Back to results
US 8,284,662 B2Granted
Flexible, cost-effective solution for peer-to-peer, gaming, and application traffic detection and treatment
AssigneeEricsson Inc.
InventorsChandramouli Sargor, Sachin Desai, Thalanayar Muthukumar
Life of this patent
Estimating the term…
Abstract
A method and apparatus for detecting peer traffic based on a heuristic model and deep packet inspection is described. A suspect set of peer packets is detected using a heuristic model. From the suspect set of peer packet, a set of verified peer packets is detected using deep packet inspection. The set of verified peer packets is processed according to the peer processing policy, while the non-verified peer packets is processed according a non-peer policy. Furthermore, the statistics are generated from the set of suspect peer packet. These statistics are used to update the heuristic model.
Claims17
A computer method, comprising:
- receiving a plurality of packets in a traffic flow;
- processing all of the plurality of packets in the traffic flow in a first stage based on heuristic model analysis to detect a plurality of suspect peer packets in the traffic flow;
- processing only the plurality of suspect peer packets in a second stage based on deep packet inspection to detect a plurality of verified peer packets in the plurality of suspect peer packets, wherein verified peer control and data packets are detected separately in the plurality of suspect peer packets based on the deep packet inspection;
- processing the plurality of verified peer packets according to a peer policy, wherein the peer policy includes dropping the verified peer control packets to prevent subsequent verified peer data packet exchange and transmitting the verified peer data packets at a restricted rate;
- and
- processing packets of the traffic flow not detected as one of the plurality of verified peer packets according to a non-peer policy.
3 more elements
A computer method, comprising:
- performing a first stage packet inspection on a plurality of packets in a traffic flow comprising,
- detecting a plurality of suspect peer packets in the plurality of packets, and
- detecting a first plurality of non-peer packets in the plurality of packets, wherein the first stage packet inspection is based on a heuristic model analysis;
- performing a second stage packet inspection on the plurality of suspect peer packets comprising,
- detecting a plurality of verified peer packets in the plurality of suspect peer packets,
- detecting a second plurality of non-peer packets in the plurality of suspect peer packets, wherein the second stage packet inspection is based on deep packet inspection, and
- separately detecting, based on deep packet inspection, a first subset of the plurality of verified peer packets as a plurality of verified peer control packets and a second subset of the plurality of verified peer packets as a plurality of verified peer data packets;
- processing the plurality of verified peer packets according to a peer policy, wherein the peer policy includes dropping the plurality of verified peer control packets to prevent subsequent verified peer data packet exchange and transmitting the plurality of verified peer data packets at a restricted rate;
- and
- processing the first plurality of non-peer packets and the second plurality of non-peer packets according to a non-peer policy.
7 more elements
A non-transitory machine-readable medium that stores instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:
- receiving a plurality of packets in a traffic flow;
- processing all of the plurality of packets in the traffic flow in a first stage based on heuristic model analysis to detect a plurality of suspect peer packets in the traffic flow;
- processing only of the plurality of suspect peer packets in a second stage based on deep packet inspection to detect a plurality of verified peer packets in the plurality of suspect peer packets, wherein verified peer control and data packets are detected separately in the plurality of suspect peer packets based on the deep packet inspection;
- processing the plurality of verified peer packets according to a peer policy, wherein the peer policy includes dropping verified peer control packets to prevent subsequent verified peer data packet exchange and transmitting verified peer data packets at a restricted rate, wherein the verified peer control and data packets are detected separately in the plurality of suspect peer packets based on the deep packet inspection;
- and
- processing packets of the traffic flow not detected as one of the plurality of verified peer packets according to a non-peer policy.
3 more elements
An apparatus comprising:
- a peer detection module comprising,
- a heuristic peer traffic detection module to detect a plurality of suspect peer packets in a traffic flow of data based on a heuristic model;
- a deep packet inspection traffic detection module to detect a plurality of verified peer packets in the plurality of suspect peer packets based on deep packet inspection of the plurality of suspect peer packets;
- a peer packet processing module to process the plurality of verified peer packets according to a peer policy, wherein the peer policy includes dropping verified peer control packets to prevent subsequent verified peer data packet exchange and transmitting verified peer data packets at a restricted rate, wherein the verified peer control and data packets are detected separately by the deep packet inspection traffic detection module and the verified peer control and data packets are detected in the plurality of suspect peer packets based on the deep packet inspection;
- a non-peer packet processing module to process packets of the traffic flow not detected as one of the plurality of verified peer packets according to a non-peer policy;
- and
- a set of one or more physical interfaces through which a packet transmitter transmits the packets of the traffic flow not detected as one of the plurality of verified peer packets.
4 more elements
A network element comprising:
- a set of one or more deep packet inspection cards, each deep packet inspection card comprising a deep packet inspection processor;
- a set of one or more line cards, each line card comprising a packet processor, wherein the packet processor is configured to,
- detect a plurality of suspect peer packets in a traffic flow of data based on a heuristic model,
- process a plurality of verified peer packets according to a peer policy, the peer policy includes dropping verified peer control packets to prevent subsequent verified peer data packet exchange and transmitting verified peer data packets at a restricted rate, wherein the plurality of verified peer packets are detected separately as verified peer control packets and verified peer data packets by the deep packet inspection processor on one of the set of one or more deep packet inspection cards and the plurality of verified peer packets are detected in the plurality of suspect peer packets based on deep packet inspection of packets in the plurality of suspect peer packets,
- process packets of the traffic flow not detected as one of the plurality of verified peer packets according to a non-peer policy;
- and
- a set of one or more control cards, the control cards to control forwarding of packets between the set of one or more line cards.
4 more elements
Dependencies are inferred from the claim text.