Classification device and method of performing a real-time classification of a data stream, computer program product, and system

A method of performing a real-time classification of a data stream exchanged between a client and a server over a telecommunications network, the method comprising:

• receiving a data segment of the data stream, the data segment indicating a data offset within the data stream;
• updating a bitmap table with the received data segment based on the indicated data offset, wherein the bitmap table comprises a number of blocks of data having a predetermined size, the data blocks being ordered by block sequence numbers in the bitmap table;
• after updating the bitmap table, if at least one first data block having a first block sequence number is complete, performing measurements on the complete data block to obtain at least one measurement result without waiting for all the data blocks having block sequence numbers that are lower than the first block sequence number to be completed;
• performing at least one statistical analysis based on measurement results obtained for several complete blocks;
• classifying the data stream into one group among a plurality of groups, based on the performed statistical analysis at least,
• wherein the plurality of groups comprises a cleartext data group and at least one non-cleartext data group, wherein measurements performed on the complete data block comprises determining the entropy of said data block, and wherein the statistical analysis comprises determining a global entropy value for the data stream, wherein if the global entropy value is greater than a predetermined entropy threshold, the data stream is classified as belonging to the non-cleartext data group;
• wherein the non-cleartext data group comprises at least an encryption group, and wherein the measurements further comprises performing an estimation of a CHI-square deviation of the complete blocks, wherein the statistical analysis further comprises, for each complete block:
• determining a CHI square deviation of said complete block;
• comparing the determined CHI-square deviation to a predetermined deviation threshold;
• if the determined CHI-square deviation is greater than the predetermined deviation threshold, incrementing a counter value;
• wherein if the counter value is less than a predetermined integer N, the data stream is classified into the encryption group.

A classification device performing a real-time classification of a data stream exchanged between a client and a server over a telecommunications network, the classification device comprising:

• an input interface for receiving a data segment of the data stream, the data segment indicating a data offset within the data stream;
• a processor, the processor being configured for performing the following steps:
• updating a bitmap table with the received data segment based on the indicated data offset, wherein the bitmap table comprises a number of blocks of data having a predetermined size, the data blocks being ordered by block sequence numbers in the bitmap table;
• after updating the bitmap table, if at least one first data block of the received data segment having a first block sequence number is complete, performing at least one measurement used for statistical analysis on the complete data block to obtain at least one measurement result, and using the at least one measurement result to update a performance of at least one statistical analysis without waiting for any of the data blocks of the received data segment having block sequence numbers that are lower than the first block sequence number to be completed;
• and
• classifying the data stream into one group among a plurality of groups, based on the at least one statistical analysis after the performance of the at least one statistical analysis has been updated based on the measurement results obtained for a predetermined number of complete blocks.