US20210258232A1 - Varying data flow aggregation period relative to data value - Google Patents
Varying data flow aggregation period relative to data value Download PDFInfo
- Publication number
- US20210258232A1 US20210258232A1 US17/306,876 US202117306876A US2021258232A1 US 20210258232 A1 US20210258232 A1 US 20210258232A1 US 202117306876 A US202117306876 A US 202117306876A US 2021258232 A1 US2021258232 A1 US 2021258232A1
- Authority
- US
- United States
- Prior art keywords
- flow
- value
- aggregation period
- database record
- endpoint device
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 230000002776 aggregation Effects 0.000 title claims abstract description 58
- 238000004220 aggregation Methods 0.000 title claims abstract description 58
- 238000000034 method Methods 0.000 claims abstract description 44
- 238000004891 communication Methods 0.000 claims abstract description 31
- 230000004931 aggregating effect Effects 0.000 claims abstract description 21
- 230000006870 function Effects 0.000 description 7
- 230000001413 cellular effect Effects 0.000 description 5
- 238000007418 data mining Methods 0.000 description 4
- 230000007774 longterm Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 230000004069 differentiation Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000002085 persistent effect Effects 0.000 description 2
- 239000000835 fiber Substances 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/02—Capturing of monitoring data
- H04L43/026—Capturing of monitoring data using flow identification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/22—Indexing; Data structures therefor; Storage structures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
- G06F16/24568—Data stream processing; Continuous queries
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/04—Processing captured monitoring data, e.g. for logfile generation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2216/00—Indexing scheme relating to additional aspects of information retrieval not explicitly covered by G06F16/00 and subgroups
- G06F2216/03—Data mining
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate
Definitions
- the present disclosure relates generally to data mining, and relates more particularly to devices, non-transitory computer-readable media, and methods for varying the aggregation periods for data flows relative to the values of the data contained in the flows.
- Data mining has become a valuable tool for helping network service providers to analyze and understand their subscribers' (i.e., customers′) service-related needs. For instance, information can be extracted from a data set (e.g., a set of packets exchanged between network endpoints) and transformed into a structure that can be analyzed for the occurrence of patterns, relationships, and other statistics that indicate how the subscribers are using the network.
- a data set e.g., a set of packets exchanged between network endpoints
- a method includes intercepting a first flow and a second flow traversing a communications network, assigning a first value to the first flow and a second value to the second flow, wherein the first value is higher than the second value, aggregating the first flow into a first database record according to a first aggregation period, aggregating the second flow into a second database record according to a second aggregation period that is longer than the first aggregation period, and storing the first database record and the second database record in a database.
- a computer-readable medium stores instructions which, when executed by a processor, cause the processor to perform operations.
- the operations include intercepting a first flow and a second flow traversing a communications network, assigning a first value to the first flow and a second value to the second flow, wherein the first value is higher than the second value, aggregating the first flow into a first database record according to a first aggregation period, aggregating the second flow into a second database record according to a second aggregation period that is longer than the first aggregation period, and storing the first database record and the second database record in a database.
- a device in another example, includes a processor and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations.
- the operations include intercepting a first flow and a second flow traversing a communications network, assigning a first value to the first flow and a second value to the second flow, wherein the first value is higher than the second value, aggregating the first flow into a first database record according to a first aggregation period, aggregating the second flow into a second database record according to a second aggregation period that is longer than the first aggregation period, and storing the first database record and the second database record in a database.
- FIG. 1 illustrates an example network related to the present disclosure
- FIG. 2 illustrates a flowchart of a first example method for aggregating data flows based on the relative value of the data
- FIG. 3 depicts a high-level block diagram of a computing device specifically programmed to perform the functions described herein.
- the present disclosure varies the aggregation periods (i.e., the frequencies or intervals with which aggregation is performed) for data flows relative to the values of the data contained in the flows.
- aggregation periods i.e., the frequencies or intervals with which aggregation is performed
- Network traffic can be analyzed for patterns, relationships, and other statistics that indicate how the subscribers are using the network.
- the basic unit of network traffic is a “flow,” i.e., a series of data packets exchanged between two network endpoints. Data packets belonging to the same flow of packets will contain the same flow key.
- the flow key is a 5-tuple defining the Transmission Control Protocol/Internet Protocol (TCP/IP) connection via which the data packet travels.
- the 5-tuple includes: the source IP address, the destination IP address, the source port number (e.g., Transmission Control Protocol/User Datagram Protocol or TCP/UDP port number), the destination port number (e.g., TCP/UDP port number), and the type of service (ToS).
- TCP/IP Transmission Control Protocol/Internet Protocol
- ToS type of service
- data packets are aggregated into flows based on a fixed interval of time.
- data packets may be aggregated into flows every N seconds, where M flows are produced every N-second interval.
- the flows may be aggregated into database records and stored in a database every P seconds (where P may be greater than N).
- the database may subsequently be mined for metadata containing useful information, such as how particular subscribers use their endpoint devices (e.g., whether they use their endpoint devices mostly for streaming video, or playing games, or making phone calls).
- a service provider may tailor the service to that endpoint device to better suit the subscriber's needs (e.g., allocating more bandwidth, varying rate channel characteristics, deploying additional base stations, etc.).
- the amount of metadata generated by even a single flow can be enormous.
- This challenge is magnified by the fact that low-value flows and high-value flows conventionally consume the same amount of processing resources (e.g., central processing unit, random access memory, input/output) and the same storage footprint (e.g., in persistent storage).
- processing resources e.g., central processing unit, random access memory, input/output
- the same storage footprint e.g., in persistent storage.
- the endpoint device may be bombarded with a plurality of short-duration flows (e.g., advertisements) that give little insight into the device's patterns of use.
- a longer-duration flow may be generated from the subscriber's interactions with one or more news articles, and this longer-duration flow may give more insight into the device's patterns of use.
- both the short-duration flows and the longer-duration flows may take up the same amount of space in the database due to the fact that they are aggregated according to the same aggregation period (e.g., M flows every N seconds).
- Examples of the present disclosure vary the aggregation periods for data flows relative to the values of the data contained in the flows. For instance, flows containing low value data may be aggregated into database records based on a first time interval, while flows containing high value information may be aggregated into database records based on a second time interval that is shorter than the first time interval.
- the level of granularity of detail in the high value flows when stored in the database will thus be greater than the level of granularity of detail in the low value flows, as the individual database records containing the high value flows will contain less data. This enhances the visibility of valuable metadata.
- the value of a flow, or of a data packet may be determined in any one or more of a plurality of ways, including, for example, the number of data packets in the flow, the duration of the data packets in the flow, or other ways.
- the “value” of a flow refers to the impact the network traffic contained in a flow has on the physical network over which the network traffic is carried (or, alternatively, the level of insight the network traffic can provide into subscriber use patterns).
- the impact on the physical network may be evaluated in terms of the volume or rate of the network traffic, the type of the network traffic (e.g., Voice over Long Term Evolution, hot spot/tethered, connected car, streaming audio/video, etc.), anomalies (e.g., higher than average number of retransmits, etc.), and/or on other metrics.
- examples of the disclosure define value at a subscriber-level granularity.
- the value of certain subscriber-centric metadata may increase over time, and may be allocated resources only when the value of the subscriber-centric metadata meets or exceeds a predefined (configurable) threshold.
- FIG. 1 illustrates an example network 100 , related to the present disclosure.
