Patent Application
20130238782
1. Field
Example embodiments relate generally to identifying applications associated with IP flows in communications networks.
2. Background
Internet IP traffic may be monitored in order to find out the type of applications that a particular IP flow carries. This application information may be used by service providers, both wireless and wireline, for marketing research, traffic policing, and general network intelligence. Enterprise networks may use this application information for their policy enforcement and traffic awareness. Presently, methods of determining an application associated with an IP flow include analyzing an IP address and/or subnet, a port and a protocol; and performing deep packet inspection (DPI) by looking for signature strings in IP traffic that match a known string of an application.
A method of handling application data associated with IP flows traveling between a plurality of mobiles and a network element in a communications network may include receiving, at a network element, one or more domain name system (DNS) packets being sent to one or more mobiles from among of the plurality of mobiles; and building, at the network element, a mapping table mapping one or more IP addresses, respectively, to corresponding application information, based on mapping information within the one or more DNS packets received at the network element.
The application information may be at least one of a host name read from the one or more DNS packets received at the network element, and a name of an application corresponding to the read host name.
The received DNS packets may be DNS response packets, and building the mapping table may include reading the one or more IP addresses and one or more host names corresponding to the one or more IP addresses from the one or more DNS packets received at the network element.
The method may further comprise receiving, at the network element, an IP data packet being sent to or from a mobile of the plurality of mobiles; and identifying application information associated with the received IP data packet by searching the mapping table based on the IP data packet.
Searching the mapping table may include selecting application data in the mapping table corresponding to a sender IP address in the mapping table as the identified application information, if the received IP data packet is a packet being sent to one of the plurality of mobiles, the sender IP address being a sender IP address of the received IP data packet. Searching the mapping table may include selecting application information corresponding to a destination IP address in the mapping table as the identified application information, if the received IP data packet is a packet being sent from one of the plurality of mobiles, the destination IP address being a destination IP address of the received IP data packet.
The method may further include identifying, at the network element, the mobile from among the one or more mobiles the IP data packet received at the network element is being sent to or from; building a tracking database including sections corresponding to each of the plurality of mobile devices; and forming an entry in the tracking database corresponding to the identified application information, the entry being formed in the section of the tracking database which corresponds to the identified mobile.
The identified application information may be a host name, and the entry formed in the tracking database is a name of an application corresponding to the host name.
The mapping table may be a hash table.
A network apparatus for handling application data associated with IP flows traveling between a plurality of mobiles and the network apparatus in a communications network may include a data receiving unit; a data transmitting unit; a memory unit configured to store parameters corresponding with a plurality mobiles in communication with the network element; and a processing unit coupled to the data transmitting unit, the data receiving unit, and the memory unit and configured to control operations. The controlled operations may include receiving one or more domain name system (DNS) packets being sent to one or more mobiles from among the plurality of mobiles; and building a mapping table mapping one or more IP addresses, respectively, to corresponding application information, based on mapping information within the one or more DNS packets received at the network apparatus.
The application information may be at least one of a host name read from the one or more DNS packets received at the network element, and a name of an application corresponding to the read host name.
The received DNS packets may be DNS response packets, and the processing unit may be configured such that the building the mapping table includes reading the one or more IP addresses and one or more host names corresponding to the one or more IP address from the one or more DNS packets received at the network apparatus.
The processing unit may be further configured to control operations including, receiving an IP data packet being sent to or from a mobile from among the plurality of mobiles; and identifying application information associated with the received IP data packet by searching the mapping table based on the IP data packet.
The processing unit may be configured such that the searching the mapping table includes selecting application data in the mapping table corresponding to a sender IP address in the mapping table as the identified application information, if the received IP data packet is a packet being sent to one of the plurality of mobiles, the sender IP address being a sender IP address of the received IP data packet. The processing unit may be configured such that, the searching the mapping table includes selecting application information corresponding to a destination IP address in the mapping table as the identified application information, if the received IP data packet is a packet being sent from one of the plurality of mobiles, the destination IP address being a destination IP address of the received IP data packet.
The processing unit may be further configured to control operations including, identifying the mobile from among the one or more mobiles the received IP data packet is being sent to or from; building a tracking database including sections corresponding to each of the plurality of mobile devices; and forming an entry in the tracking database corresponding to the identified application information, the entry being formed in the section of the tracking database which corresponds to the identified mobile.
