Patent Description:
For many types of applications, analyzing data traffic in data networks is important, e.g. in order to guarantee network safety, check the network functionality, or handle data traffic loads correctly.

One known data traffic analysis method is called "deep packet inspection", also known as packet sniffing, wherein not only the header of data packets is inspected, but also the payload portion of the data packets. Generally, deep packet inspection is a type of data processing that inspects in detail the data being sent over a network, and may take actions such as alerting, blocking, re-routing, or logging it accordingly.

Analyzing data traffic using deep packet inspection techniques requires large amounts of computing resources in order to perform the analysis in real-time or near real-time.

This becomes an ever-increasing problem due to the large data rates that can be achieved in modern data networks, particularly in data networks employing the <NUM> standard.

<CIT> discloses a network device comprising a deep packet inspection classifier, and a machine learning classifier. The deep packet inspection classifier is configured to determine a first classification for an application by means of a deep packet inspection technique. The machine learning classifier is configured to determine a second classification for the application by means of a machine learning classification technique. The network device accepts the classification obtained by the deep packet inspection classifier or the classification obtained by the machine learning classifier, and processes traffic according to a policy associated with the accepted classification.

Thus, the object of the present invention is to provide a system for analyzing data traffic and a data traffic analysis method that allow for a more resource-efficient analysis of data traffic.

According to the invention, the problem is solved by a system for analyzing data traffic according to claim <NUM>.

According to the invention, at least one of the data processing units, namely the first data processing unit and/or the second data processing unit, processes a bulk of data packets instead of individual data packets. Particularly, all data processing units may respectively process a bulk of data packets instead of individual data packets.

Due to this bulk-processing approach, a higher data analysis rate can be achieved than by analyzing individual data packets. Furthermore, the computational resources required may be reduced due to the bulk-processing approach.

Moreover, according to the invention the different deep packet inspection techniques are not carried out by a single data processing unit. Instead, the different deep packet inspection techniques are allocated to different data processing units.

Due to the distribution of different deep packet inspection functionalities to different data processing units, an increased flexibility for scheduling the analysis of different aspects of the data stream(s) is obtained.

It has turned out that the overall performance of the system increases due to this modular approach.

In addition, the respective different data processing units may be specified according to the corresponding deep packet inspection technique applied, thereby improving the overall efficiency.

The individual data processing units may be established in hardware and/or software, respectively. For example, each data processing unit may be established as a computer program being executed on one or several CPUs, on one or several GPUs, or on other suitable types of electronic processing circuitry.

The individual data processing units may all be part of the same computer system or may be established on different computer systems, e.g. on different servers.

The data distribution circuit may comprise a distribution unit that is configured to distribute the data stream(s) to the individual data processing units, particularly to the first data processing unit and/or to the second data processing unit. The data distribution circuit may further comprise connectors, cables, wireless connections, and/or further distribution units that are configured to distribute the data streams after a first processing by the first data processing unit and/or the second data processing unit.

Alternatively or additionally, if the individual data processing units are established as software modules, the data distribution circuit may comprise a software interface being configured to distribute the data packets and/or bulks of data packets to the individual data processing units.

For example, the data distribution circuit is configured to forward the data packets and/or the bulks of data packets to be analyzed to a predetermined one of the data processing units if the analysis result obtained by the previous data processing units is a first predetermined analysis result. The data distribution circuit may be configured to forward the data packets and/or the bulks of data packets to be analyzed to another predetermined one of the data processing units if the analysis result obtained by the previous data processing units is a second predetermined analysis result.

According to an aspect of the present invention, data streams associated with at least two data processing units of the plurality of data processing units are established as a bulk of data packets, respectively, particularly wherein data streams associated with each data processing unit of the plurality of data processing units are established as a bulk of data packets. Thus, at least two of the data processing units process a bulk of data packets instead of individual data packets. Accordingly, an even higher data analysis rate can be achieved.

According to another aspect of the present invention, the first data processing unit and the second data processing unit are arranged in parallel. Thus, the first data processing unit and the second data processing unit may process the same data stream or two different data streams in parallel, thereby further increasing the data analysis rate that can be achieved by the system.

In other words, two different properties of a single data stream may be analyzed by means of the first data processing unit and the second data processing unit simultaneously.

Moreover, two different portions of the same data stream may be analyzed simultaneously by the different data processing units, thereby providing two analysis results simultaneously, which relate to the different portions processed.

Alternatively or additionally, two different data streams may be analyzed by means of the first data processing unit and the second data processing unit simultaneously.

For example, a first data stream may be analyzed via the first data processing unit by means of the first deep packet inspection technique, and a second data stream may be analyzed via the second data processing unit by means of the second deep packet inspection technique.