- the network 100 may be any type of communications network, such as for example, a traditional circuit switched network (CS) (e.g., a public switched telephone network (PSTN)) or an Internet Protocol (IP) network (e.g., an IP Multimedia Subsystem (IMS) network, an asynchronous transfer mode (ATM) network, a wireless network, a cellular network (e.g., 2G, 3G and the like), a long term evolution (LTE) network, and the like) related to the current disclosure.
- IP network is broadly defined as a network that uses Internet Protocol to exchange data packets.
- Additional exemplary IP networks include Voice over IP (VoIP) networks, Service over IP (SoIP) networks, and the like.
- VoIP Voice over IP
- SoIP Service over IP
- the network 100 may comprise a core network 102 .
- core network 102 may combine core network components of a cellular network with components of a triple play service network; where triple play services include telephone services, Internet services, and television services to subscribers.
- core network 102 may functionally comprise a fixed mobile convergence (FMC) network, e.g., an IP Multimedia Subsystem (IMS) network.
- FMC fixed mobile convergence
- IMS IP Multimedia Subsystem
- core network 102 may functionally comprise a telephony network, e.g., an Internet Protocol/Multi-Protocol Label Switching (IP/MPLS) backbone network utilizing Session Initiation Protocol (SIP) for circuit-switched and Voice over Internet Protocol (VoIP) telephony services.
- IP/MPLS Internet Protocol/Multi-Protocol Label Switching
- SIP Session Initiation Protocol
- VoIP Voice over Internet Protocol
- Core network 102 may also further comprise an Internet Service Provider (ISP) network.
- the core network 102 may include an application server (AS) 104 and a database (DB) 106 .
- AS application server
- DB database
- FIG. 1 For ease of illustration, various additional elements of core network 102 are omitted from FIG. 1 , including switches, routers, firewalls, web servers, and the like.
- the core network 102 may be in communication with one or more wireless access networks 120 and 122 .
- Either or both of the access networks 120 and 122 may include a radio access network implementing such technologies as: global system for mobile communication (GSM), e.g., a base station subsystem (BSS), or IS-95, a universal mobile telecommunications system (UMTS) network employing wideband code division multiple access (WCDMA), or a CDMA3000 network, among others.
- GSM global system for mobile communication
- BSS base station subsystem
- UMTS universal mobile telecommunications system
- WCDMA wideband code division multiple access
- CDMA3000 CDMA3000 network
- either or both of the access networks 120 and 122 may comprise an access network in accordance with any “second generation” (2G), “third generation” (3G), “fourth generation” (4G), Long Term Evolution (LTE), or any other yet to be developed future wireless/cellular network technology including “fifth generation” (5G) and further generations.
- the operator of core network 102 may provide a data service to subscribers via access networks 120 and 122 .
- the access networks 120 and 122 may all be different types of access networks, may all be the same type of access network, or some access networks may be the same type of access network and other may be different types of access networks.
- the core network 102 and the access networks 120 and 122 may be operated by different service providers, the same service provider or a combination thereof.
- the access network 120 may be in communication with one or more user endpoint devices (also referred to as “endpoint devices” or “UE”) 108 and 110 , while the access network 122 may be in communication with one or more user endpoint devices 112 and 114 .
- Access networks 120 and 122 may transmit and receive communications between respective UEs 108 , 110 , 112 , and 124 and core network 102 relating to communications with web servers, AS 104 , and/or other servers via the Internet and/or other networks, and so forth.
- the user endpoint devices 108 , 110 , 112 , and 114 may be any type of subscriber/customer endpoint device configured for wireless communication such as a laptop computer, a Wi-Fi device, a Personal Digital Assistant (PDA), a mobile phone, a smartphone, an email device, a computing tablet, a messaging device, a wearable “smart” device (e.g., a smart watch or fitness tracker), a portable media device (e.g., an MP3 player), a gaming console, a portable gaming device, a set top box, a smart television, and the like.
- PDA Personal Digital Assistant
- any one or more of the user endpoint devices 108 , 110 , 112 , and 114 may have both cellular and non-cellular access capabilities and may further have wired communication and networking capabilities (e.g., such as a desktop computer). It should be noted that although only four user endpoint devices are illustrated in FIG. 1 , any number of user endpoint devices may be deployed.
- the application server 104 is configured to aggregate data packets traversing the core network 102 into flows.
- the application server 104 is further configured to aggregate the flows into database records and to send the database records to the database 106 for storage.
- the application server 104 utilizes a subscriber table 116 to assign value to the flows (e.g., to differentiate between high value flows and low value flows).
- the application server 104 may use different aggregation periods for aggregating the high value flows and the low value flows into respective database records. For instance, high value flows may be aggregated into database records using a shorter aggregation period than is used for aggregating low value flows. Thus, database records containing high value flows will contain less metadata than database records containing low value flows, making the metadata contained in the high value flows more visible.
- the database 106 stores the database records produced by the application server 104 .
- the database 106 may be mined, e.g., by a communications service provider, for metadata indicative of subscriber use patterns. These use patterns, in turn, may be used to tailor service to subscribers (e.g., allocating more bandwidth, varying rate channel characteristics, deploying additional base stations, etc.).
- the application server 104 may comprise or be configured as a general purpose computer as illustrated in FIG. 3 and discussed below.
- the terms “configure” and “reconfigure” may refer to programming or loading a computing device with computer-readable/computer-executable instructions, code, and/or programs, e.g., in a memory, which when executed by a processor of the computing device, may cause the computing device to perform various functions.
- Such terms may also encompass providing variables, data values, tables, objects, or other data structures or the like which may cause a computer device executing computer-readable instructions, code, and/or programs to function differently depending upon the values of the variables or other data structures that are provided.
- the network 100 has been simplified.
- the network 100 may include other network elements (not shown) such as border elements, routers, switches, policy servers, security devices, a content distribution network (CDN) and the like.
- the network 100 may also be expanded by including additional endpoint devices, access networks, network elements, application servers, etc. without altering the scope of the present disclosure.
- FIG. 2 illustrates a flowchart of a first example method 200 for aggregating data flows based on the relative value of the data.
- the method 200 may be performed by the application server 104 illustrated in FIG. 1 .
- the method 200 may be performed by another device.
- any references in the discussion of the method 200 to the application server 104 of FIG. 1 (or any other elements of FIG. 1 ) are not intended to limit the means by which the method 200 may be performed.
- the method 200 begins in step 202 .
- network traffic in the form of a plurality of data packets is received or intercepted (e.g., by the application server 104 of FIG. 1 ).
- the plurality of data packets may be replicas of data packets that traverse a communications network (such as the network 100 of FIG. 1 ).
- the plurality of packets may include at least first packet and a second packet.
- the plurality of data packets is aggregated into a plurality of flows.
- a data packet is aggregated into a flow with other data packets sharing a common flow key, as discussed above.
- data packets that share the same source IP address, destination IP address, source port number, destination port number, and the type of service may be aggregated into a single flow.
- the plurality of flows may include at least a first flow and a second flow.
- each flow of the plurality of flows may be bound to an endpoint device (such as one of the UEs 108 , 110 , 112 , or 114 of FIG. 1 ).
- the flow may be bound to an endpoint device based on the source IP address, destination IP address, source port number, and/or destination port number.
- the endpoint device is an endpoint device that is used by a subscriber to access a communications network such as the network 100 of FIG. 1 .
- the value of each flow is determined.
- the value of a flow may be based on the number of data packets in the flow, the duration of the data packets in the flow, or on other metrics.
- the value of a flow may be determined based on an entry in a subscriber table (such as subscriber table 116 of FIG. 1 ) for the endpoint device to which it is bound. For instance, each endpoint device may be associated with a profile in the subscriber table.
