Patent Document ID: 7782793
Application ID: 11226328
Patent Flag: 1

Claim One:
1. A packet flow classification apparatus for on-line real-time traffic flow classification in a communications network of packet switches, each packet switch being any of a packet router and a network edge switch, the packet flow classification apparatus comprising: a first packet switch among the packet switches further configured to randomly select packets from an aggregate flow to generate sampled packets, and to inspect the sampled packets to obtain a flow identification for and a packet size of each sampled packet, and to generate a sampled flow information table based in part on the determined packet size and the obtained flow identification, a. wherein said first packet switch is further configured to randomly select packets with a pre-determined sampling probability, b. wherein said first packet switch is further configured to generate a corresponding packet size and flow identification result based on the determined packet size and the obtained flow identification, c. wherein said first packet switch is further configured to generate the sampled flow information table to have sampled flow table entries corresponding to sampled traffic flows, said sampled flow table entries for storing real-time sampled flow statistical information for each of the sampled traffic flows, each sampled flow table entry comprising a number of packets sampled, a cumulative amount of traffic content sampled so far, and at least one of an average packet size, a median packet size, a packet size variance, a root-mean-square packet size, a size of the largest packet sampled so far, a size of the shortest packet sampled so far, an average inter-packet arrival delay, a median inter-packet arrival delay, an inter-packet arrival delay variance, and a number of sampled bytes, and d. wherein said first packet switch is further configured to track a flow information by maintaining the sampled flow information table in real-time, based on the flow identification result and including incrementing the number of packets sampled and using the corresponding packet size to update the cumulative amount of traffic content sampled so far; and a second packet switch from among the packet switches further configured to store a group of classification rules to classify high bandwidth traffic flow, and to classify the traffic class/type of a sampled traffic flow on-line in real-time as an illicit or regulated traffic class, prior to termination of the sampled traffic flow, wherein e. the group of classification rules is trained off-line on statistical trace traffic flow information, to classify high bandwidth traffic flows according to traffic class/type based on at least one other of said real-time sampled flow statistical information, and f. wherein said second packet switch is further configured to classify the traffic class/type of a sampled traffic flow on-line in real-time as an illicit or regulated traffic class, prior to termination of the sampled traffic flow, by forecasting to a given statistical certainty a duration of the sampled traffic flow based on the number of packets sampled and, based on the forecast duration, to identify whether the sampled traffic flow is a suspect high bandwidth traffic flow and, in response to identifying the sampled traffic flow as a suspect high bandwidth traffic flow, to subject the suspect high bandwidth traffic flow's sampled flow statistical information stored in the sampled flow information table to the group of off-line trained classification rules to identify whether the classified traffic class/type of the suspect high bandwidth traffic flow is an illicit or regulated traffic class/type.