Patent application EP18164727A (EP), filed 2018-03-28
Publication number: EP3399723A1
Title: PERFORMING UPPER LAYER INSPECTION OF A FLOW BASED ON A SAMPLING RATE
Abstract: A device may receive a first portion of network traffic associated with a flow. The device may perform a first upper layer inspection of the first portion of network traffic associated with the flow. The device may identify a set of parameters of the flow based on performing the first upper layer inspection of the first portion of network traffic associated with the flow. The device may determine, based on the set of parameters, a sampling rate at which to perform a second upper layer inspection of a second portion of network traffic associated with the flow. The device may instruct a lower layer to use the sampling rate to provide the second portion of network traffic associated with the flow for the second upper layer inspection. The device may perform the second upper layer inspection of the second portion of network traffic associated with the flow based on receiving the second portion of network traffic associated with the flow from the lower layer. The device may perform an action with regard to the flow based on a result of performing the second upper layer inspection.
IPC codes: H04L  29/    06            A I
H04L  29/    08            A I
H04L  67/    50            A I
H04L   9/    40            A I
Claims: number: 1
text: A device, comprising:
one or more processors configured to:
number: 2
text: The device of claim 1, wherein the one or more processors are further configured to:
number: 3
text: The device of claim 1 or 2, wherein the one or more processors are further configured to:
number: 4
text: The device of claim 1, 2 or 3, wherein the one or more processors are further configured to:
number: 5
text: The device of any preceding claim, wherein the one or more processors are further configured to:
number: 6
text: The device of any preceding claim, wherein the one or more processors are further configured to:
number: 7
text: The device of any preceding claim, wherein the first upper layer inspection and the second upper layer inspection are performed by an upper layer of a communication model,
wherein the upper layer is higher in the communication model than the lower layer.
number: 8
text: A method, comprising:
number: 9
text: The method of claim 8, further comprising:
number: 10
text: The method of claim 8 or 9, further comprising:
number: 11
text: The method of claim 8, 9 or 10, further comprising:
number: 12
text: The method of any of claims 8 to 11, further comprising:
number: 13
text: The method of any of claims 8 to 12, further comprising:
number: 14
text: The method of any of claims 8 to 13, further comprising:
number: 15
text: A computer program product comprising machine executable instructions on computer readable media, which, when loaded and executed by a processor, cause the processor to perform operations according to the method of any one of claims 8-14.
Office action: search_report, dated 2018-11-07
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2015256431A1
ref_type: patent
severity: background
ref_id: US2010158009A1
ref_type: patent
severity: background
ref_id: - JAWAD M KHALIFE ET AL: "Performance of OpenDPI in Identifying Sampled Network Traffic", JOURNAL OF NETWORKS, vol. 8, no. 1, 2 January 2013 (2013-01-02), FI, XP055497843, ISSN: 1796-2056, DOI: 10.4304/jnw.8.1.71-81
ref_type: npl
severity: background
ref_id: US2010158009
ref_type: patent
severity: background
ref_id: US2015256431
ref_type: patent
severity: novelty_destroying
ref_id: - JAWAD M KHALIFE ET AL, "Performance of OpenDPI in Identifying Sampled Network Traffic", JOURNAL OF NETWORKS, FI, (20130102), vol. 8, no. 1, doi:10.4304/jnw.8.1.71-81, ISSN 1796-2056, XP055497843 [A] 1-15 * the whole document *
ref_type: npl
severity: background
Final disposition: pending (2018-11-07)