- the profile may contain information regarding the historical patterns of usage of the endpoint device (e.g., the applications that are most frequently used on the endpoint device at particular times of day or on particular days of the week, the web sites that are most frequently visited using the endpoint device, the types of network traffic most frequently sent to/from the endpoint device while connected to the communications network, etc.).
- the value of a given flow can be estimated. For example, it may be determined that a given endpoint device is currently streaming video data (which may be associated with relatively long flows). It may also be determined, based on the profile for the given endpoint device in the subscriber table, that the given endpoint device is frequently used to stream video data. Thus, if a relatively short flow is bound to the endpoint device in step 208 , and this relatively short flow is determined to be concurrent with a longer flow, it may be determined that the value of the relatively short flow is low (e.g., it may constitute advertising as opposed to more substantive media content).
- a given endpoint device is frequently used to access a service associated with a particular domain name service (DNS) name server.
- DNS domain name service
- the DNS name server is associated with a lot of flows containing advertising.
- relatively short flows exchanged between the DNS name server and the endpoint device may be assumed to comprise advertising and may be considered to be of low value.
- the profiles in the subscriber table may provide context for the flows that are bound to the endpoint devices, and this context may help to distinguish between high value and low value flows.
- differentiation between high value and low value flows is a binary operation, e.g., each flow is identified as being either “high value” or “low value.” “High” or “low” may be determined relative to some predefined (configurable) threshold. For instance, flows whose values do not at least meet the predefined threshold may be considered “low” value, while flows whose values at least meet the predefined threshold may be considered “high” value. In other examples, however, the differentiation may be different. For instance, the value of a flow may be assigned as a numerical value on a scale of values (e.g., a scale from 1 to 5 ), a category on a rubric (e.g., very low, low, moderate, high, very high), or in some other way.
- a scale of values e.g., a scale from 1 to 5
- a category on a rubric e.g., very low, low, moderate, high, very high
- each flow is assigned to an aggregation period based on its value as determined in step 210 .
- each category or value is associated with a specific aggregation period. For instance, “high” value flows may be aggregated every S seconds, while “low” value flows may be aggregated every T seconds.
- the aggregation periods may be predefined based on the values of the flows. In one example, higher-value flows are assigned shorter aggregation periods, whereas lower value flows are assigned longer aggregation periods. Thus, the duration of the aggregation period for a flow is proportional to the flow's value.
- a plurality of different aggregation periods (e.g., including at least a first aggregation period and a second aggregation period) may be available.
- the plurality of flows is aggregated into a plurality of database records (e.g., including at least a first database record and a second database record) in accordance with their respective aggregation periods.
- FIG. 1 illustrates a first plurality of flows being aggregated into a first plurality of database records 124 according to a first aggregation period, and a second plurality of flows being aggregated into a second plurality of database records 126 according to a second, longer aggregation period.
- the plurality of database records is stored in a database (e.g., database 106 of FIG. 1 ).
- the database records By aggregating the flows in a manner proportional to value before storing the database records, it can be assured that the database records possess enough value (e.g., at least a threshold amount) to consume the network resources (processing, persistent storage, etc.) needed to maintain them.
- value e.g., at least a threshold amount
- the method 200 ends in step 216 .
- the database may subsequently be mined for data that can be used to tailor service to subscribers (e.g., allocating more bandwidth, varying rate channel characteristics, deploying additional base stations, etc.). For instance, network resources could be allocated in proportion to the values of the flows (e.g., high value flows such as flows associated with video streaming could be assigned more resources than low value flows).
- a database event e.g., a notification sent to a service provider
- the method 200 thus scales resource consumption while preserving the visibility of valuable metadata that can be used to improve service to subscribers.
- other techniques for scaling resource consumption such as sampling, tend to operate arbitrarily, without considering the relative value of various metadata.
- one or more steps of the method 200 may include a storing, displaying, and/or outputting step as required for a particular application.
- any data, records, fields, and/or intermediate results discussed in the method can be stored, displayed and/or outputted to another device as required for a particular application.
- operations, steps, or blocks in FIG. 2 that recite a determining operation or involve a decision do not necessarily require that both branches of the determining operation be practiced. In other words, one of the branches of the determining operation can be deemed as an optional step.
- operations, steps or blocks of the above described method(s) can be combined, separated, and/or performed in a different order from that described above, without departing from the examples of the present disclosure.
- FIG. 3 depicts a high-level block diagram of a computing device specifically programmed to perform the functions described herein.
- any one or more components or devices illustrated in FIG. 1 or described in connection with the method 200 may be implemented as the system 300 .
- the application server 104 of FIG. 1 (such as might be used to perform the method 200 ) could be implemented as illustrated in FIG. 3 .
- the system 300 comprises a hardware processor element 302 , a memory 304 , a module 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows, and various input/output (I/O) devices 306 .
- the hardware processor 302 may comprise, for example, a microprocessor, a central processing unit (CPU), or the like.
- the memory 304 may comprise, for example, random access memory (RAM), read only memory (ROM), a disk drive, an optical drive, a magnetic drive, and/or a Universal Serial Bus (USB) drive.
- the module 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows may include circuitry and/or logic for performing special purpose functions relating to data mining.
- the input/output devices 306 may include, for example, storage devices (including but not limited to, a tape drive, a floppy drive, a hard disk drive or a compact disk drive), a receiver, a transmitter, a fiber optic communications line, an output port, or a user input device (such as a keyboard, a keypad, a mouse, and the like).
- storage devices including but not limited to, a tape drive, a floppy drive, a hard disk drive or a compact disk drive
- a receiver a transmitter, a fiber optic communications line, an output port, or a user input device (such as a keyboard, a keypad, a mouse, and the like).
- the general-purpose computer may employ a plurality of processor elements.
- the general-purpose computer may employ a plurality of processor elements.
- the general-purpose computer of this Figure is intended to represent each of those multiple general-purpose computers.
- one or more hardware processors can be utilized in supporting a virtualized or shared computing environment.
- the virtualized computing environment may support one or more virtual machines representing computers, servers, or other computing devices. In such virtualized virtual machines, hardware components such as hardware processors and computer-readable storage devices may be virtualized or logically represented.
- instructions and data for the present module or process 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows can be loaded into memory 304 and executed by hardware processor element 302 to implement the steps, functions or operations as discussed above in connection with the example method 200 .
- a hardware processor executes instructions to perform “operations,” this could include the hardware processor performing the operations directly and/or facilitating, directing, or cooperating with another hardware device or component (e.g., a co-processor and the like) to perform the operations.
- the processor executing the computer readable or software instructions relating to the above described method(s) can be perceived as a programmed processor or a specialized processor.
- the present module 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows (including associated data structures, such as subscriber tables) of the present disclosure can be stored on a tangible or physical (broadly non-transitory) computer-readable storage device or medium, e.g., volatile memory, non-volatile memory, ROM memory, RAM memory, magnetic or optical drive, device or diskette and the like.
- the computer-readable storage device may comprise any physical devices that provide the ability to store information such as data and/or instructions to be accessed by a processor or a computing device such as a computer or an application server.
Abstract
Description
- This application is a continuation of U.S. patent application Ser. No. 15/952,829, filed on Apr. 13, 2018, now U.S. Pat. No. 10,999,167, which is herein incorporated by reference in its entirety.
- The present disclosure relates generally to data mining, and relates more particularly to devices, non-transitory computer-readable media, and methods for varying the aggregation periods for data flows relative to the values of the data contained in the flows.