The application information may be a host name, and the entry formed in the tracking database is a name of an application corresponding to the host name.
The mapping table may be a hash table.
Example embodiments will become more fully understood from the detailed description provided below and the accompanying drawings, wherein like elements are represented by like reference numerals, which are given by way of illustration only and thus are not limiting and wherein:
At least one example embodiment will now be described more fully with reference to the accompanying drawings in which some example embodiments are shown.
Detailed illustrative embodiments are disclosed herein. However, specific structural and functional details disclosed herein are merely representative for purposes of describing at least one example embodiment. Example embodiments may, however, be embodied in many alternate forms and should not be construed as limited to only the embodiments set forth herein.
Accordingly, while example embodiments are capable of various adaptations and alternative forms, embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit example embodiments to the particular forms disclosed, but on the contrary, example embodiments are to cover all adaptations, equivalents, and alternatives falling within the scope of example embodiments. Like numbers refer to like elements throughout the description of the figures. As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed items.
It will be understood that when an element is referred to as being “connected” or “coupled” to another element, it can be directly connected or coupled to the other element or intervening elements may be present. In contrast, when an element is referred to as being “directly connected” or “directly coupled” to another element, there are no intervening elements present. Other words used to describe the relationship between elements should be interpreted in a like fashion (e.g., “between” versus “directly between”, “adjacent” versus “directly adjacent”, etc.).
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising,”, “includes” and/or “including”, when used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It should also be noted that in some alternative implementations, the functions/acts noted may occur out of the order noted in the figures. For example, two figures shown in succession may in fact be executed substantially concurrently or may sometimes be executed in the reverse order, depending upon the functionality/acts involved.
As used herein, the term user equipment (UE) may be considered synonymous to, and may hereafter be occasionally referred to, as a terminal, mobile unit, mobile station, mobile user, access terminal (AT), subscriber, user, remote station, access terminal, receiver, etc., and may describe a remote user of wireless resources in a wireless communication network. The term base station (BS) may be considered synonymous to and/or referred to as a base transceiver station (BTS), NodeB, extended Node B (eNB), access point (AP), etc. and may describe equipment that provides the radio baseband functions for data and/or voice connectivity between a network and one or more users.
Exemplary embodiments are discussed herein as being implemented in a suitable computing environment. Although not required, exemplary embodiments will be described in the general context of computer-executable instructions, such as program modules or functional processes, being executed by one or more computer processors or CPUs. Generally, program modules or functional processes include routines, programs, objects, components, data structures, etc. that performs particular tasks or implement particular abstract data types.
The program modules and functional processes discussed herein may be implemented using existing hardware in existing communication networks. For example, program modules and functional processes discussed herein may be implemented using existing hardware at existing network elements or control nodes (e.g., the serving general packet radio service (GPRS) support node (SGSN), packet analyzer, gateway GPRS support node (GGSN), radio network controller (RNC), and/or base stations (BS) shown in
In the following description, illustrative embodiments will be described with reference to acts and symbolic representations of operations (e.g., in the form of flowcharts) that are performed by one or more processors, unless indicated otherwise. As such, it will be understood that such acts and operations, which are at times referred to as being computer-executed, include the manipulation by the processor of electrical signals representing data in a structured form. This manipulation transforms the data or maintains it at locations in the memory system of the computer, which reconfigures or otherwise alters the operation of the computer in a manner well understood by those skilled in the art.
Wireless communications network 100 includes serving general packet radio service (GPRS) support node (SGSN) 110; a gateway GPRS support node (GGSN) 106; a packet analyzer 108; a radio network controller (RNC) 120, a plurality of base stations (BSs) 130 and a plurality of user equipments (UEs) 140. Though not pictured, for the purpose of simplicity, wireless communications network 100 may include other elements of a UMTS core network.
The UEs 140 may include, for example, first through fourth UEs 142A-142D. The UEs 140 may be, for example, mobile phones, smart phones, computers, or personal digital assistants (PDAs). The UEs 140 may be in wireless communication with corresponding ones of the BSs 130.
