traffic flow, such as the active time112, the active bytes114, the active sessions116, and the large uplink counts118to determine a flow pattern. The flow pattern is compared against the flow patterns in the training set of data120. If a match is made, the incoming traffic flow is classified according to the identified flow pattern of the training set of data120.

In some examples, if information about the flow pattern may not be classifiable concurrently, information about the incoming traffic flow may be prioritized for analysis based on various factors, such as an expected load on the cellular network108. For example, because of the amount of potential bandwidth to be used, the classification engine122may attempt to first categorize traffic flow based on active bytes114or large upload link count118. In that manner, the traffic flow may be classified more rapidly, allowing for the identification and application of policies associated with the traffic flow to occur.

The process300commences at operation302, where a traffic flow, such as the traffic flow202A,202B, or202C ofFIG.2, is detected.

The process300continues to operation304, where a determination is made as to whether or not the traffic flow202is encrypted or unencrypted. If the traffic flow202is unencrypted, the process300continues to operation304. If the traffic flow202is encrypted, the process300continues to operation308.

At operation306, based on a determination at operation304that the traffic flow202is unencrypted, the source of the traffic flow is identified. As noted herein, a source may be one of the application servers106or one of the applications104executing on the user devices102. The source of the traffic flow helps identify if there is a particular policy to apply to the traffic flow202. There may be various ways in which a source may be identified when the traffic flow202is not encrypted. For example, the traffic flow202may be analyzed to extract a Uniform Resource Locator (“URL”) associated with the traffic flow202. The URL may be used to identify the source so that a policy may be enforced at operation310, and thereafter, the classification operation ends at operation312.

At operation308, based on a determination at operation304that the traffic flow202is encrypted, the classification engine122is instantiated. As noted above, the classification engine122receives traffic flows202from the application servers106or the applications104executing on the user devices.

The process300continues to operation314, where the data records110are extracted from the traffic flows202. The classification engine122determines information about the incoming traffic flow, such as the active time112, the active bytes114, the active sessions116, and the large uplink counts118to determine a flow pattern.

The process300continues to operation316, where extracted data records110are compared to the flow patterns in the training set of data120. The training set of data120may be compiled using historical records of known sources (i.e. before encryption was used by those sources) or general categories of sources. For example, social media websites tend to offer the same services and resources, and therefore, tend to have similar, if not the same, traffic flow patterns.

The process300continues to operation318, where the traffic flow is classified based on the comparison. If a match is made, the incoming traffic flow202may be serviced according to a policy. If the traffic flow202is not classifiable (i.e. no match was made), the traffic flow202may be serviced based on a default policy. In some examples, a “match” is made when a predefined comparative threshold is met between the traffic flow and the training set of data120. For example, if the active time of the traffic flow202and the training set of data120are within a predetermined period of time of each other, e.g. 10 ms, then a match may be made. Because the match is made for only one data, the confidence level may be low. However, for example, if the traffic flow202is within 10% of active bytes, active time, and large uplink counts, the traffic flow202may be matched to the training set of data120at a high confidence level. The more data matches, the higher a confidence level may be achieved. In this manner, even though a match may be made, the process300may still not classify the traffic flow202based on the match if the confidence level is low.

A default policy may be a policy that instructs the network108to service the traffic flow202based on the types of data associated with the traffic flow202. For example, traffic flow202that is primarily text or other low bandwidth data, the default policy may be to process the traffic flow202at a lower priority. In another example, if the traffic flow202includes a large amount of data (such as streaming video), to maintain viewing quality, the network108may apply a default policy that prioritizes the traffic flow202, as video quality may be of greater concern of subscribers than the speed at which text is delivered.

FIG.4depicts a component level view of a server computer400for use with the systems and methods described herein. The server computer400could be any device capable of providing the functionality associated with the systems and methods described herein. The server computer400can comprise several components to execute the above-mentioned functions. The server computer400may be comprised of hardware, software, or various combinations thereof. As discussed below, the server computer400can comprise memory402including an operating system (OS)404and one or more standard applications406. The standard applications406may include applications that provide for communication with the cellular network108, one or more of the application servers106, and one or more of the user devices102.

The server computer400can also comprise the classification engine122and the training set of data120. The memory402may also include data records110, active time112, active bytes114, active sessions116, and large uplink count118for one or more traffic flows202.