- Data mining has become a valuable tool for helping network service providers to analyze and understand their subscribers' (i.e., customers′) service-related needs. For instance, information can be extracted from a data set (e.g., a set of packets exchanged between network endpoints) and transformed into a structure that can be analyzed for the occurrence of patterns, relationships, and other statistics that indicate how the subscribers are using the network.
- In one example, the present disclosure describes a device, computer-readable medium, and method for varying the aggregation periods for data flows relative to the values of the data contained in the flows. For instance, in one example, a method includes intercepting a first flow and a second flow traversing a communications network, assigning a first value to the first flow and a second value to the second flow, wherein the first value is higher than the second value, aggregating the first flow into a first database record according to a first aggregation period, aggregating the second flow into a second database record according to a second aggregation period that is longer than the first aggregation period, and storing the first database record and the second database record in a database.
- In another example, a computer-readable medium stores instructions which, when executed by a processor, cause the processor to perform operations. The operations include intercepting a first flow and a second flow traversing a communications network, assigning a first value to the first flow and a second value to the second flow, wherein the first value is higher than the second value, aggregating the first flow into a first database record according to a first aggregation period, aggregating the second flow into a second database record according to a second aggregation period that is longer than the first aggregation period, and storing the first database record and the second database record in a database.
- In another example, a device includes a processor and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations. The operations include intercepting a first flow and a second flow traversing a communications network, assigning a first value to the first flow and a second value to the second flow, wherein the first value is higher than the second value, aggregating the first flow into a first database record according to a first aggregation period, aggregating the second flow into a second database record according to a second aggregation period that is longer than the first aggregation period, and storing the first database record and the second database record in a database.
- The teachings of the present disclosure can be readily understood by considering the following detailed description in conjunction with the accompanying drawings, in which:
-
FIG. 1 illustrates an example network related to the present disclosure; -
FIG. 2 illustrates a flowchart of a first example method for aggregating data flows based on the relative value of the data; and -
FIG. 3 depicts a high-level block diagram of a computing device specifically programmed to perform the functions described herein. - To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures.
- In one example, the present disclosure varies the aggregation periods (i.e., the frequencies or intervals with which aggregation is performed) for data flows relative to the values of the data contained in the flows. As discussed above, data mining has become a valuable tool for helping network service providers to analyze and understand their subscribers' service-related needs. Network traffic can be analyzed for patterns, relationships, and other statistics that indicate how the subscribers are using the network.
- The basic unit of network traffic is a “flow,” i.e., a series of data packets exchanged between two network endpoints. Data packets belonging to the same flow of packets will contain the same flow key. In one embodiment, the flow key is a 5-tuple defining the Transmission Control Protocol/Internet Protocol (TCP/IP) connection via which the data packet travels. In one example, the 5-tuple includes: the source IP address, the destination IP address, the source port number (e.g., Transmission Control Protocol/User Datagram Protocol or TCP/UDP port number), the destination port number (e.g., TCP/UDP port number), and the type of service (ToS). Generally, data packets are aggregated into flows based on a fixed interval of time. For instance, data packets may be aggregated into flows every N seconds, where M flows are produced every N-second interval. In turn, the flows may be aggregated into database records and stored in a database every P seconds (where P may be greater than N). The database may subsequently be mined for metadata containing useful information, such as how particular subscribers use their endpoint devices (e.g., whether they use their endpoint devices mostly for streaming video, or playing games, or making phone calls). Once the patterns of use associated with a subscriber's endpoint device are known, a service provider may tailor the service to that endpoint device to better suit the subscriber's needs (e.g., allocating more bandwidth, varying rate channel characteristics, deploying additional base stations, etc.).
- The amount of metadata generated by even a single flow can be enormous. When scaled out to consider all flows generated by all endpoint devices in a communications network, it can be challenging to identify the metadata that is most valuable. This challenge is magnified by the fact that low-value flows and high-value flows conventionally consume the same amount of processing resources (e.g., central processing unit, random access memory, input/output) and the same storage footprint (e.g., in persistent storage). For instance, when a subscriber uses an endpoint device to visit a news web site, the endpoint device may be bombarded with a plurality of short-duration flows (e.g., advertisements) that give little insight into the device's patterns of use. At the same time, a longer-duration flow may be generated from the subscriber's interactions with one or more news articles, and this longer-duration flow may give more insight into the device's patterns of use. However, both the short-duration flows and the longer-duration flows may take up the same amount of space in the database due to the fact that they are aggregated according to the same aggregation period (e.g., M flows every N seconds).
- Examples of the present disclosure vary the aggregation periods for data flows relative to the values of the data contained in the flows. For instance, flows containing low value data may be aggregated into database records based on a first time interval, while flows containing high value information may be aggregated into database records based on a second time interval that is shorter than the first time interval. The level of granularity of detail in the high value flows when stored in the database will thus be greater than the level of granularity of detail in the low value flows, as the individual database records containing the high value flows will contain less data. This enhances the visibility of valuable metadata. The value of a flow, or of a data packet, may be determined in any one or more of a plurality of ways, including, for example, the number of data packets in the flow, the duration of the data packets in the flow, or other ways.
- Within the context of the present disclosure, the “value” of a flow refers to the impact the network traffic contained in a flow has on the physical network over which the network traffic is carried (or, alternatively, the level of insight the network traffic can provide into subscriber use patterns). The impact on the physical network may be evaluated in terms of the volume or rate of the network traffic, the type of the network traffic (e.g., Voice over Long Term Evolution, hot spot/tethered, connected car, streaming audio/video, etc.), anomalies (e.g., higher than average number of retransmits, etc.), and/or on other metrics. Moreover, examples of the disclosure define value at a subscriber-level granularity. The value of certain subscriber-centric metadata may increase over time, and may be allocated resources only when the value of the subscriber-centric metadata meets or exceeds a predefined (configurable) threshold.
