# US 2024/0205115 A1 · System and method for traffic flow content classification and classification confidence level > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205115 A1 - Document ID: US20240205115A1 - Status: Published application - Kind: A1 - Application number: 18/389,918 - Filed: 2023-12-20 - Published: 2024-06-20 - Earliest claimed: 2022-12-20 - Assignees: Sandvine Corporation - Applicants: Sandvine Corporation - Inventors: Anuram PALANISAMY; Alexander HAVANG; Pradeep KARANTH; Ambuj MITTAL; Jujare VINAYAKA; Ousef KURUVILLA; Mridula MADHUSUDAN; Vishal KULSHRESTHA; Christopher STOCKER - Web page: https://patentgrep.com/patent/US20240205115A1 ## CPC - H04L 43/026: using flow identification - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2475: for supporting traffic characterised by the type of applications - H04L 47/2483: involving identification of individual flows - G06N 20/00: Machine learning - H04L 41/16: using machine learning or artificial intelligence - H04L 43/028: by filtering - H04L 47/24: Traffic characterised by specific attributes, e.g. priority or QoS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A system and method for classifying application and content in a computer network. The method including: determining an application associated with a traffic flow; determining at least one type of content category associated with the application; reviewing packet parameters to determine the content category of the traffic flow; and monitoring the traffic flow for any changes to the packet parameters that would indicate a change in the content category of the traffic flow. The system including: an application module configured to determine an application associated with a traffic flow; a signature module, a heuristic module and a machine learning module configured to review packet parameters to determine a content category associated with the traffic flow and any changes to the content category associated with the traffic flow. A system and method for determining a confidence level of a classification of an application and content category of a traffic flow. ## Claims ### Claim 1 A method for classifying application and content in a computer network, the method comprising: determining an application associated with a traffic flow; determining at least one type of content category associated with the application; reviewing packet parameters to determine the content category of the traffic flow; and monitoring the traffic flow for any changes to the packet parameters that would indicate a change in the content category of the traffic flow. ### Claim 2 (depends on 1) The method according to claim 1, wherein the packet parameters comprise signatures of the traffic flow and determining the content category comprises matching the signature of the traffic flow with a previously stored signature of the content category. ### Claim 3 (depends on 1) The method according to claim 1, wherein the packet parameters comprise bincode entry functions and determining the content category comprises reviewing the bincode and a bitrate of the traffic flow. ### Claim 4 (depends on 1) The method according to claim 1, further comprising: monitoring the traffic flow for a predetermined evaluation time prior to determining an application associated with the traffic flow. ### Claim 5 (depends on 1) The method according to claim 1, wherein the monitoring of the traffic flow comprises waiting for a predetermined number of packets before evaluating whether there has been a change in the content category. ### Claim 6 A system for classifying application and content in a computer network, the system comprising: an application module configured to determine an application associated with a traffic flow; a signature module, a heuristic module and a machine learning module configured to review packet parameters to determine a content category associated with the traffic flow and any changes to the content category associated with the traffic flow. ### Claim 7 (depends on 6) The system according to claim 6, wherein the signature module is configured to determine packet parameters comprising of signatures of the traffic flow and determine the content category comprises matching the signature of the traffic flow with a previously stored signature of the content category. ### Claim 8 (depends on 6) The system according to claim 6, wherein the heuristic module is configured to determine packet parameters comprising bincode entry functions and determine the content category comprises reviewing the bincode and a bitrate of the traffic flow. ### Claim 9 (depends on 6) The system according to claim 6, wherein the traffic flow is monitored for a predetermined evaluation time prior to determining an application associated with the traffic flow. ### Claim 10 (depends on 6) The system according to claim 6, the monitoring of the traffic flow comprises waiting for a predetermined number of packets before evaluating whether there has been a change in the content category. ### Claim 11 A method for determining a confidence score of an application or content classification of network traffic comprising: determining an application or content classification of a traffic flow; determining a test matrix for the application or content classification; determining test results based on the test matrix; and determining a confidence score based on the test matrix. ### Claim 12 (depends on 11) A method according to claim 11 further comprising: determining any increase or decrease to the confidence score in comparison to a previously determined confidence score for the application or content classification; and determining any changes to any traffic policies based on the increase or decrease of the confidence score. ### Claim 13 (depends on 12) A method according to claim 12 further comprising preparing a summary with details as to the increase or decrease in the confidence score. ### Claim 14 (depends on 11) A method according to claim 11 wherein determining an application or content classification comprises determining whether the application is a top used application. ### Claim 15 (depends on 14) A method according to claim 14 wherein if the application is a top used application determining a priority level for each test in the test matrix. ### Claim 16 (depends on 14) A method according to claim 14 wherein if the application is a top used application, determining test results comprises: determining a pass or fail result per test in the test matrix; determining a consistency factor fear each test; and determining if any planned test in the test matrix was not run. ### Claim 17 (depends on 14) A method according to claim 14 wherein if the application is not a top used application determining a test matrix comprises: determining a signature adaptability of the application or content classification; determining trend analysis of the application or content classification; and determine a ticket count for the application or content classification. ### Claim 18 (depends on 17) A method according to claim 17 wherein the ticket count is reviewed a plurality of consecutive time periods. ### Claim 19 (depends on 17) A method according to claim 17 wherein the ticket count is determined by subscriber tickets, internal tickets and external tickets.