Afterwards, the first data stream may be analyzed via the second data processing unit by means of the second deep packet inspection technique, and the second data stream may be analyzed via the first data processing unit by means of the first deep packet inspection technique.

In a further embodiment of the present invention, the first data processing unit and the second data processing unit are serially connected. Thus, a single data stream may be analyzed by means of the first data processing unit and the second data processing unit consecutively. In other words, different properties of the same data stream may be analyzed consecutively by means of the first deep packet inspection technique and the second deep packet inspection technique consecutively. In addition, the latter data processing unit, e.g. the second data processing unit, may only analyze a certain portion of the data stream depending on the analysis result of the previous data processing unit, e.g. the first data processing unit. The certain portion may be the same one or rather a portion that is associated with the one analyzed by the previous data processing unit, e.g. the first data processing unit.

According to another aspect of the present invention, the plurality of data processing units is arranged in a series connection and/or in a parallel connection. Particularly, the system may comprise a plurality of signal processing channels, wherein each signal processing channel comprises a plurality of signal processing units being arranged in a series connection and/or in a parallel connection.

According to an aspect of the present invention, the first data processing unit and the second data processing unit are associated with the same data stream. In other words, data packets analyzed by the first data processing unit and the second data processing unit are at least partially the same or originate from a common bulk of data packets. Alternatively or additionally, the bulk(s) of data packets analyzed by the first data processing unit and the second data processing unit is (are) the same.

According to another aspect of the present invention, the first data processing unit and the second data processing unit are associated with different portions of a data stream and/or with different data streams. In other words, the first data processing unit and the second data processing unit analyze different bulks of data packets. Alternatively or additionally, the data packets analyzed by the first data processing unit and the second data processing unit may originate from different bulks of data packets.

Particularly, the data processing units are each configured to analyze data packets and/or bulks of data packets by means of a deep packet inspection technique, thereby obtaining data information. Accordingly, data information about the respectively associated data packets and/or bulks of data packets is obtained by each of the data processing units.

In an embodiment of the present invention, every data processing unit is configured to analyze data packets and/or bulks of data packets by means of a different deep packet inspection technique. Accordingly, different data information about the respectively associated data packets and/or bulks of data packets is obtained by each of the data processing units. As already described above, this modular approach allows for an increased flexibility of scheduling the analysis of different aspects of the data stream(s). Moreover, it has turned out that the overall analysis performance of the system increases due to this modular approach.

In a further embodiment of the present invention, the data information is associated with properties of a bulk of data packets as a whole and/or with properties of individual data packets.

For example, the data information may relate to the type of data stream comprising the bulk(s) of data packets and/or the data packets. Particularly, the data information may comprise the information whether the associated data stream is a video stream, an audio stream and/or another type of data stream.

Alternatively or additionally, the data information may comprise a number of occurrences of a predetermined data content, for example a number of occurrences of a predetermined word or expression.

Alternatively or additionally, the data information may comprise information regarding a used data protocol, a data protocol violation, data content, unwanted data content, an origin of the respective bulk of data packets (e.g. an associated IP address), an origin of the respective data packet (e.g. an associated IP address), a size of the respective bulk of data packets, and/or a size of the respective data packet.

According to the invention, the problem further is solved by a data traffic analysis method according to claim <NUM>.

Regarding the advantages and further properties of the data traffic analysis method, reference is made to the explanations given above with respect to the system, which also hold for the data traffic analysis method and vice versa.

According to an aspect of the present invention, the first data information and the second data information are each associated with properties of a bulk of data packets as a whole and/or with properties of individual data packets.

According to another aspect of the present invention, the at least one data stream is analyzed by means of the first data processing unit and the second data processing unit serially or in parallel.

Thus, the first data processing unit and the second data processing unit may process the same data stream or two different data streams in parallel, thereby further increasing the data analysis rate that can be achieved by the system.

If the at least one data stream is analyzed by means of the first data processing unit and the second data processing unit serially, different properties of the same data stream are analyzed consecutively by means of the first deep packet inspection technique and the second deep packet inspection technique.

Therein and in the following, the terms "module" and "unit" are understood to describe suitable hardware, suitable software, or a combination of hardware and software that is configured to have a certain functionality.

The hardware may, inter alia, comprise a CPU, a GPU, an FPGA, an ASIC, or other types of electronic circuitry.

<FIG> schematically shows a system <NUM> for analyzing data traffic.

The system <NUM> comprises a data processing module <NUM>, a data distribution circuit <NUM>, and an analysis module <NUM>.

The data processing module <NUM> comprises a first data processing channel <NUM> and a second data processing channel <NUM>.