- To better understand the present disclosure,
FIG. 1 illustrates anexample network 100, related to the present disclosure. Thenetwork 100 may be any type of communications network, such as for example, a traditional circuit switched network (CS) (e.g., a public switched telephone network (PSTN)) or an Internet Protocol (IP) network (e.g., an IP Multimedia Subsystem (IMS) network, an asynchronous transfer mode (ATM) network, a wireless network, a cellular network (e.g., 2G, 3G and the like), a long term evolution (LTE) network, and the like) related to the current disclosure. It should be noted that an IP network is broadly defined as a network that uses Internet Protocol to exchange data packets. Additional exemplary IP networks include Voice over IP (VoIP) networks, Service over IP (SoIP) networks, and the like. - In one embodiment, the
network 100 may comprise acore network 102. In one example,core network 102 may combine core network components of a cellular network with components of a triple play service network; where triple play services include telephone services, Internet services, and television services to subscribers. For example,core network 102 may functionally comprise a fixed mobile convergence (FMC) network, e.g., an IP Multimedia Subsystem (IMS) network. In addition,core network 102 may functionally comprise a telephony network, e.g., an Internet Protocol/Multi-Protocol Label Switching (IP/MPLS) backbone network utilizing Session Initiation Protocol (SIP) for circuit-switched and Voice over Internet Protocol (VoIP) telephony services.Core network 102 may also further comprise an Internet Service Provider (ISP) network. In one embodiment, thecore network 102 may include an application server (AS) 104 and a database (DB) 106. Although only asingle application server 104 and a single database 106 are illustrated, it should be noted that any number of application servers and databases may be deployed. Furthermore, for ease of illustration, various additional elements ofcore network 102 are omitted fromFIG. 1 , including switches, routers, firewalls, web servers, and the like. - The
core network 102 may be in communication with one or morewireless access networks access networks access networks core network 102 may provide a data service to subscribers viaaccess networks access networks core network 102 and theaccess networks - In one example, the
access network 120 may be in communication with one or more user endpoint devices (also referred to as “endpoint devices” or “UE”) 108 and 110, while theaccess network 122 may be in communication with one or moreuser endpoint devices 112 and 114.Access networks respective UEs core network 102 relating to communications with web servers, AS 104, and/or other servers via the Internet and/or other networks, and so forth. - In one embodiment, the
user endpoint devices user endpoint devices FIG. 1 , any number of user endpoint devices may be deployed. - In one example, the
application server 104 is configured to aggregate data packets traversing thecore network 102 into flows. Theapplication server 104 is further configured to aggregate the flows into database records and to send the database records to the database 106 for storage. In one example, theapplication server 104 utilizes a subscriber table 116 to assign value to the flows (e.g., to differentiate between high value flows and low value flows). As discussed in further detail below, theapplication server 104 may use different aggregation periods for aggregating the high value flows and the low value flows into respective database records. For instance, high value flows may be aggregated into database records using a shorter aggregation period than is used for aggregating low value flows. Thus, database records containing high value flows will contain less metadata than database records containing low value flows, making the metadata contained in the high value flows more visible. - The database 106 stores the database records produced by the
application server 104. The database 106 may be mined, e.g., by a communications service provider, for metadata indicative of subscriber use patterns. These use patterns, in turn, may be used to tailor service to subscribers (e.g., allocating more bandwidth, varying rate channel characteristics, deploying additional base stations, etc.). - The
application server 104 may comprise or be configured as a general purpose computer as illustrated inFIG. 3 and discussed below. It should also be noted that as used herein, the terms “configure” and “reconfigure” may refer to programming or loading a computing device with computer-readable/computer-executable instructions, code, and/or programs, e.g., in a memory, which when executed by a processor of the computing device, may cause the computing device to perform various functions. Such terms may also encompass providing variables, data values, tables, objects, or other data structures or the like which may cause a computer device executing computer-readable instructions, code, and/or programs to function differently depending upon the values of the variables or other data structures that are provided. - Those skilled in the art will realize that the
network 100 has been simplified. For example, thenetwork 100 may include other network elements (not shown) such as border elements, routers, switches, policy servers, security devices, a content distribution network (CDN) and the like. Thenetwork 100 may also be expanded by including additional endpoint devices, access networks, network elements, application servers, etc. without altering the scope of the present disclosure. - To further aid in understanding the present disclosure,
FIG. 2 illustrates a flowchart of afirst example method 200 for aggregating data flows based on the relative value of the data. In one example, themethod 200 may be performed by theapplication server 104 illustrated inFIG. 1 . However, in other examples, themethod 200 may be performed by another device. As such, any references in the discussion of themethod 200 to theapplication server 104 ofFIG. 1 (or any other elements ofFIG. 1 ) are not intended to limit the means by which themethod 200 may be performed. - The
method 200 begins instep 202. Instep 204, network traffic in the form of a plurality of data packets is received or intercepted (e.g., by theapplication server 104 ofFIG. 1 ). The plurality of data packets may be replicas of data packets that traverse a communications network (such as thenetwork 100 ofFIG. 1 ). The plurality of packets may include at least first packet and a second packet. - In
step 206, the plurality of data packets is aggregated into a plurality of flows. In one example, a data packet is aggregated into a flow with other data packets sharing a common flow key, as discussed above. Thus, data packets that share the same source IP address, destination IP address, source port number, destination port number, and the type of service may be aggregated into a single flow. The plurality of flows may include at least a first flow and a second flow. - In
step 208, each flow of the plurality of flows may be bound to an endpoint device (such as one of theUEs FIG. 1 ). The flow may be bound to an endpoint device based on the source IP address, destination IP address, source port number, and/or destination port number. In one example, the endpoint device is an endpoint device that is used by a subscriber to access a communications network such as thenetwork 100 ofFIG. 1 . - In
step 210, the value of each flow is determined. As discussed above, in one example, the value of a flow may be based on the number of data packets in the flow, the duration of the data packets in the flow, or on other metrics. In another example, the value of a flow may be determined based on an entry in a subscriber table (such as subscriber table 116 ofFIG. 1 ) for the endpoint device to which it is bound. For instance, each endpoint device may be associated with a profile in the subscriber table. The profile may contain information regarding the historical patterns of usage of the endpoint device (e.g., the applications that are most frequently used on the endpoint device at particular times of day or on particular days of the week, the web sites that are most frequently visited using the endpoint device, the types of network traffic most frequently sent to/from the endpoint device while connected to the communications network, etc.). - Based on the information regarding the historical patterns of usage, the value of a given flow can be estimated. For example, it may be determined that a given endpoint device is currently streaming video data (which may be associated with relatively long flows). It may also be determined, based on the profile for the given endpoint device in the subscriber table, that the given endpoint device is frequently used to stream video data. Thus, if a relatively short flow is bound to the endpoint device in
step 208, and this relatively short flow is determined to be concurrent with a longer flow, it may be determined that the value of the relatively short flow is low (e.g., it may constitute advertising as opposed to more substantive media content). Alternatively, it may be known, based on the corresponding profile in the subscriber table, that a given endpoint device is frequently used to access a service associated with a particular domain name service (DNS) name server. It may also be known that the DNS name server is associated with a lot of flows containing advertising. Thus, relatively short flows exchanged between the DNS name server and the endpoint device may be assumed to comprise advertising and may be considered to be of low value. As such, the profiles in the subscriber table may provide context for the flows that are bound to the endpoint devices, and this context may help to distinguish between high value and low value flows. - In one example, differentiation between high value and low value flows is a binary operation, e.g., each flow is identified as being either “high value” or “low value.” “High” or “low” may be determined relative to some predefined (configurable) threshold. For instance, flows whose values do not at least meet the predefined threshold may be considered “low” value, while flows whose values at least meet the predefined threshold may be considered “high” value. In other examples, however, the differentiation may be different. For instance, the value of a flow may be assigned as a numerical value on a scale of values (e.g., a scale from 1 to 5), a category on a rubric (e.g., very low, low, moderate, high, very high), or in some other way.
