Systems and methods of data flow classification

Abstract

Systems and methods of classifying data flows being communicated on a network by one or more network elements. One method includes creating a table including information of packet timestamps and pre-defined packet header fields, grouping packets into data flows based on information in the table, assigning flow identifiers to each data flow, determining a plurality of feature/characteristic sets having one or more features and/or one or more characteristics of the data flows, determining one or more classifiers to predict flow labels using the plurality of feature/characteristic sets, and generating a classification policy that includes the one or more classifiers to classify data flows on the network. The method can also include storing the classification policy in at least one non-transitory computer medium that is accessible by a network element that is classifying data flows on the network, and using the classification policy to classify data flows.

1 - 20 . (canceled) 
     
     
         21 . A method of predicting, in real-time, the classification of data flows, at the beginning of each data flow, being communicated on a network by one or more network element(s), into categories based on a type of data flow using a classification policy that includes a data flow classifier, the type of data flow indicative of a time duration of the data flow or the payload of the data flow, the method comprising:
 receiving a plurality of packets from the network, each packet having header information comprising a source IP address, a destination IP address, source port, destination port, and a type of transfer protocol;   identifying a number of the plurality of packets as belonging to a data flow based on the header information, for each data flow:
 selecting a subset of ten or less packets in the data flow; 
 determining one or more parameters from the subset of packets; 
 based on the determined parameters and using the classification policy, predicting the classification by the network element of the data flow as one of at least two categories of data flows, each of the at least two categories indicative of a different type of data flow; and 
 routing the data flow in the network based on its respective category of data flow classification. 
   
     
     
         22 . The method of  claim 21 , wherein the type of the data flow is indicative of the duration of the data flow. 
     
     
         23 . The method of  claim 21 , wherein the type of the date flow is indicative of the payload of the data flow. 
     
     
         24 . The method of  claim 21 , wherein the header information of each packet comprises a source IP address, a destination IP address, source port, destination port, and a type of transfer protocol. 
     
     
         25 . The method of  claim 21 , further comprising:
 generating a classification policy for classifying data flows into categories based on the type of each data flow, wherein generating the classification policy includes   (i) grouping samples of packets previously transmitted on the network into sample data flows based at least in part on the respective header information of each packet,   (ii) separating the data flows into training data and test data,   (iii) determining one or more parameters from the training data,   (iv) training classifiers to categorize the data flows in the training data into categories using the one or more parameters of the training data, each of the categories associated with data flows of different types,   (v) testing the classifiers using the data flows in the test data to determine an accuracy of each classifier,   (vi) determining if each classifier is accurate, and in response to determining a classifier is not accurate, repeating parts (iv)-(vi) of the method, and   providing the classification policy including the classifier to the network element, the included classifier determined to be accurate during the testing of the classifiers using the test data.   
     
     
         26 . The method of  claim 25 , wherein the number of sample data flows is greater than ten thousand data flows. 
     
     
         27 . The method of  claim 21 , further comprising storing the classification policy on the network element. 
     
     
         28 . The method of  claim 21 , wherein the one or more parameters include one of more features, each feature being a time-independent feature determined using respective packet information in a data flow. 
     
     
         29 . The method of  claim 28 , wherein the one or more features include at least one of the following: frame number, protocol, source IP address, destination IP address, source port number, destination port number, sequence number, quality of service (QoS), a flag indicating whether packet can be fragmented, flag indicating whether one of more fragments follow, position of fragment in original packet, a flag indicating whether both TCP and UDP fields are set, or a type of service (ToS) flag to specify Quality of Service levels. 
     
     
         30 . The method of  claim 21 , wherein the one or more parameters includes one of more characteristics. 
     
     
         31 . The method of  claim 30 , wherein the one or more characteristics includes time-based characteristics that are calculated using respective packet information in a data flow. 
     
     
         32 . The method of  claim 30 , wherein the one or more characteristics include at least one of the following: flow ID, channel ID, sub-channel ID, packet position number in the flow, time since last frame in this flow, time since first frame in this flow, average time for this flow, average time difference, cumulative packet size in this flow, average packet size in this flow, or flow rate. 
     
     
         33 . The method of  claim 21 , further comprising routing data flows to different channels based on the classification of the data flows. 
     
     
         34 . The method of  claim 21 , further comprising routing long data flows to dedicated links based on the classification of the data flows, 
     
     
         35 . A system of predicting, in real-time, the classification of data flows, at the beginning of each data flow, being communicated on a network, into categories based on a type of data flow using a classification policy that includes a data flow classifier, the type of data flow indicative of a time duration of the data flow or the payload of the data flow, the system comprising:
 one or more non-transitory computer storage mediums configured to store a classification policy and computer-executable instructions; and   a network element including one or more computer hardware processors in communication with the one or more non-transitory computer storage mediums, the one or more computer hardware processors configured to execute the computer-executable instructions to at least:
 receive a plurality of packets from the network, each packet having header information, 
 identify a number of the plurality of packets as belonging to a data flow based on the header information, and for each data flow
 select a subset of ten or less packets in the data flow; 
 determine one or more parameters from the subset of packets; 
 based on the determined parameters and using the classification policy, predict the classification by the network element of the data flow as one of at least two categories of data flows, each of the at least two categories indicative of a different type of data flow, and 
 
 rout the data flow in the network based on its respective category of data flow classification. 
   
     
     
         36 . The system of  claim 35 , wherein the data flow classification is indicative of the duration of the data flow. 
     
     
         37 . The system of  claim 35 , wherein the data flow classification is indicative of the payload of the data flow. 
     
     
         38 . A non-transient computer readable medium containing program instructions for classifying in real-time data flows, being communicated on a network by one or more network element(s), into categories based on a type of data flow, the type indicative of a time duration of the data flow or the payload of the data flow, the program instructions causing one or more hardware processors to perform a method of:
 receiving a plurality of packets from the network, each packet having header information comprising a source IP address, a destination IP address, source port, destination port, and a type of transfer protocol;   identifying a number of the plurality of packets as belonging to a data flow based on the header information, for each data flow:
 selecting a subset of ten or less packets in the data flow; 
 determining one or more parameters from the subset of packets; 
 based on the determined parameters and using the classification policy, predicting the classification by the network element of the data flow as one of at least two categories of data flows, each of the at least two categories indicative of a different type of data flow; and 
 routing the data flow in the network based on its respective category of data flow classification. 
   
     
     
         39 . The non-transient computer readable medium of  claim 39 , wherein the header information comprises a source IP address, a destination IP address, source port, destination port, and a type of transfer protocol 
     
     
         40 . A network element comprising the non-transient computer readable medium of  claim 38  and one or more hardware processors configured to execute the program instructions.