The first data processing channel <NUM> and the second data processing channel <NUM> are arranged in parallel.

It is noted that the data processing module <NUM> may comprise any other number of data processing channels other than two, for example one, three, four or more.

The first data processing channel <NUM> comprises three data processing units <NUM> that are connected to each other in a serial connection.

The first data processing channel <NUM> may comprise any other number of data processing units other than three, for example one, two, four or more.

The second data processing channel <NUM> comprises five data processing units <NUM> that are connected to each other in a combination of serial connections and parallel connections.

Of course, the second data processing channel <NUM> may comprise any other number of data processing units other than five, for example one, two, three, four, or more than five.

The data processing units <NUM> each comprise a data input <NUM> for receiving a data stream and a result output <NUM> for outputting an analysis result and for forwarding the respective data stream.

It is noted that the data input <NUM> and the result output <NUM> are only explicitly shown for one of the data processing units <NUM> in order to enhance the legibility of <FIG>.

The individual data processing units <NUM> may be established in hardware and/or software, respectively. For example, each data processing unit <NUM> may be established as a computer program being executed on one or several CPUs, on one or several GPUs, or on other suitable types of electronic processing circuitry.

The individual data processing units <NUM> may all be part of the same computer system, for example the same server, or may be established on different computer systems, e.g. on different servers.

The data distribution circuit <NUM> comprises a first data distribution unit <NUM> being configured to receive and distribute data streams si to the data processing channels <NUM>, <NUM>, wherein i is an integer bigger than or equal to <NUM>.

More precisely, the first data distribution unit <NUM> is configured to distribute data packets and/or bulks of data packets that are associated with the data streams si to the data processing channels <NUM>, <NUM>.

The data streams si may be established as a video stream, an audio stream, and/or as any other type of data stream, respectively.

The data distribution circuit <NUM> further comprises connectors, cables, wireless connections, and/or further data distribution units <NUM> that are configured to distribute the data streams after a first processing by the data processing units <NUM> being immediately connected with the first data distribution unit <NUM>.

Alternatively or additionally, if the individual data processing units <NUM> are established as software modules, the data distribution circuit <NUM> may comprise a software interface being configured to distribute the data packets and/or bulks of data packets that are associated with the data streams si to the individual data processing units <NUM>.

The functionality of the data distribution circuit <NUM> will be explained in more detail below.

The analysis module <NUM> is connected to each of the data processing channels <NUM>, <NUM>. More precisely, the analysis module <NUM> is connected to the data processing units <NUM> being arranged at the end of each data processing channel <NUM>, <NUM>.

The system <NUM> is configured to perform a data traffic analysis method that is described in the following with reference to <FIG>.

The data streams si are received via the data distribution circuit <NUM>, more precisely via the first data distribution unit <NUM> (step S1).

Therein, at least one of the data streams si comprises a bulk of data packets. Particularly, several or even all of the received data streams si comprise a bulk of data packets, respectively.

The data packets or rather the bulks of data packets comprised in the received data streams are distributed to the first data processing channel <NUM> and to the second data processing channel <NUM> (step S2).

The data packets or rather the bulks of data packets are processed by means of the data processing units <NUM>, thereby obtaining data information about the data packets or rather about the bulks of data packets (step S3).

This step is described for each of the two processing channels <NUM>, <NUM> in more detail below.

In general, each data processing unit <NUM> within the first data processing channel <NUM> is configured to analyze the received data packets and/or the received bulks of data packets based on a different deep packet inspection technique.

Accordingly, each data processing unit <NUM> within the first data processing channel <NUM> processes the received data packets and/or the received bulks of data packets by means of a different predetermined deep packet inspection technique, thereby obtaining different data information.

In general, the data information is associated with properties of a bulk of data packets as a whole and/or with properties of individual data packets.

Thus, in the particular example of <FIG>, three different properties of the data packets or rather the bulks of data packets distributed to the first data processing channel <NUM> are analyzed by means of the three data processing units <NUM> of the first data processing channel <NUM> consecutively.

In other words, the same data packets, the same bulk(s) of data packets and/or the same data streams are analyzed by all of the data processing units <NUM> of the first data processing channel <NUM> consecutively.

For example, the data information may relate to the type of the data stream si comprising the bulk(s) of data packets and/or the data packets. Particularly, the data information may comprise the information whether the associated data stream si is a video stream, an audio stream and/or another type of data stream.

Regarding the second data processing channel <NUM>, each data processing unit <NUM> within the second data processing channel <NUM> is configured to analyze the received data packets and/or the received bulks of data packets based on a different deep packet inspection technique.

Accordingly, each data processing unit <NUM> within the second data processing channel <NUM> processes the received data packets and/or the received bulks of data packets by means of a different predetermined deep packet inspection technique, thereby obtaining different data information.

