Systems and methods of data flow classification

A method of classifying data flows, being communicated on a network by one or more network element(s), into categories based on a type of data flow, the type indicative of a time duration of the data flow or the payload of the data flow, the method comprising:

• creating, from a plurality of sample packets, a table including information of packet timestamps and pre-defined packet header fields, the plurality of sample packets being previously transmitted on the network;
• grouping the plurality of sample packets into data flows based at least in part on information in the table;
• assigning flow identifiers to each of the data flows;
• grouping the data flows into a training portion and a testing portion;
• determining one or more parameters having one or more features and/or one or more characteristics of the training data flows;
• determining a classifier to predict a type of data flow, including iteratively training and testing the classifier, using the training portion and the one or more parameters to train each classifier, and the testing portion to determine an accuracy of the classifier;
• generating a classification policy that includes the classifier to classify data flows on the network using ten or less packets of a data flow;
• and
• providing the classification policy to a network element in the network to classify data flows.

A method of classifying data flows being communicated on a network by one or more network element(s), into categories based on a type of data flow, the type indicative of a duration of the data flow or a payload of the data flow, the method comprising:

• (i) obtaining samples of packets previously transmitted on the network;
• (ii) grouping the samples of packets into data flows based at least in part on the respective 5-tuple header information of each packet;
• (iii) separating the data flows into training data and test data;
• (iv) training one or more classifiers to classify data flows into categories using one or more parameters of the training data and using the training data to recognize data flows that each of the categories is associated with data flows of a different type,
• (v) determining accuracy or the one or more classifiers using the test data;
• (vi) in response to determining a classifier is not accurate, repeating portions (iv)-(v) of the method;
• and
• (vii) providing the classification policy to a network element to be used to classify data flows on the network using ten or less packets of a data flow to classify the data flow, the classification policy including a classifier that was determined to be accurate.