Automatic network traffic discovery and classification mechanism including dynamic discovery thresholds

An apparatus facilitating the monitoring of network traffic, comprising:

• one or more network interfaces;
• a memory;
• a processor;
• and
• computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising
• a traffic classification database module comprising computer-executable instructions configured, when executed, to cause the processor to
• store at least one traffic class including a traffic class identifier and at least one attribute defining the traffic class;
• compare attributes stored in association with traffic class identifiers to attributes of a data flow to match a traffic class that corresponds to the data flow;
• a traffic discovery module comprising computer-executable instructions configured, when executed, to cause the processor to
• discover new traffic classes associated with data flows for which the traffic classification database did not find a matching traffic class;
• add discovered traffic classes to the traffic classification database after a discovery threshold has been exceeded;
• dynamically adjust under one or more computer program controls the discovery threshold based on an initial value of the discovery threshold and an amount of time since the traffic discovery module was initialized.

An apparatus facilitating the monitoring of network traffic, comprising:

• one or more network interfaces;
• a memory;
• a processor;
• and
• computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising
• a traffic classification database module comprising computer-executable instructions configured, when executed, to cause the processor to
• store at least one traffic class including a traffic class identifier and at least one attribute defining the traffic class;
• compare attributes stored in association with traffic class identifiers to attributes of a data flow to match a traffic class that corresponds to the data flow;
• a traffic discovery module comprising computer-executable instructions configured, when executed, to cause the processor to
• discover new traffic classes associated with data flows for which the traffic classification database did not find a matching traffic class;
• add discovered traffic classes to the traffic classification database after a discovery threshold has been exceeded;
• dynamically adjust under one or more computer program controls the discovery threshold based on a comparison of a total number of data flows traversing the apparatus to a total number of data flows unmatched by the traffic classification database.

An apparatus facilitating the monitoring of network traffic, comprising:

• one or more network interfaces;
• a memory;
• a processor;
• and
• computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising
• a traffic classification database module comprising computer-executable instructions configured, when executed, to cause the processor to
• store at least one traffic class including a traffic class identifier and at least one attribute defining the traffic class;
• compare attributes stored in association with traffic class identifiers to attributes of a data flow to match a traffic class that corresponds to the data flow;
• a traffic discovery module comprising computer-executable instructions configured, when executed, to cause the processor to
• discover new traffic classes associated with data flows for which the traffic classification database did not find a matching traffic class;
• add discovered traffic classes to the traffic classification database after a discovery threshold has been exceeded;
• dynamically adjust under one or more computer program controls the discovery threshold based on a comparison of a threshold ratio value to a current ratio between a total number of data flows traversing the apparatus and a total number of data flows unmatched by the traffic classification database.

A method facilitating the monitoring of network traffic, comprising

• detecting a data flow in network traffic traversing a communications path, the data flows each comprising at least one packet;
• parsing at least one packet associated with the data flow into a flow specification,
• matching the flow specification to a first set of traffic classes, wherein the traffic classes in the first set of traffic classes are each defined by one or more attributes,
• having found a matching traffic class in the matching step, associating the flow specification corresponding to the data flow with a traffic class from the first set of traffic classes,
• not having found a matching traffic class in the first set of traffic classes, matching the flow specification to a second set including at least one additional traffic class;
• having found a matching traffic class in the second set, updating at least one discovery parameter associated with the matching traffic class,
• upon a discovery parameter crossing a discovery threshold, adding the corresponding traffic class to the first set of traffic classes;
• and
• dynamically adjusting under one or more computer program controls the discovery threshold based on a comparison of a current rate at which the discovered traffic classes are added to the traffic classification database to a threshold rate.

An apparatus comprising

• one or more network interfaces;
• a memory;
• a processor;
• and
• computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising
• a packet processor module comprising computer-executable instructions configured, when executed, to cause the processor to
• detect data flows in network traffic traversing a communications path, the data flows each comprising at least one packet;
• parse at least one packet associated with a data flow into a flow specification,
• a traffic classification database module comprising computer-executable instructions configured, when executed, to cause the processor to
• match the data flow to a plurality of traffic classes, at least one of the plurality of traffic classes is defined by one or more matching attributes;
• and
• a traffic discovery module comprising computer-executable instructions configured, when executed, to cause the processor to
• discover new traffic classes associated with data flows for which the traffic classification database did not find a matching traffic class;
• add newly discovered traffic classes to the traffic classification database after a discovery threshold has been exceeded;
• dynamically adjust under one or more computer program controls the discovery threshold based on a comparison of a current rate at which the discovered traffic classes are added to the traffic classification database to a threshold rate.

An apparatus facilitating the monitoring of network traffic, comprising:

• one or more network interfaces;
• a memory;
• a processor;
• and
• computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising
• a traffic discovery module comprising computer-executable instructions configured, when executed, to cause the processor to
• identify traffic classes corresponding to data flows traversing an access link;
• monitor bandwidth utilization across the access link with respect to a plurality of traffic classes in relation to at least one bandwidth utilization statistic;
• add an identified traffic class to a traffic classification database upon achievement of a minimum bandwidth utilization threshold;
• dynamically adjust under one or more computer program controls the minimum bandwidth utilization threshold based on a comparison of a current rate at which the discovered traffic classes are added to the traffic classification database to a threshold rate;
• and
• a user interface module operative to display the traffic classes maintained by the traffic classification database.

A method for automatically classifying traffic in a packet communications network, said network having any number of flows, including zero, comprising the steps of:

• parsing a packet into a flow specification, wherein said flow specification including at least one attribute;
• matching the first flow specification of the parsing step to a plurality of traffic classes, each said traffic class having a traffic specification;
• thereupon,
• if a matching classification tree type node was not found in the matching step,
• associating the flow specification with one or more newly-created traffic classes;
• thereupon,
• incorporating said newly-created traffic class into said plurality of traffic classes upon an achievement of a minimum usage threshold;
• and
• dynamically adjusting under one or more computer program controls the minimum usage threshold based on a comparison of a threshold ratio value to a current ratio between a total number of data flows traversing the apparatus and a total number of data flows unmatched by the traffic classification database.