Thus, in the particular example of <FIG>, five different properties of the data packets or rather the bulks of data packets distributed to the second data processing channel <NUM> are analyzed by means of the five data processing units <NUM> of the second data processing channel <NUM>.

It is noted that while the data processing units <NUM> within each data processing channel <NUM>, <NUM> are configured to have a different deep packet inspection functionality, at least one of the data processing units <NUM> of the first data processing channel <NUM> may have the same deep packet inspection functionality as at least one of the data processing units <NUM> of the second data processing channel <NUM>.

Within the second data processing channel <NUM>, the data distribution circuit <NUM> distributes the data packets and/or bulks of data packets to be analyzed based on analysis results obtained by the individual data processing units <NUM>.

More precisely, the further data distribution units <NUM> provide conditional connections between the data processing units <NUM> based on the respective analysis results obtained by the data processing units <NUM> immediately upstream of the respective further data distribution unit <NUM>.

In the specific example shown in <FIG>, the further data distribution units <NUM> distinguish between two different possible outcomes (e.g. "yes" or "no"), and thus connect the data processing units <NUM> immediately upstream of the respective further data distribution unit <NUM> with two data processing units <NUM> downstream of the further data distribution unit <NUM>, respectively.

Thus, the further data distribution units <NUM> forward the data packets and/or the bulks of data packets to be analyzed to a predetermined one of the data processing units <NUM> if the analysis result obtained by the previous data processing units is a first predetermined analysis result (e.g. "yes").

The further data distribution units <NUM> forward the data packets and/or the bulks of data packets to be analyzed to another predetermined one of the data processing units <NUM> if the analysis result obtained by the previous data processing units is a second predetermined analysis result (e.g. "no").

Of course, more than two different analysis results may be possible. Accordingly, the further data distribution units <NUM> may respectively connect more than two downstream data processing units <NUM> with an upstream data processing unit <NUM>.

The data information obtained by means of the data processing units <NUM> may be forwarded to the analysis module <NUM> for further analysis and/or data processing (step S4).

For example, the data information may be statistically analyzed, converted into a predetermined file format, converted into a graphic representation, and/or displayed on a display of a user-side device.

With the system <NUM>, bulks of data packets can be processed instead of individual data packets. Particularly, all data processing units <NUM> may respectively process a bulk of data packets instead of individual data packets.

Due to this bulk-processing approach, a higher data analysis rate can be achieved than by analyzing individual data packets.

Moreover, the different deep packet inspection techniques are not carried out by a single data processing unit <NUM>. Instead, the different deep packet inspection techniques are allocated to different data processing units <NUM>.

Due to the distribution of different deep packet inspection functionalities to different data processing units <NUM>, an increased flexibility for scheduling the analysis of different aspects of the data stream(s) si is obtained.

It has turned out that the overall performance of the system <NUM> increases due to this modular approach.

Certain embodiments disclosed herein, particularly the respective module(s) and unit(s), utilize circuitry (e.g., one or more circuits) in order to implement standards, protocols, methodologies or technologies disclosed herein, operably couple two or more components, generate information, process information, analyze information, generate signals, encode/decode signals, convert signals, transmit and/or receive signals, control other devices, etc. Circuitry of any type can be used.

Claim 1:
A system for analyzing data traffic, wherein the system (<NUM>) comprises a data processing module (<NUM>), wherein the data processing module (<NUM>) comprises a plurality of data processing units (<NUM>), wherein the plurality of data processing units (<NUM>) comprise a first data processing unit and a second data processing unit,
wherein the data processing units (<NUM>) each comprise a data input (<NUM>) for receiving a data stream (si) and a result output (<NUM>) for outputting an analysis result,
wherein the first data processing unit is configured to analyze data packets and/or bulks of data packets by means of a first deep packet inspection technique,
wherein the second data processing unit is configured to analyze data packets and/or bulks of data packets by means of a second deep packet inspection technique,
wherein the first deep packet inspection technique is different from the second deep packet inspection technique,
wherein a data stream (si) being associated with the first data processing unit and/or the second data processing unit is a bulk of data packets,
wherein the system (<NUM>) comprises a data distribution circuit (<NUM>), the data distribution circuit (<NUM>) being configured to distribute data packets and/or bulks of data packets to be analyzed to the plurality of data processing units (<NUM>), and
wherein the data distribution circuit (<NUM>) is configured to distribute the data packets and/or bulks of data packets to be analyzed based on analysis results obtained by the individual data processing units (<NUM>), wherein the data distribution circuit (<NUM>) is configured to provide conditional connections between the data processing units (<NUM>).