# US 8,751,431 B2 · System and method for inferring traffic legitimacy through selective impairment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,431 B2 - Document ID: US8751431B2 - Status: Granted - Kind: B2 - Application number: 12/632,716 - Filed: 2009-12-07 - Published: 2010-04-08 - Granted: 2014-06-10 - Earliest claimed: 2005-06-21 - Assignees: AT&T Intellectual Property II, L.P. - Applicants: Nicholas Duffield; Balachaner Krishnamurthy - Inventors: Nicholas Duffield; Balachaner Krishnamurthy - Web page: https://patentgrep.com/patent/US8751431B2 ## CPC - H04L 47/2475: for supporting traffic characterised by the type of applications - G06Q 10/063: Operations research, analysis or management - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/50: Testing arrangements - H04L 67/025: for remote control or remote monitoring of applications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Described is a system and method for determining a classification of an application that includes initiating a stress test on the application, the stress test including a predetermined number of stress events, wherein the stress events are based on a network impairment. A response by the application to each stress event is identified and the application is classified as a function of the response into one of a first classification and a second classification, the first classification indicative of a normal application and the second classification indicative of an undesired application. If, the application is in the second classification, a network response procedure is executed. ## Claims ### Claim 1 A method for classifying an application, comprising: initiating, via a processor, a stress test on the application, the stress test comprising a predetermined number of stress events, wherein the stress events are based on a network impairment; identifying, via the processor, a response by the application to each of the stress events; classifying, via the processor, the application as a function of the response into one of a first classification and a second classification, the first classification indicative of a normal application and the second classification indicative of an undesired application; and when the application is in the second classification, executing, via the processor, a network response procedure, wherein the network response procedure comprises a deprioritization of the application. ### Claim 2 (depends on 1) The method of claim 1, wherein the application is executed on a computing terminal at one of: an ingress point to the network, or a middle point of the network. ### Claim 3 (depends on 1) The method of claim 1, wherein each of the stress events comprises at least one of: a predetermined frequency of occurrence within the stress test, an event duration, or a granularity. ### Claim 4 (depends on 1) The method of claim 1, wherein the network response procedure further comprises at least one of: a termination of a connection to a network of the application, a block to a further connection to the network by the application, or a redirection of transmissions by the application. ### Claim 5 (depends on 1) The method of claim 1, wherein the application utilizes a predetermined protocol. ### Claim 6 (depends on 5) The method of claim 5, wherein the predetermined protocol comprises one of: a transmission control protocol, a user datagram protocol, a simple mail transfer protocol, a hypertext transfer protocol, or a peer-to-peer protocol. ### Claim 7 (depends on 1) The method of claim 1, further comprising: storing the classification of the application in a database. ### Claim 8 (depends on 1) The method of claim 1, after the identifying, the method further comprising: comparing the response to at least one stored response in a database, the at least one stored response being indicative of an undesired response generated by the undesired application. ### Claim 9 An apparatus, comprising: a first computing terminal for initiating a stress test on an application over a data-sharing network, wherein the application is executed by a second computing terminal, the stress test including a predetermined number of stress events, wherein the stress events are based on a network impairment, the first computing terminal identifying a response by the application to each stress event, the first computing terminal classifying the application as a function of the response into one of a first classification and a second classification, the first classification indicative of a normal application and the second classification indicative of an undesired application, wherein, when the application is in the second classification, the first computing terminal executes a network response procedure, wherein the network response procedure comprises a deprioritization of the application. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein each of the stress events comprises at least one of: a predetermined frequency of occurrence within the stress test, an event duration, or a granularity. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the network response procedure further comprises at least one of: a termination of a connection to a network of the application, a block to a further connection to the network by the application, or a redirection of transmissions by the application. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the application utilizes a predetermined protocol. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the predetermined protocol comprises one of: a transmission control protocol, a user datagram protocol, a simple mail transfer protocol, a hypertext transfer protocol, or a peer-to-peer protocol. ### Claim 14 (depends on 9) The apparatus of claim 9, further comprising: storing the classification of the application in a database. ### Claim 15 (depends on 9) The apparatus of claim 9, further comprising: comparing the response to at least one stored response in a database, the at least one stored response being indicative of an undesired response generated by the undesired application. ### Claim 16 A device, comprising: a processor; and a memory storing a set of instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising: initiating a stress test on an application, the stress test including a predetermined number of stress events, wherein the stress events are based on a network impairment; identifying a response by the application to each of the stress events; classifying the application as a function of the response into one of a first classification and a second classification, the first classification indicative of a normal application and the second classification indicative of an unauthorized application; and when the application is in the second classification, executing a network response procedure, wherein the network response procedure comprises a deprioritization of the application. ### Claim 17 (depends on 16) The device of claim 16, wherein the device comprises a router. ### Claim 18 (depends on 16) The device of claim 16, wherein each of the stress events comprises at least one of: a predetermined frequency of occurrence within the stress test, an event duration, or a granularity. ### Claim 19 (depends on 16) The device of claim 16, wherein the network response procedure further comprises at least one of: a termination of a connection to a network of the application, a block to a further connection to the network by the application, or a redirection of transmissions by the application. ### Claim 20 (depends on 16) The device of claim 16, wherein the application utilizes a predetermined protocol, wherein the predetermined protocol comprises one of: a transmission control protocol, a user datagram protocol, a simple mail transfer protocol, a hypertext transfer protocol, or a peer-to-peer protocol.