- In
step 212, each flow is assigned to an aggregation period based on its value as determined instep 210. In one example, each category or value is associated with a specific aggregation period. For instance, “high” value flows may be aggregated every S seconds, while “low” value flows may be aggregated every T seconds. The aggregation periods may be predefined based on the values of the flows. In one example, higher-value flows are assigned shorter aggregation periods, whereas lower value flows are assigned longer aggregation periods. Thus, the duration of the aggregation period for a flow is proportional to the flow's value. A plurality of different aggregation periods (e.g., including at least a first aggregation period and a second aggregation period) may be available. - In
step 214, the plurality of flows is aggregated into a plurality of database records (e.g., including at least a first database record and a second database record) in accordance with their respective aggregation periods. For instance,FIG. 1 illustrates a first plurality of flows being aggregated into a first plurality ofdatabase records 124 according to a first aggregation period, and a second plurality of flows being aggregated into a second plurality ofdatabase records 126 according to a second, longer aggregation period. The plurality of database records is stored in a database (e.g., database 106 ofFIG. 1 ). By aggregating the flows in a manner proportional to value before storing the database records, it can be assured that the database records possess enough value (e.g., at least a threshold amount) to consume the network resources (processing, persistent storage, etc.) needed to maintain them. - The
method 200 ends instep 216. The database may subsequently be mined for data that can be used to tailor service to subscribers (e.g., allocating more bandwidth, varying rate channel characteristics, deploying additional base stations, etc.). For instance, network resources could be allocated in proportion to the values of the flows (e.g., high value flows such as flows associated with video streaming could be assigned more resources than low value flows). In another example, a database event (e.g., a notification sent to a service provider) could be triggered when the value of a flow aggregated into an incoming database record exceeds a predefined (configurable) threshold. Themethod 200 thus scales resource consumption while preserving the visibility of valuable metadata that can be used to improve service to subscribers. By contrast, other techniques for scaling resource consumption, such as sampling, tend to operate arbitrarily, without considering the relative value of various metadata. - Although not expressly specified above, one or more steps of the
method 200 may include a storing, displaying, and/or outputting step as required for a particular application. In other words, any data, records, fields, and/or intermediate results discussed in the method can be stored, displayed and/or outputted to another device as required for a particular application. Furthermore, operations, steps, or blocks inFIG. 2 that recite a determining operation or involve a decision do not necessarily require that both branches of the determining operation be practiced. In other words, one of the branches of the determining operation can be deemed as an optional step. Furthermore, operations, steps or blocks of the above described method(s) can be combined, separated, and/or performed in a different order from that described above, without departing from the examples of the present disclosure. -
FIG. 3 depicts a high-level block diagram of a computing device specifically programmed to perform the functions described herein. For example, any one or more components or devices illustrated inFIG. 1 or described in connection with themethod 200 may be implemented as thesystem 300. For instance, theapplication server 104 ofFIG. 1 (such as might be used to perform the method 200) could be implemented as illustrated inFIG. 3 . - As depicted in
FIG. 3 , thesystem 300 comprises ahardware processor element 302, amemory 304, amodule 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows, and various input/output (I/O)devices 306. - The
hardware processor 302 may comprise, for example, a microprocessor, a central processing unit (CPU), or the like. Thememory 304 may comprise, for example, random access memory (RAM), read only memory (ROM), a disk drive, an optical drive, a magnetic drive, and/or a Universal Serial Bus (USB) drive. Themodule 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows may include circuitry and/or logic for performing special purpose functions relating to data mining. The input/output devices 306 may include, for example, storage devices (including but not limited to, a tape drive, a floppy drive, a hard disk drive or a compact disk drive), a receiver, a transmitter, a fiber optic communications line, an output port, or a user input device (such as a keyboard, a keypad, a mouse, and the like). - Although only one processor element is shown, it should be noted that the general-purpose computer may employ a plurality of processor elements. Furthermore, although only one general-purpose computer is shown in the Figure, if the method(s) as discussed above is implemented in a distributed or parallel manner for a particular illustrative example, i.e., the steps of the above method(s) or the entire method(s) are implemented across multiple or parallel general-purpose computers, then the general-purpose computer of this Figure is intended to represent each of those multiple general-purpose computers. Furthermore, one or more hardware processors can be utilized in supporting a virtualized or shared computing environment. The virtualized computing environment may support one or more virtual machines representing computers, servers, or other computing devices. In such virtualized virtual machines, hardware components such as hardware processors and computer-readable storage devices may be virtualized or logically represented.
- It should be noted that the present disclosure can be implemented in software and/or in a combination of software and hardware, e.g., using application specific integrated circuits (ASIC), a programmable logic array (PLA), including a field-programmable gate array (FPGA), or a state machine deployed on a hardware device, a general purpose computer or any other hardware equivalents, e.g., computer readable instructions pertaining to the method(s) discussed above can be used to configure a hardware processor to perform the steps, functions and/or operations of the above disclosed method(s). In one example, instructions and data for the present module or
process 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows (e.g., a software program comprising computer-executable instructions) can be loaded intomemory 304 and executed byhardware processor element 302 to implement the steps, functions or operations as discussed above in connection with theexample method 200. Furthermore, when a hardware processor executes instructions to perform “operations,” this could include the hardware processor performing the operations directly and/or facilitating, directing, or cooperating with another hardware device or component (e.g., a co-processor and the like) to perform the operations. - The processor executing the computer readable or software instructions relating to the above described method(s) can be perceived as a programmed processor or a specialized processor. As such, the
present module 305 for varying the aggregation periods for data flows relative to the values of the data contained in the flows (including associated data structures, such as subscriber tables) of the present disclosure can be stored on a tangible or physical (broadly non-transitory) computer-readable storage device or medium, e.g., volatile memory, non-volatile memory, ROM memory, RAM memory, magnetic or optical drive, device or diskette and the like. More specifically, the computer-readable storage device may comprise any physical devices that provide the ability to store information such as data and/or instructions to be accessed by a processor or a computing device such as a computer or an application server. - While various examples have been described above, it should be understood that they have been presented by way of example only, and not limitation. Thus, the breadth and scope of a preferred example should not be limited by any of the above-described example examples, but should be defined only in accordance with the following claims and their equivalents.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/306,876 US20210258232A1 (en) | 2018-04-13 | 2021-05-03 | Varying data flow aggregation period relative to data value |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/952,829 US10999167B2 (en) | 2018-04-13 | 2018-04-13 | Varying data flow aggregation period relative to data value |
