Statistical trace-based method, apparatus, node and system for real-time traffic classification

摘要

Apparatus and methods for real-time traffic classification based on off-line determined traffic classification rules are provided. Traces of real traffic are obtained and subjected to statistical analysis. The statistical analysis identifies domain the a multidimensional space of characteristic traffic parameters. Classification rules associated with the identified domains are derived and provided to traffic classification points for real-time traffic classification. Traffic classification points, typically edge network nodes, sample packets in aggregate streams with a predetermined probability. Statistical information regarding the sampled flows is tracked in a table, the number of time a flow was sampled providing a probabilistic measure of the flow's duration before the flow terminates. The table entries, which predominantly track high bandwidth flows, are subjected to the classification rules for real-time classification of the sampled flows. Optionally, rules include an action to be taken in respect of flows having characteristics matching thereof. Advantages are derived from low overhead on-line real-time classification of high-bandwidth flows at low overheads before flow termination.