# US 12,003,609 B2 · Data flow classification method and packet forwarding device

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,609 B2
- Document ID: US12003609B2
- Status: Granted
- Kind: B2
- Application number: 17/468,250
- Filed: 2021-09-07
- Published: 2021-12-30
- Granted: 2024-06-04
- Earliest claimed: 2019-05-14
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Yaping Qiu; Qi Luo; Zhuojun Hua; Lu Wang
- Web page: https://patentgrep.com/patent/US12003609B2

## CPC

- H04L 69/22: Parsing or analysis of headers
- H04L 41/5054: Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
- H04L 43/026: using flow identification
- H04L 45/74: Address processing for routing
- H04L 47/24: Traffic characterised by specific attributes, e.g. priority or QoS
- H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ]
- H04L 47/2475: for supporting traffic characterised by the type of applications
- H04L 61/4511: using domain name system [DNS]
- H04L 41/16: using machine learning or artificial intelligence
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A data flow classification method includes obtaining, by a packet forwarding device, a plurality of data flows, extracting, by the packet forwarding device, address information and time information of each of the data flows, selecting, by the packet forwarding device, a data flow set that is generated when a first client device accesses a plurality of services, determining, by the packet forwarding device, a service set that includes a first service and a second service and that is accessed by the first client device based on the address information of the data flows, determining, by the packet forwarding device, a correlation between services in the service set based on time information of each data flow in the data flow set, and determining, by the packet forwarding device, that the first service and the second service implement a first application.

## Claims

### Claim 1

A data flow classification method, comprising:
obtaining a plurality of data flows;
extracting address information and time information of each of the plurality of data flows, wherein the plurality of data flows are generated when a plurality of client devices access a plurality of services separately, wherein each of the services is used to implement a sub-function of an application, and wherein the address information comprises a source Internet Protocol (IP) address, a source port number, a destination IP address, and a destination port number;
selecting, from the plurality of data flows based on the source IP address of each of the plurality of data flows, a data flow set that is generated when a first client device accesses the plurality of services, wherein the first client device is a client device in the plurality of client devices that is allocated to use a first IP address;
determining, based on a destination IP address and a destination port number of each of a plurality of data flows in the data flow set, a service set accessed by the first client device, wherein the service set comprises a first service and a second service, and a combination of a destination IP address and a destination port number that correspond to the first service is different from a combination of a destination IP address and a destination port number that correspond to the second service;
determining, a correlation between services in the service set based on time information of each of the data flows in the data flow set;
determining, based on the correlation, that the first service and the second service are used to implement a first application; and
determining, that data flows corresponding to the first service and the second service are data flows of the first application.

### Claim 2 (depends on 1)

The data flow classification method of claim 1, wherein the time information comprises at least one of a start moment of the data flow or an end moment of the data flow.

### Claim 3 (depends on 1)

The data flow classification method of claim 1, wherein determining, based on the correlation, that the first service and the second service are used to implement a first application further comprises performing clustering based on the correlation using an unsupervised learning algorithm, to determine that the first service and the second service are used to implement the first application.

### Claim 4 (depends on 3)

The data flow classification method of claim 3, wherein a method for the clustering comprises a spectral clustering algorithm, a K-Means clustering algorithm, or a density-based spatial clustering of applications with noise (DBSCAN) density clustering algorithm.

### Claim 5 (depends on 1)

The data flow classification method of claim 1, wherein determining a correlation between services in the service set based on time information of each of the data flows in the data flow set comprises:
determining a first co-occurrence service set based on the time information of each of the data flows in the data flow set, wherein the first service and the second service belong to the first co-occurrence service set, wherein the first co-occurrence service set comprises at least two services, and wherein an interval duration of time information of data flows generated when the at least two services are accessed is less than or equal to preset duration; and
determining a correlation between the first service and the second service based on the first co-occurrence service set.

### Claim 6 (depends on 5)

The data flow classification method of claim 5, further comprising:
determining a similarity between the first service and the second service based on the first co-occurrence service set, to obtain a similarity matrix; and
determining, based on the correlation, that the first service and the second service are used to implement a first application comprises determining, based on the similarity matrix, that the first service and the second service are used to implement the first application.

### Claim 7 (depends on 6)

The data flow classification method of claim 6, wherein determining, by the packet forwarding device, a similarity between the first service and the second service based on the first co-occurrence service set comprises determining the similarity between the first service and the second service based on a cosine similarity calculation method, an intersection over union calculation method, or a Euclidean distance calculation method.

### Claim 8 (depends on 6)

The data flow classification method of claim 6, further comprising:
extracting a first feature vector of the first service and a second feature vector of the second service from the similarity matrix using a graph embedding technology; and
determining, based on the correlation, that the first service and the second service are used to implement a first application comprises determining, based on the first feature vector and the second feature vector, that the first service and the second service are used to implement the first application.

### Claim 9 (depends on 1)

The data flow classification method of claim 1, further comprising:
extracting Domain Name System (DNS) features of the plurality of data flows, wherein each of the DNS features comprises a correspondence between a domain name, and the combination of the destination IP address and the destination port number; and
determining a label of the first application based on destination address information of the data flow of the first application and the DNS features, wherein the label is used to identify the first application.

### Claim 10

A packet forwarding device, comprising:
a network interface configured to receive and send data; and
a processor coupled to the network interface and configured to:
obtain a plurality of data flows;
extract address information and time information of each of the plurality of data flows, wherein the plurality of data flows are generated when a plurality of client devices access a plurality of services separately, wherein each of the services is used to implement a sub-function of an application, and wherein the address information comprises a source Internet Protocol (IP) address, a source port number, a destination IP address, and a destination port number;
select, from the plurality of data flows based on the source IP address of each of the plurality of data flows, a data flow set that is generated when a first client device accesses the plurality of services, wherein the first client device is a client device in the plurality of client devices that is allocated to use a first IP address;
determine, based on a destination IP address and a destination port number of each of the plurality of data flows in the data flow set, a service set accessed by the first client device, wherein the service set comprises a first service and a second service, and a combination of a destination IP address and a destination port number that correspond to the first service is different from a combination of a destination IP address and a destination port number that correspond to the second service;
determine a correlation between services in the service set based on time information of each of a plurality of data flows in the data flow set;
determine, based on the correlation, that the first service and the second service are used to implement a first application; and
determine that data flows corresponding to the first service and the second service are data flows of the first application.

### Claim 11 (depends on 10)

The packet forwarding device of claim 10, wherein the time information comprises at least one of a start moment of the data flow or an end moment of the data flow.

### Claim 12 (depends on 10)

The packet forwarding device of claim 10, wherein the processor is configured to determine, based on the correlation, that the first service and the second service are used to implement a first application by performing clustering based on the correlation using an unsupervised learning algorithm to determine that the first service and the second service are used to implement the first application.

### Claim 13 (depends on 12)

The packet forwarding device of claim 12, wherein the unsupervised learning algorithm comprises a spectral clustering algorithm, a K-Means clustering algorithm, or a density-based spatial clustering of applications with noise (DBSCAN) density clustering algorithm.

### Claim 14 (depends on 10)

The packet forwarding device of claim 10, wherein the processor is configured to determine the correlation between services in the service set based on time information of each of a plurality of data flows in the data flow set by:
determining a first co-occurrence service set based on the time information of each of the plurality of data flows in the data flow set, wherein the first service and the second service belong to the first co-occurrence service set, the first co-occurrence service set comprises at least two services, and interval duration of time information of data flows generated when the at least two services are accessed is less than or equal to preset duration; and
determining a correlation between the first service and the second service based on the first co-occurrence service set.

### Claim 15 (depends on 14)

The packet forwarding device of claim 14, wherein the processor is further configured to:
determine a similarity between the first service and the second service based on the first co-occurrence service set, to obtain a similarity matrix; and
determine, based on the correlation, that the first service and the second service are used to implement a first application by determining, based on the similarity matrix, that the first service and the second service are used to implement the first application.

### Claim 16 (depends on 15)

The packet forwarding device as claimed in claim 15, wherein the processor is configured to determine the similarity between the first service and the second service based on the first co-occurrence service set by determining the similarity between the first service and the second service based on a cosine similarity calculation method, an intersection over union calculation method, or a Euclidean distance calculation method.

### Claim 17 (depends on 15)

The packet forwarding device of claim 15, wherein the processor is further configured to:
extract a first feature vector of the first service and a second feature vector of the second service from the similarity matrix using a graph embedding technology; and
determine, based on the correlation, that the first service and the second service are used to implement a first application by determining, based on the first feature vector and the second feature vector, that the first service and the second service are used to implement the first application.

### Claim 18 (depends on 10)

The packet forwarding device of claim 10, wherein the processor is further configured to:
extract Domain Name System (DNS) features of the plurality of data flows, wherein each of the DNS features comprises a correspondence between a domain name, and the combination of the destination IP address and the destination port number; and
determine a label of the first application based on destination address information of the data flow of the first application and the DNS features, wherein the label is used to identify the first application.

### Claim 19

A non-transitory computer-readable storage medium configured to store instructions; and that when executed by one or more processors causes a packet forwarding device to:
obtain a plurality of data flows;
extract address information and time information of each of the plurality of data flows, wherein the plurality of data flows are generated when a plurality of client devices access a plurality of services separately, wherein each of the services is used to implement a sub-function of an application, and wherein the address information comprises a source Internet Protocol (IP) address, a source port number, a destination IP address, and a destination port number;
select, from the plurality of data flows based on the source IP address of each of the plurality of data flows, a data flow set that is generated when a first client device accesses the plurality of services, wherein the first client device is a client device in the plurality of client devices that is allocated to use a first IP address;
determine, based on a destination IP address and a destination port number of each of the plurality of data flows in the data flow set, a service set accessed by the first client device, wherein the service set comprises a first service and a second service, and a combination of a destination IP address and a destination port number that correspond to the first service is different from a combination of a destination IP address and a destination port number that correspond to the second service;
determine a correlation between services in the service set based on time information of each of the plurality of data flows in the data flow set;
determine, based on the correlation, that the first service and the second service are used to implement a first application; and
determine that data flows corresponding to the first service and the second service are data flows of the first application.

### Claim 20 (depends on 19)

The non-transitory computer-readable storage medium of claim 19, wherein the time information comprises at least one of a start moment of the data flow or an end moment of the data flow.