US17/306,876 US20210258232A1 (en) | 2018-04-13 | 2021-05-03 | Varying data flow aggregation period relative to data value |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/952,829 Continuation US10999167B2 (en) | 2018-04-13 | 2018-04-13 | Varying data flow aggregation period relative to data value |
Publications (1)
Publication Number | Publication Date |
---|---|
US20210258232A1 true US20210258232A1 (en) | 2021-08-19 |
Family
ID=68160514
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/952,829 Active 2038-10-31 US10999167B2 (en) | 2018-04-13 | 2018-04-13 | Varying data flow aggregation period relative to data value |
US17/306,876 Abandoned US20210258232A1 (en) | 2018-04-13 | 2021-05-03 | Varying data flow aggregation period relative to data value |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/952,829 Active 2038-10-31 US10999167B2 (en) | 2018-04-13 | 2018-04-13 | Varying data flow aggregation period relative to data value |
Country Status (1)
Country | Link |
---|---|
US (2) | US10999167B2 (en) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20240015110A1 (en) * | 2022-07-06 | 2024-01-11 | Cisco Technology, Inc. | Intelligent packet distribution control for optimizing system performance and cost |
Citations (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6839751B1 (en) * | 1999-06-30 | 2005-01-04 | Hi/Fn, Inc. | Re-using information from data transactions for maintaining statistics in network monitoring |
US6850764B1 (en) * | 1998-12-17 | 2005-02-01 | Cisco Technology, Inc. | Method and system for allocating bandwidth in a wireless communications network |
US7002960B1 (en) * | 2001-10-30 | 2006-02-21 | At&T Corp. | Traffic matrix computation for packet networks |
US20080253287A1 (en) * | 2007-04-04 | 2008-10-16 | Binita Gupta | Methods and Apparatus for Flow Data Acquisition in a Multi-Frequency Network |
US20090059812A1 (en) * | 2007-08-29 | 2009-03-05 | Sudhagar Chinnaswamy | Adaptive method and apparatus for adjusting network traffic volume reporting |
US7580356B1 (en) * | 2005-06-24 | 2009-08-25 | Packeteer, Inc. | Method and system for dynamically capturing flow traffic data |
US20100070647A1 (en) * | 2006-11-21 | 2010-03-18 | Nippon Telegraph And Telephone Corporation | Flow record restriction apparatus and the method |
US20110040706A1 (en) * | 2009-08-11 | 2011-02-17 | At&T Intellectual Property I, Lp | Scalable traffic classifier and classifier training system |
US7990982B2 (en) * | 2008-12-15 | 2011-08-02 | At&T Intellectual Property I, L.P. | Methods and apparatus to bound network traffic estimation error for multistage measurement sampling and aggregation |
US8095635B2 (en) * | 2008-07-21 | 2012-01-10 | At&T Intellectual Property I, Lp | Managing network traffic for improved availability of network services |
US8125909B2 (en) * | 2009-10-22 | 2012-02-28 | Motorola Solutions, Inc. | Methods and apparatus for controlling congestion in a communication network |
US20120064908A1 (en) * | 2010-07-02 | 2012-03-15 | David Andrew Fox | Telecommunication networks |
US20120311704A1 (en) * | 2011-06-03 | 2012-12-06 | Fluke Corporation | Method and Apparatus for Efficient Netflow Data Analysis |
US20170090679A1 (en) * | 2015-09-25 | 2017-03-30 | International Business Machines Corporation | Adaptive user interface |
US20170126550A1 (en) * | 2015-10-29 | 2017-05-04 | Ca, Inc. | Selecting a flow data source |
US20170126583A1 (en) * | 2015-11-03 | 2017-05-04 | Le Holdings (Beijing) Co., Ltd. | Method and electronic device for bandwidth allocation based on online media services |
US20180069668A1 (en) * | 1998-07-10 | 2018-03-08 | Intellectual Ventures I Llc | TRANSMISSION CONTROL PROTOCOL/INTERNET PROTOCOL (TCP/IP) PACKET-CENTRIC WIRELESS POINT TO MULTI-POINT (PtMP) TRANSMISSION SYSTEM ARCHITECTURE |
US20180103408A1 (en) * | 2016-10-10 | 2018-04-12 | Netgear, Inc. | Machine learning coordinated wireless networking |
US20180145906A1 (en) * | 2016-11-22 | 2018-05-24 | Cisco Technology, Inc. | Federated microburst detection |
US20180176624A1 (en) * | 2016-07-07 | 2018-06-21 | Telefonaktiebolaget Lm Ericsson (Publ) | Bandwidth and ABR Video QoE Management Based On OTT Video Providers and Devices |
US20180225132A1 (en) * | 2017-02-07 | 2018-08-09 | Samsung Electronics Co., Ltd. | Platform and interface for providing user assistance in a computing system |
US10080155B1 (en) * | 2017-03-16 | 2018-09-18 | ARRIS Enterprises, LLC | Dynamic data collection in a WLAN |
US20180375915A1 (en) * | 2017-06-23 | 2018-12-27 | Nokia Solutions And Networks Oy | Quality-of-experience for adaptive bitrate streaming |
US10333996B2 (en) * | 2016-10-14 | 2019-06-25 | CALLSTATS I/O Oy | Methods and systems for analyzing streaming media sessions |
US10897389B2 (en) * | 2018-09-14 | 2021-01-19 | Cisco Technology, Inc. | Threshold selection for KPI candidacy in root cause analysis of network issues |
Family Cites Families (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7143153B1 (en) | 2000-11-09 | 2006-11-28 | Ciena Corporation | Internal network device dynamic health monitoring |
US20020188710A1 (en) | 2001-03-18 | 2002-12-12 | At&T Corp. | Size-dependent sampling for managing a data network |
US7506046B2 (en) | 2001-07-31 | 2009-03-17 | Hewlett-Packard Development Company, L.P. | Network usage analysis system and method for updating statistical models |
US7543052B1 (en) | 2003-12-22 | 2009-06-02 | Packeteer, Inc. | Automatic network traffic discovery and classification mechanism including dynamic discovery thresholds |
US7571181B2 (en) | 2004-04-05 | 2009-08-04 | Hewlett-Packard Development Company, L.P. | Network usage analysis system and method for detecting network congestion |
US9407518B2 (en) | 2005-08-19 | 2016-08-02 | Cpacket Networks Inc. | Apparatus, system, and method for enhanced reporting and measurement of performance data |
US9003010B1 (en) | 2007-05-30 | 2015-04-07 | Expo Service Assurance Inc. | Scalable network monitoring system |
US9331919B2 (en) | 2007-11-30 | 2016-05-03 | Solarwinds Worldwide, Llc | Method for summarizing flow information of network devices |
US7873727B2 (en) | 2008-03-13 | 2011-01-18 | Board Of Regents, The University Of Texas Systems | System and method for evaluating streaming multimedia quality |
CN102217234A (en) | 2009-05-08 | 2011-10-12 | 圣斯马来西亚大学 | A real time distributed network monitoring and security monitoring platform (rtdnms) |
US9294560B2 (en) | 2009-06-04 | 2016-03-22 | Bae Systems Plc | System and method of analysing transfer of data over at least one network |
WO2012142854A1 (en) | 2011-04-18 | 2012-10-26 | 北京新媒传信科技有限公司 | Application service platform system and implementation method thereof |
US9392010B2 (en) | 2011-11-07 | 2016-07-12 | Netflow Logic Corporation | Streaming method and system for processing network metadata |
DE102012110802A1 (en) | 2012-05-15 | 2013-11-21 | Schneider Electric Automation Gmbh | Method for monitoring, control and data acquisition of system components of a service-oriented automation system and automation system for carrying out the method |
CN103516558B (en) | 2012-06-30 | 2016-12-21 | 北京新媒传信科技有限公司 | Monitor supervision platform and on server application monitoring method |
WO2014040193A1 (en) | 2012-09-17 | 2014-03-20 | Select Technology Corporation Limited | Method and system for monitoring network communications |
US9438488B2 (en) | 2012-11-09 | 2016-09-06 | Citrix Systems, Inc. | Systems and methods for appflow for datastream |
US9246747B2 (en) | 2012-11-15 | 2016-01-26 | Hong Kong Applied Science and Technology Research Co., Ltd. | Adaptive unified performance management (AUPM) with root cause and/or severity analysis for broadband wireless access networks |
US9130826B2 (en) | 2013-03-15 | 2015-09-08 | Enterasys Networks, Inc. | System and related method for network monitoring and control based on applications |