The server computer400can also comprise one or more processors410and one or more of removable storage412, non-removable storage414, transceiver(s)416, output device(s)418, and input device(s)420. In various implementations, the memory402can be volatile (such as random access memory (RAM)), non-volatile (such as read only memory (ROM), flash memory, etc.), or some combination of the two.

The memory402can also include the OS404. The OS404varies depending on the manufacturer of the server computer400. The OS404contains the modules and software that support basic functions of the server computer400, such as scheduling tasks, executing applications, and controlling peripherals. In some examples, the OS404can enable the classification engine122and the training set of data120, and provide other functions, as described above, via the transceiver(s)416. The OS404can also enable the server computer400to send and retrieve other data and perform other functions.

The server computer400can also comprise one or more processors410. In some implementations, the processor(s)410can be one or more central processing units (CPUs), graphics processing units (GPUs), both CPU and GPU, or any other combinations and numbers of processing units. The server computer400may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. Such additional storage is illustrated inFIG.4by removable storage412and non-removable storage414.

Non-transitory computer-readable media may include volatile and nonvolatile, removable and non-removable tangible, physical media implemented in technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. The memory402, removable storage412, and non-removable storage414are all examples of non-transitory computer-readable media. Non-transitory computer-readable media include, but are not limited to, RAM, ROM, electronically erasable programmable ROM (EEPROM), flash memory or other memory technology, compact disc ROM (CD-ROM), digital versatile discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible, physical medium which can be used to store the desired information and which can be accessed by the server computer400. Any such non-transitory computer-readable media may be part of the server computer400or may be a separate database, databank, remote server, or cloud-based server.

In some implementations, the transceiver(s)416include any transceivers known in the art. In some examples, the transceiver(s)416can include wireless modem(s) to facilitate wireless connectivity with other components (e.g., between the server computer400and a wireless modem that is a gateway to the Internet), the Internet, and/or an intranet. Specifically, the transceiver(s)416can include one or more transceivers that can enable the server computer400to send and receive data using the cellular network108. Thus, the transceiver(s)416can include multiple single-channel transceivers or a multi-frequency, multi-channel transceiver to enable the server computer400to send and receive video calls, audio calls, messaging, etc. The transceiver(s)416can enable the server computer400to connect to multiple networks including, but not limited to 2G, 3G, 4G, 5G, and Wi-Fi networks. The transceiver(s) can also include one or more transceivers to enable the server computer400to connect to future (e.g., 6G) networks, Internet-of-Things (IoT), machine-to machine (M2M), and other current and future networks.

The transceiver(s)416may also include one or more radio transceivers that perform the function of transmitting and receiving radio frequency communications via an antenna (e.g., Wi-Fi or Bluetooth®). In other examples, the transceiver(s)416may include wired communication components, such as a wired modem or Ethernet port, for communicating via one or more wired networks. The transceiver(s)416can enable the server computer400to facilitate audio and video calls, download files, access web applications, and provide other communications associated with the systems and methods, described above.

In some implementations, the output device(s)418include any output devices known in the art, such as a display (e.g., a liquid crystal or thin-film transistor (TFT) display), a touchscreen, speakers, a vibrating mechanism, or a tactile feedback mechanism. Thus, the output device(s) can include a screen or display. The output device(s)418can also include speakers, or similar devices, to play sounds or ringtones when an audio call or video call is received. Output device(s)418can also include ports for one or more peripheral devices, such as headphones, peripheral speakers, or a peripheral display.

In various implementations, input device(s)420include any input devices known in the art. For example, the input device(s)420may include a camera, a microphone, or a keyboard/keypad. The input device(s)420can include a touch-sensitive display or a keyboard to enable users to enter data and make requests and receive responses via web applications (e.g., in a web browser), make audio and video calls, and use the standard applications406, among other things. A touch-sensitive display or keyboard/keypad may be a standard push button alphanumeric multi-key keyboard (such as a conventional QWERTY keyboard), virtual controls on a touchscreen, or one or more other types of keys or buttons, and may also include a joystick, wheel, and/or designated navigation buttons, or the like. A touch sensitive display can act as both an input device420and an output device418.

The presently disclosed examples are considered in all respects to be illustrative and not restrictive. The scope of the disclosure is indicated by the appended claims, rather than the foregoing description, and all changes that come within the meaning and range of equivalents thereof are intended to be embraced therein.