The BSs 130 may include first BS 132A and second BS 132B. The BSs 130 operate according to known methods and provide wireless coverage for UEs in wireless communication with the BSs 130. For example, the first and second UEs 142A and 142B may be in wireless communication with the first BS 132A, and the third and fourth UEs 142C and 142D may be in wireless communication with the second BS 132B. The BSs 130 are connected to the RNC 120.
The RNC 120 operates according to known methods and receives data from and forwards data to the BSs 130. The RNC 120 also controls operations of the BSs 130 and handles radio resource management for the BSs 130. Though, for the purpose of simplicity, the wireless communications network 100 is illustrated as including only the first and second BSs 132A and 132B, the wireless communications network 100 may include any number of BSs. The RNC is connected to the SGSN 110.
The SGSN 110 operates according to known methods and is connected to the GGSN 106. The SGSN 110 handles routing and delivery of data packets between the UEs 140 and the GGSN 106. The GGSN 106 operates according to known methods and handles delivery of packets between the SGSN 110 and packet data networks including, for example, the internet 101.
The internet 101 includes a domain name system (DNS) 105. The DNS 105 includes a plurality of DNS servers, which perform a number of operations including translation of hostnames into IP addresses. The DNS 105 operates according to known standards including, for example, the DNS specifications published by the Internet Engineering Task Force (IETF).
The packet analyzer 108 may be connected to a connection between the GGSN 106 and the SGSN 110. The packet analyzer 108 may access and analyze data, which is sent between the GGSN 106 and the SGSN 110 including, for example, IP data packets. An example structure and operation of the packet analyzer 108 will be discussed in greater detail below with reference to
Explanation of Identifying an Application through IP Packet Analysis
Network elements within a wireless communications network are capable of analyzing an IP address, an IP subnet, a port and/or a protocol associated with an IP packet. Previously, this analysis could be used to determine a type of application associated with an IP flow of which the analyzed packet was part. However, presently, since content distribution networks (CDNs) and cloud computing are rising in popularity, one IP subnet may correspond to many different applications. Further, the IP addresses of computers which serve a particular application may be changed.
Additionally, multiple IP addresses may be used to access one application. Accordingly, it may be difficult to determine an application associated with an IP flow based only on a conventional analysis of an IP address, an IP subnet, a port and/or a protocol associated with an IP packet with the IP flow.
Further, deep packet inspection (DPI) is capable of analyzing IP packets in an IP flow for signature strings and/or behavior signatures in order to determine an application associated with the IP flow. However, DPI is less effective with respect to applications for which the corresponding IP flows have no well known signature strings. Such applications include, for example, applications which use data packets having proprietary protocols. Additionally, the effectiveness of DPI is significantly reduced when the data packets include encrypted data.
Method and Apparatus for Identifying an Application Associated with an IP Flow Using DNS Data
As is described above, there are drawbacks to attempting to identify an application associated with an IP flow based on conventional analysis of IP packet information including address, subnet, port or protocol. Further, as is described above, there are drawbacks to using the conventional method of DPI. Accordingly, it may be useful to implement a method of identifying an application associated with an IP flow which does not rely upon IP addresses, IP subnets, ports and/or protocols being fixed or well known. Further, it may be useful to implement a method of identifying an application associated with an IP flow which does not rely upon access to packet data which may have an unknown protocol or be encrypted. According to at least one example embodiment, such a method may be implemented using DNS data.
For example, the DNS implements the well-known domain name service by which DNS clients send queries to a DNS server and receive, from the DNS servers, DNS responses. A DNS query may include a host name (e.g., the host name “www. example. com” maintained by the Internet Assigned Number Authority (IANA)). Further, the DNS response to the DNS query may include the host name in the DNS query as well as the corresponding IP address (e.g. “192. 0. 43. 10”).
Using the wireless communications network 100 as an example, if an application being run on, for example, the first UE 142A needs to access data associated with a particular host name, and the IP address associated with the particular host name is not included in a cache within the first UE 142A, the first UE 142A may generate a DNS query requesting translation of the host name, and send the DNS query to the DNS 105. Further, once the DNS 105 determines the IP address associated with the requested host name in the DNS query, the DNS 105 will (i) generate a DNS response including the requested host name and the IP address associated with the requested host name, and (ii) send the DNS response to the first UE 142A. The DNS response will pass through many network elements in the wireless communications system 100 including, for example, the GGSN 106, the SGSN 110, the RNC 120 and the BS 132A. Accordingly, the packet analyzer 108, for example, will have access to DNS data within the DNS response including both the requested host name and the IP address associated with the requested host name. Further the DNS data will be both current and presented in a known, standardized format.