US8966074B1 (en) | 2013-09-13 | 2015-02-24 | Network Kinetix, LLC | System and method for real-time analysis of network traffic |
US9755942B2 (en) | 2013-10-25 | 2017-09-05 | Vmware, Inc. | Method and system for monitoring conditions in a dynamic network environment |
US9549335B2 (en) | 2014-04-21 | 2017-01-17 | Verizon Patent And Licensing Inc. | Traffic aggregation at end device |
US9934683B2 (en) | 2014-05-29 | 2018-04-03 | Here Global B.V. | Traffic aggregation and reporting in real-time |
US9860145B2 (en) | 2015-07-02 | 2018-01-02 | Microsoft Technology Licensing, Llc | Recording of inter-application data flow |
CN106982173A (en) | 2016-01-18 | 2017-07-25 | 中兴通讯股份有限公司 | A kind of tunnel traffic control method, device and NMS |
-
2018
- 2018-04-13 US US15/952,829 patent/US10999167B2/en active Active
-
2021
- 2021-05-03 US US17/306,876 patent/US20210258232A1/en not_active Abandoned
Patent Citations (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20180069668A1 (en) * | 1998-07-10 | 2018-03-08 | Intellectual Ventures I Llc | TRANSMISSION CONTROL PROTOCOL/INTERNET PROTOCOL (TCP/IP) PACKET-CENTRIC WIRELESS POINT TO MULTI-POINT (PtMP) TRANSMISSION SYSTEM ARCHITECTURE |
US6850764B1 (en) * | 1998-12-17 | 2005-02-01 | Cisco Technology, Inc. | Method and system for allocating bandwidth in a wireless communications network |
US6839751B1 (en) * | 1999-06-30 | 2005-01-04 | Hi/Fn, Inc. | Re-using information from data transactions for maintaining statistics in network monitoring |
US7002960B1 (en) * | 2001-10-30 | 2006-02-21 | At&T Corp. | Traffic matrix computation for packet networks |
US7580356B1 (en) * | 2005-06-24 | 2009-08-25 | Packeteer, Inc. | Method and system for dynamically capturing flow traffic data |
US20100070647A1 (en) * | 2006-11-21 | 2010-03-18 | Nippon Telegraph And Telephone Corporation | Flow record restriction apparatus and the method |
US20080253287A1 (en) * | 2007-04-04 | 2008-10-16 | Binita Gupta | Methods and Apparatus for Flow Data Acquisition in a Multi-Frequency Network |
US20090059812A1 (en) * | 2007-08-29 | 2009-03-05 | Sudhagar Chinnaswamy | Adaptive method and apparatus for adjusting network traffic volume reporting |
US8095635B2 (en) * | 2008-07-21 | 2012-01-10 | At&T Intellectual Property I, Lp | Managing network traffic for improved availability of network services |
US7990982B2 (en) * | 2008-12-15 | 2011-08-02 | At&T Intellectual Property I, L.P. | Methods and apparatus to bound network traffic estimation error for multistage measurement sampling and aggregation |
US20110040706A1 (en) * | 2009-08-11 | 2011-02-17 | At&T Intellectual Property I, Lp | Scalable traffic classifier and classifier training system |
US8125909B2 (en) * | 2009-10-22 | 2012-02-28 | Motorola Solutions, Inc. | Methods and apparatus for controlling congestion in a communication network |
US20120064908A1 (en) * | 2010-07-02 | 2012-03-15 | David Andrew Fox | Telecommunication networks |
US20120311704A1 (en) * | 2011-06-03 | 2012-12-06 | Fluke Corporation | Method and Apparatus for Efficient Netflow Data Analysis |
US20170090679A1 (en) * | 2015-09-25 | 2017-03-30 | International Business Machines Corporation | Adaptive user interface |
US20170126550A1 (en) * | 2015-10-29 | 2017-05-04 | Ca, Inc. | Selecting a flow data source |
US20170126583A1 (en) * | 2015-11-03 | 2017-05-04 | Le Holdings (Beijing) Co., Ltd. | Method and electronic device for bandwidth allocation based on online media services |
US20180176624A1 (en) * | 2016-07-07 | 2018-06-21 | Telefonaktiebolaget Lm Ericsson (Publ) | Bandwidth and ABR Video QoE Management Based On OTT Video Providers and Devices |
US20180103408A1 (en) * | 2016-10-10 | 2018-04-12 | Netgear, Inc. | Machine learning coordinated wireless networking |
US10333996B2 (en) * | 2016-10-14 | 2019-06-25 | CALLSTATS I/O Oy | Methods and systems for analyzing streaming media sessions |
US20180145906A1 (en) * | 2016-11-22 | 2018-05-24 | Cisco Technology, Inc. | Federated microburst detection |
US20180225132A1 (en) * | 2017-02-07 | 2018-08-09 | Samsung Electronics Co., Ltd. | Platform and interface for providing user assistance in a computing system |
US10080155B1 (en) * | 2017-03-16 | 2018-09-18 | ARRIS Enterprises, LLC | Dynamic data collection in a WLAN |
US20180375915A1 (en) * | 2017-06-23 | 2018-12-27 | Nokia Solutions And Networks Oy | Quality-of-experience for adaptive bitrate streaming |
US10897389B2 (en) * | 2018-09-14 | 2021-01-19 | Cisco Technology, Inc. | Threshold selection for KPI candidacy in root cause analysis of network issues |
Non-Patent Citations (3)
Title |
---|
K. Akkaya, M. Demirbas, R. Savas Aygun, "The impact of data aggregation on the performance of wireless sensor networks," 2006 Wireless Communications And Mobile Computing (Wiley Interscience), 2016, doi: 10.1002/wcm.454. (Year: 2006) * |
L. Deri and F. Fusco, "Realtime MicroCloud-based flow aggregation for fixed and mobile networks," 2013 9th International Wireless Communications and Mobile Computing Conference (IWCMC), 2013, pp. 96-101, doi: 10.1109/IWCMC.2013.6583541. (Year: 2013) * |
S. Tremko, A. Pekár, J. Juhár and J. Janitor, "Reduction of IP flow information in network traffic monitoring systems," 2014 IEEE 12th IEEE International Conference on Emerging eLearning Technologies and Applications (ICETA), 2014, pp. 385-390, doi: 10.1109/ICETA.2014.7107616. (Year: 2014) * |
Also Published As
Publication number | Publication date |
---|---|
US10999167B2 (en) | 2021-05-04 |
US20190319862A1 (en) | 2019-10-17 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10917809B2 (en) | Systems and methods for providing mobility aspects to applications in the cloud | |
US20200195673A1 (en) | Risk identification for unlabeled threats in network traffic | |
US11483727B2 (en) | Subscriber data analysis and graphical rendering | |
US20180212837A1 (en) | Network resource allocation based upon network service profile trajectories | |
US10230622B2 (en) | Integrated wireline and wireless access using software defined networking | |
US10469671B2 (en) | Network-based per-application data usage limitations | |
US20220124185A1 (en) | Terabit-scale network packet processing via flow-level parallelization | |
US10743249B2 (en) | Methods and apparatus for generating recommended changes to communication behaviors | |
US11159448B2 (en) | Dynamically modifying service delivery parameters | |
CN110870256B (en) | Method, system and computer readable medium for operating a telecommunication network | |
JP7036225B2 (en) | Estimator, system and method and program and learning device and method and program | |
US20210258232A1 (en) | Varying data flow aggregation period relative to data value | |
US20230283523A1 (en) | Handling, controlling, and managing internet protocol assets using machine learning | |
Luglio et al. | A Flexible Web Traffic Generator for the dimensioning of a 5G backhaul in NPN | |
US11330039B2 (en) | Application classification | |
Klessig et al. | Impact of inter-cell interference on buffered video streaming startup delays | |
Melak Asmare et al. | A survey on 3G mobile network traffic performance and analysis in Ethiopia | |
Gonçalves et al. | On the impact of user segmentation and behaviour analysis over traffic generation in beyond 4G networks | |
Colarieti et al. | QoE provisioning over mobile networks: The CASPER perspective | |
US20240031829A1 (en) | Optimization of long term evolution/fifth generation service through conformity-based recommendations | |
Niephaus et al. | Towards QoS-aware load distribution in heterogeneous networks | |
US20220174534A1 (en) | Automatic adjustment of throughput rate to optimize wireless device battery performance | |
US20220138642A1 (en) | Forecasting based on planning data | |
US10492063B2 (en) | Aggregating network cell data to address user privacy | |
Ilisevic et al. | Advanced regulation approach: Dynamic rules for capturing the full potential of future ICT networks |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: AT&T INTELLECTUAL PROPERTY I, L.P., GEORGIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:ZAIFMAN, ARTHUR;MOCENIGO, JOHN MARK;DORSEY, JOSEPH, JR.;SIGNING DATES FROM 20180411 TO 20180412;REEL/FRAME:056120/0634 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: APPLICATION DISPATCHED FROM PREEXAM, NOT YET DOCKETED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |