Method for classifying applications and detecting network abnormality by statistical information of packets and apparatus therefor
AssigneeOki Electric Industry Co., Ltd.
InventorNobuyuki Nakamura
Life of this patent
Estimating the term…
Abstract
In a method for classifying the types of applications on an IP network, packets are received, and statistical information on at least TCP flags and TCP packet sizes of the received packets are gathered to store. On the basis of the statistical information on the stored TCP flags, the applications are classified into two types, while, on the basis of the statistical information on the stored TCP packet sizes, the applications are classified into two other types. Further on the basis of results of the classification; the applications are classified into four types.
Claims12
A method of classifying a type of an application being used on an IP (Internet Protocol) network on a basis of a packet transmitted over the network to calculate an application constitution ratio, comprising:
- a step of preparing a storage for storing statistical information of the packet;
- a reception step of receiving the packet;
- a data gathering step of storing in the storage statistical information on at least a TCP (Transmission Control Protocol) flag and a TCP packet size of the packet received in said reception step;
- a first classification step of using a first mathematical equation on the basis of the statistical information on the TCP flag stored in the storage to classify the application into two types;
- a second classification step of using a second mathematical equation on the basis of the statistical information on the TCP packet size stored in the storage to classify the application into two other types;
- and
- a third classification step of classifying the application into four types in dependence upon a result of said first and second classification steps.
A method for detecting an abnormality in an IP (Internet Protocol) network, comprising:
- a step of preparing a storage for storing statistical information of a packet transmitted over the network;
- a reception step of receiving the packet;
- a data gathering step of storing in the storage statistical information on at least a TCP (Transmission Control Protocol) flag and a TCP packet size of the packet received in said reception step;
- a first classification step of using a first mathematical equation on a basis of the statistical information on the TCP flag stored in the storage to classify an application being used on the IP network into two types;
- a second classification step of using a second mathematical equation on the basis of the statistical information on the TCP packet size stored in the storage to classify the application into two other types;
- a third classification step of classifying the application into four types in dependence upon a result of said first and second classification steps, thereby classifying the type of the application on the basis of the packet to calculate an application constitution ratio;
- a storage step of storing a result of the classification in the storage;
- and
- an abnormality detection step of deciding one of the results of the classification as a classification result for abnormality detection, and comparing the decided classification result with another of the classification results;
- wherein, in said abnormality detection step, when a deviation between the classification result decided for abnormal detection and the other classification result is above a predetermined threshold value, it is determined that an abnormality has occurred in the IP network.
A program for causing a computer to carry out a method of classifying a type of an application being used on an IP (Internet Protocol) network on a basis of a packet transmitted over the network to calculate an application constitution-ratio, said method comprising:
- a step of preparing a storage for storing statistical information of the packet;
- a reception step of receiving the packet;
- a data gathering step of storing in the storage statistical information on at least a TCP (Transmission Control Protocol) flag and a TCP packet size of the packet received in said reception step;
- a first classification step of using a first predetermined mathematical equation on the basis of the statistical information on the TCP flag stored in the storage to classify the application into two types;
- a second classification step of using a second predetermined mathematical equation on the basis of the statistical information on the TCP packet size stored in the storage to classify the application into two other types;
- and
- a third classification step of classifying the application into four types in dependence upon a result of said first and second classification steps.
A program for causing a computer to carry out a method for detecting an abnormality in an IP (Internet Protocol) network, said method comprising:
- a step of preparing a storage for storing statistical information of a packet transmitted over the network;
- a reception step of receiving the packet;
- a data gathering step of storing in the storage statistical information on at least a TCP (Transmission Control Protocol) flag and a TCP packet size of the packet received in said reception step;
- a first classification step of using a first mathematical equation on a basis of the statistical information on the TCP flag stored in the storage to classify an application being used on the IP network into two types;
- a second classification step of using a second mathematical equation on the basis of the statistical information on the TCP packet size stored in the storage to classify the application into two other types;
- a third classification step of classifying the application into four types in dependence upon a result of said first and second classification steps, thereby classifying the type of the application on the basis of the packet to calculate an application constitution ratio;
- a storage step of storing a result of the classification in the storage;
- and
- an abnormality detection step of deciding one of the results of the classification as a classification result for abnormality detection, and comparing the decided classification result with another of the classification results;
- wherein, in said abnormality detection step, when a deviation between the classification result decided for abnormal detection and the other classification result is above a predetermined threshold value, it is determined that an abnormality has occurred in the IP network.
Application classifier apparatus for classifying a type of an application being used on an IP (Internet Protocol) network on a basis of a packet transmitted over the network to calculate an application constitution ratio, comprising:
- a storage for storing statistical information of the packet;
- a receiver for receiving the packet;
- a data gathering section for storing in said storage statistical information on at least a TCP (Transmission Control Protocol) flag and a TCP packet size of the packet received by said receiver;
- a first classifier for using a first mathematical equation on the basis of the statistical information on the TCP flag stored in said storage to classify the application into two type;
- a second classifier for using a second mathematical equation on the basis of the statistical information on the TCP packet size stored in said storage to classify the application into two other types;
- and
- a third classifier for classifying the application into four types in dependence upon a result from processing by said first and second classifiers.
Network abnormality detector apparatus comprising application classifier apparatus for classifying a type of an application being used on an IP (Internet Protocol) network on a basis of a packet transmitted over the network to calculate an application constitution ratio,
- said classifier apparatus comprising:
- a storage for storing statistical information of the packet;
- a receiver for receiving the packet;
- a data gathering section for storing in said storage statistical information on at least a TCP (Transmission Control Protocol) flag and a TCP packet size of the packet received by said receiver;
- a first classifier for using a first mathematical equation on the basis of the statistical information on the TCP flag stored in said storage to classify the application into two type;
- a second classifier for using a second mathematical equation on the basis of the statistical information on the TCP packet size stored in said storage to classify the application into two other types;
- and
- a third classifier for classifying the application into four types in dependence upon a result from processing by said first and second classifiers,
- said storage storing a classification result obtained by said classifier apparatus,
- said detector apparatus further comprising an abnormality detector for deciding one of the classification results as a classification result for abnormality detection, and comparing the decided classification result with another of the classification results,
- said abnormality detector determining, when a deviation between the classification result decided for abnormal detection and the other classification result is above a predetermined threshold value, that an abnormality has occurred in the IP network.
Dependencies are inferred from the claim text.