According to at least one example embodiment, a method of identifying an application associated with an IP flow using DNS data includes using a network element within a wireless communications network to read DNS data from DNS queries and corresponding DNS responses to determine current mapping relationships between host names and IP address, and building an application mapping table including the determined mapping relationships. Applications associated with IP flows are then determined by, identifying a destination or sender IP address included in the IP packet, comparing the identified IP address to the Application mapping table, and returning the host name associated with the identified IP address based on the comparison. The host name may then be matched to an application known to be associated with the host name.
A method and apparatus for identifying an application associated with an IP flow using DNS data will now be discussed in greater detail below with reference to
Referring to
The transmitting unit 252, receiving unit 254, memory unit 256, and processing unit 258 may send data to and/or receive data from one another using the data bus 259. The transmitting unit 252 is a device that includes hardware and any necessary software for transmitting wired and/or wireless signals including, for example, data signals and control signals, via one or more wired and/or wireless connections to network elements in the wireless communications network 100. For example, data signals transmitted by the transmitting unit 252 may include IP data packets sent to or from the UEs 140.
The receiving unit 254 is a device that includes hardware and any necessary software for receiving wired and/or wireless signals including, for example, data signals and control signals, via one or more wired and/or wireless connections to network elements in the wireless communications network 100. For example, data signals received by the receiving unit 354 may include IP data packets sent to or from the UEs 140.
The memory unit 256 may be any device capable of storing data including magnetic storage, flash storage, etc.
The processing unit 258 may be any device capable of processing data including, for example, a microprocessor configured to carry out specific operations based on input data, or capable of executing instructions included in computer readable code.
For example, the processing unit 258 is capable of analyzing IP data packets to determine information regarding the IP data packets including whether or not the IP data packets are DNS packets, and a destination and/or sender IP address associated with the IP data packet. Further, the processing unit 258 is also capable of analyzing DNS packets including, for example, DNS response packets, to determine information within the DNS response packet including a host name and an IP address corresponding to the host name. Further, the processing unit 258 is capable of forming a table mapping IP addresses to host names based on the information included in the DNS response packets, and using the table to identify host names corresponding to destination and/or sender IP addresses included in IP data packets.
Example methods for operating the network element 251 will now be discussed in greater detail below with reference
According to at least one example embodiment, each of the operations illustrated in, or described with respect to,
Referring to
If, in step S315, the network element 251 determines the IP data packet received in step S310 is not a DNS response packet, the network element 251 returns to step S310 and analyzes a next received IP data packet. For example, the packet analyzer 108 may begin processing of a next received IP data packet.
If the network element 251 determines the IP data packet received in step S310 is a DNS response packet, the network element 251 proceeds to step S320.
In step S320, the network element 251 reads a host name and a corresponding IP address from the DNS response packet.
As is known, DNS response packets are generated, for example by DNS servers, in response to DNS query packets. According to the known format of DNS packets, a DNS query packet may include a question section including a host name for which the entity generating the DNS query desires to know the corresponding IP address. The DNS response packet generated in response to the DNS query packet may include the same question section included in the DNS query packet as well as an answer section. The answer section of the DNS response packet may include the host name included in the question section of the DNS response packet as well as the IP address corresponding to the host name included in the question section of the DNS response packet.
The packet analyzer 108, for example, may access the question and/or answer section of the DNS response packet to determine a host name for which the DNS response packet was generated. Further, the packet analyzer 108 may access the answer portion of the DNS response packet to determine the IP address corresponding to the host name for which the DNS response packet was generated.
In step S325, the network element 251 enters the host name and the corresponding IP address read from the DNS response packet in step S320 into an application mapping table. The packet analyzer 108 may generate and store an application mapping table which maps IP addresses to host names. For example, the packet analyzer 108 may create an entry in the application mapping table that maps the host name read in step S320 to the corresponding IP address read in step S320. The application mapping table may be, for example, a hash table in which that table indices are each IP addresses and the table entries are each IP addresses coupled with corresponding host names. The hash table may be formed using any known hash function.
Further, according to at least one example embodiment, the packet analyzer 108 may determine an application associated with the host name read in step S320. The packet analyzer 108 is capable of determining an application associated with a particular host name according to known methods. For example, the packet analyzer 108 may access information stored in the packet analyzer 108 or another element in the wireless communications network 100 which stores associations between host names and the applications to which the host names belong. Accordingly, in step S325, instead of mapping the read IP address to the read host name, the packet analyzer 108 may map the read IP address to an identifier representing an application associated with the read host name, for example, the name of the application.
Once the network element 251 has entered the IP address read in step S320 and the host name or application corresponding to the read IP address into the application mapping table, the network element 251 may return to step S310. For example, after step S325, the packet analyzer 108 may begin processing of a next IP data packet received at the packet analyzer 108.
A process for using the application mapping table developed in step S325 above to identify applications associated with IP flows will be discussed below with reference to
Referring to
In step S415, the network element 251 may determine a sender IP address and/or a destination IP address of the IP data packet received in step S410. For example, according to known methods, the packet analyzer 108 may analyze fields of the IP packet received in step S410 to determine an IP address corresponding to the intended destination of the IP data packet. The packet analyzer 108 may additionally, or alternatively, determine an IP address corresponding to the entity that originally sent the IP data packet. For example, if the received IP data packet originated from the internet 101, the packet analyzer 108 may determine a sender IP address of the received IP data packet. Further, if the received IP data packet originated from one of the UEs 140, the packet analyzer 108 may determine the destination IP address of the IP data packet.
In step S420, the network element 251 may search for the IP address determined in step S415 in the application mapping table formed in step S310 discussed above with reference to
In step S425, the network element 251 may determine whether or not the determined IP address matches an entry in the application mapping table. For example, as is described above with reference to step S325 in
If, in step S425, the network element 215 determines that no entry corresponding to the IP address determined in step S415 exists in the application mapping table stored in the packet analyzer 108, the network element 215 returns to step S410 to begin analysis of a next IP data packet received at the network element 215.
If, in step S425, the network element 251 identifies an entry corresponding to the IP address determined in step S415 in the application mapping table stored in the network element 251, the network element proceeds to step S430.
In step S430, the network element 251 stores application information in a tracking table for a UE corresponding to the IP data packet received in step S410. For example, the packet analyzer 108 may generate a tracking database which stores tracking information corresponding to UEs within the communications network 100. The tracking database may include, for example, a tracking table corresponding to each UE having an IP flow which passed to the UE or from the UE between the GGSN 106 and the SGSN 110. For each UE, the corresponding tracking table may include application information identified from IP data packets of IP flows of the UE. The application information may be, for example, a host name associated with an IP address read from an IP packet being sent to or from the UE, or an identifier for an application associated with the host name. For example, for a particular host name, the packet analyzer 108 is capable of determining an associated application according to known methods.
For each UE, the tracking table may also include information indicating a timing and/or frequency with which different host names and/or applications are identified as being associated with IP data packets being sent to or from the UE via the connection between the GGSN 106 and the SGSN 110.
After step S430, the network element 251 may return to step S410 to begin analysis of a next IP data packet received at the network element 215.
The network element 251 is capable of executing the methods discussed above in
Thus, according to the method of identifying an application associated with an IP flow using DNS data described above with respect to examples in
Further, the application mapping table may be used by the network element 251 to determine application information associated with any IP packets passing through the network element 251 and having sender or destination IP addresses corresponding to entries within the application mapping table. For each UE, the determined application information which is associated with IP packets sent to or from the UE can placed into a table within a tracking database stored at the network element. The information stored within the tracking database of the network element 251 may be used by a network operator of the wireless communications network 100 to determine specific application information including the types of applications accessed by each UE connected to the wireless communications network 100, as well as the timing and frequency of such accesses. This access information may have a number of uses for the network operator including, for example, marketing research, traffic policing, traffic awareness, policy enforcement, and general network intelligence.
Example embodiments being thus described, it will be obvious that the same may be varied in many ways. Such variations are not to be regarded as a departure from example embodiments, and all such modifications are intended to be included within the scope of example embodiments.
