FI130535B

FI130535B - Method for observing traffic over a network interface

Info

Publication number: FI130535B
Application number: FI20197058A
Authority: FI
Inventors: Jukka Manner; Sebastian Sonntag; Sami Saarinen
Original assignee: Celltrum Oy
Priority date: 2019-04-03
Filing date: 2019-04-03
Publication date: 2023-11-06
Also published as: FI20197058A1; WO2020201615A1

Abstract

The current invention is generally related to measurement of traffic in digital networks, and more specifically to measurement of traffic over network interfaces between a computing device and a data communication network. The invention provides a method for collecting information about data traffic over a network interface on a per application basis. The inventive method performs traffic measurements in consecutive time periods and calculates total amount of data transferred during a time period based on traffic counters of the network interface. Further, the method combines this traffic information with information of active network sockets, and further with process information of processes associated with these active network sockets, in order to provide information of data transfer over the network interface on a per-process basis.

Description

Method for observing traffic over a network interface

BACKGROUND OF THE INVENTION

1. Field of the Invention

The current invention is generally related to measurement of traffic in digital networks, and more specifically to measurement of traffic over network interfaces between a computing device and a data communication network. 2. Description of Related Art

Network operators typically study how their customers use their network by observing traffic flows created by the customers. Network operators perform these observations in order to be able to better understand how their customers use their networks, what the applications used by the customers require from the networks, and how to further develop their networks to better serve the customers.

However, there exist certain trends that limit the amount of useful information that a network operator can obtain from observing traffic through their network. One trend is increasing encryption of traffic, which removes the possibility to do content analysis to gain information about use of different services. Another trend is consolidation of services into a few major cloud service providers, from which o 25 follows that a multitude of digital services is typically provided by a single cloud

N service, in which case looking at IP addresses of traffic going to or from the cloud 3 service does not reveal information about which actual digital service a piece of

S traffic is associated with. j < 30 It would be very beneficial for wireless network operators to gain a better

S understanding of what applications their customers are using in their mobile devices < and what data transfer speeds and volumes these applications require, in order to develop the networks to better service the customers. Currently it is possible to get e.g. lists of installed popular mobile apps, but this information does not reveal what apps are actually used by the customers and when and where, and what load they put on the network. Such information is not readily available from current operating systems in use in mobile devices at the time of writing this specification.

SUMMARY OF THE INVENTION

The invention solves the problems of the prior art by providing a method that allows monitoring of traffic flows over a network interface of a computing device on a per- application or per-process basis. The method allows collection of information about which application or process receives or transmits data over the network connection, at which time, and how much. This allows analysis of which applications are used, how much and when, as well as how much data transfer is generated by each application. Further, the method allows collection of this information without needing to examine content of the traffic. When this information is collected in aggregate for statistical analysis by an operator of a data communication network, this information can be used to e.g. optimise the network to accommodate peak uses of network traffic. Further, the invention allows collection of this detailed traffic information without requiring changes in any of the operating systems in common use in small computing devices at the time of writing of this specification, such as iOS and

Android.

In the inventive method, how much traffic over a network interface is generated by which processes or applications is determined by observing traffic over consecutive o 25 periods of time, and by combining information about total traffic in a period of time

N with information about which network sockets are active in that period of time and 3 which processes these network sockets are associated with, and with information

S about names of the processes these active network sockets are associated with. j < 30 The inventors have found that during typical use of a mobile use, when the observed

S time periods are relatively short, for example up to 5 or 10 seconds long, there is < often only one network socket in an active state i.e. in a state associated with transmission or reception of data. In such a case, the total traffic in that period of time can be determined to be caused by the process associated with that single active socket. This insight allows collection of information of network traffic load per application with sufficient accuracy in a mobile device.

If more than one socket is in an active state, amounts of traffic generated with each process having an active socket can be estimated by calculating a sum of transmission and/or reception queue lengths of active sockets associated with the process, and comparing that sum to the corresponding sum over all active sockets.

At the time of writing of this specification, a category of computing devices that are used by a very large number of users are mobile computing devices such as smart phones, tablets, and palmtop computers. While the invention is well suited for monitoring the network traffic of such wireless devices, the invention is not limited to use only in wireless mobile devices. The invention can also be used in devices with a wired network connection.

The above summary relates to only some of the many embodiments of the invention disclosed herein and is not intended to limit the scope of the invention, which is set forth in the claims herein. These and other features of the present invention will be described in more detail below in the detailed description of the invention and in conjunction with the following figures.

BRIEF DESCRIPTION OF THE DRAWINGS o 25 Various embodiments of the invention will be described in detail below, by way of

N example only, with reference to the accompanying drawings, of which 3

S Figure 1 illustrates a method according to an embodiment of the invention, and j < 30 Figure 2 illustrates a method according to a further embodiment of the invention.

O

N

DETAILED DESCRIPTION OF SOME EMBODIMENTS

The following embodiments are exemplary. Although the specification may refer to "an", "one", or "some" embodiment(s), this does not necessarily mean that each such reference is to the same embodiment(s), or that the feature only applies to a single embodiment. Features of different embodiments may be combined to provide further embodiments.

In the following, features of the invention will be described with a simple example of a method. Only elements relevant for illustrating the embodiments are described in detail. Details that are generally known to a person skilled in the art may not be specifically described herein.

Figure 1 illustrates a method according to an embodiment of the invention. Figure 1 illustrates a method, in which traffic over a wireless network interface of a mobile device such as a smartphone, a tablet, or a palmtop computer is monitored over consecutive periods of time we call measurement periods, and illustrates method steps happening during and after a measurement period.

In step 110, it is determined whether a predefined start condition has been fulfilled. If a start condition has not been fulfilled, it is waited in step 115 for a predetermined time, before returning to step 110.

In an embodiment of the invention, a starting condition is initiation of new traffic over o 25 the wireless interface, i.e. the condition triggers on new data packets being

N transmitted or received over the wireless interface. 3

S If a start condition has been fulfilled, the next step is step 120 in which values of

E traffic counters associated with the wireless network interface are retrieved from the < 30 operating system of the mobile device. These values represent the traffic counter

S values at the beginning of the measurement period.

N

In step 130 information about network sockets associated with the wireless network interface are retrieved from the operating system of the mobile device. This information preferably comprises at least state of each socket and process ID of the process associated with each socket.

In step 140, it is determined whether a predefined end condition has been fulfilled. If 5 an end condition has not been fulfilled, it is waited in step 145 for a predetermined time, before returning to step 140.

In an embodiment of the invention, an end condition is cessation of traffic over the wireless interface. The cessation of traffic can be determined for example exceeding of a predetermined time after transmission and/or reception of the previous data packet.

In a further embodiment of the invention, an end condition is exceeding a predetermined time since fulfillment of the starting condition.

If an end condition has been fulfilled, the next step is step 150 in which values of traffic counters associated with the wireless network interface are retrieved from the operating system of the mobile device, and the total amount of traffic over the network interface is determined from values retrieved in step 150 and values retrieved in step 120.

In step 160, names of the processes associated with active sockets are retrieved from the operating system on the basis of the process identifiers of the processes. o 25 In step 170, it is determined from retrieved network socket information, how many

N network sockets had active status i.e. were transmitting or receiving data packets 3 during the measurement period. 3

E If only one socket had an active status, it is determined that all traffic during the < 30 measurement period was generated by the process associated with the socket. In

S step 180, this result is stored in a memory means, such as a file or a database in the < mobile device. The stored information preferably comprises at least the name of the start and end times of the measurement period, name of the process, and amount of transmitted and received traffic.

In step 190 one or more measurement results are retrieved from the memory means and transmitted to a server entity in the data communications network for central processing and storage.

In a further embodiment of the invention, the stored information further comprises information identifying the wireless network the wireless network interface is connected to, and/or a part of the wireless network, such as the identifier of the base station of the wireless network.

In a further embodiment of the invention, if the mobile device has positioning functionality such as GPS or GLONASS functionality and current location information is available, current location information is stored with the measurement results of a measurement period. In a further embodiment, access point and/or base — station information is stored with the measurement results of a measurement period.

In a further embodiment of the invention, the name of the application to which the process belongs to is stored in step 180 instead of the name of the process.

Figure 2 illustrates a further embodiment of the invention. Figure 2 illustrates a variation of the embodiment illustrated in figure 1. In this embodiment, steps 110 to 170 are the same as in figure 1. For clarity, steps 110 to 160 are not illustrated in figure 2. o 25 In step 170, it is determined from retrieved network socket information, how many

E If a plurality of sockets had an active status, the share of traffic over the network < 30 interface for each process associated with an active socket is estimated on the basis

S of transmission and reception gueues of each active network socket associated with < the process.

In step 210, for each process associated with an active socket, the total length of transmission queues and reception queues of all active sockets associated with the process are calculated. These totals are compared to corresponding totals over all active sockets to give an estimate of the share of traffic generated by each of these processes of the total traffic during the measurement period.

In step 220, the estimated amounts of traffic of each process with an active socket are stored in a memory means in the mobile device, along with the name of the process or the application the process is part of as well as start and end times of the — measurement period.

In step 230 one or more measurement results are retrieved from the memory means and transmitted to a server entity in the data communications network for central processing and storage.

In a further embodiment of the invention, calculation of total lengths of transmission and reception queues of processes having active sockets is performed irrespective of the number of processes having active sockets.

In a further embodiment of the invention, when a plurality of processes have generated traffic during a measurement period but one of the processes is estimated to have generated a large majority of traffic, all traffic during that measurement period is assigned to that process in the measurement results. This large majority can be for example 70%, 80%, 90%, or more of the total traffic. Such o 25 an approach may not be completely accurate, but is accurate enough for most kinds

N of analysis by network operators. For example, if one process was receiving a video 3 data stream while another merely sent a small number of data packets e.g. for

S checking email, the small amount of traffic for email is for many practical purposes

E insignificant in comparison with the traffic of the video stream and can be < 30 disregarded. x < Although the examples of figures 1 and 2 describe use of the inventive method in wireless mobile computing devices, the method is applicable also in computing devices with wired connections.

The invention has several benefits. For example, the inventive method can provide information about volume of traffic generated at which times by which applications in a computing device. The inventive method is able to produce this information without requiring any changes to the operating system of the computing device, whereby the inventive method can be taken into use by installing an application performing the method. The inventive method does not require the ability to perform any kind of content analysis as the method does not require inspection of contents of the data traffic. Use of encryption or virtual private network connections does not hinder the use of the inventive method.

The inventive method provides information about actual usage of applications that use the network, as well as about the volume of their use of the network. While this information is very useful for network operators as described elsewhere in this — specification, the invention is not limited to use by operators, as such information is beneficial for many other parties as well. For example, application developers, investors, as well as advertisers would be very interested in reliable information about usage of applications. For example, investors would be interested to know how much games from a company are played compared to games from other companies. Despite this clear need, the inventors are not aware of other solutions that would bring the results and the benefits of the inventive method. Further, this method can be implemented using features that exist in most common operating systems such as iOS and Android, without any need to change the operating systems themselves. This allows easy provisioning of the inventive functionality as a o 25 — standalone application installable by the user of the mobile device. x 3 3

E CERTAIN FURTHER EMBODIMENTS OF THE INVENTION

8 30

NS In the following, we describe a number of embodiments of the invention.

N

According to a first aspect of the invention, a method in a computing device is provided for collecting information about amount of data transferred over a network interface. According to a first embodiment of this first aspect of the invention, in said method, information about amount of data transferred over a network interface of said operating system software is collected over consecutive periods of time, and during each of a plurality of consecutive periods of time at least the following steps are executed: determining from network traffic counters associated with said network interface the total amount of traffic transferred via said network interface during said period of time, requesting network socket information from a service of said operating system software, determining from said requested network socket information which network sockets are active and the process identifiers of processes associated with said active network sockets, determining the number of active sockets from said requested network socket information, and if only one socket is active, said total amount of traffic transferred during said period of time is determined to be generated by the process associated with said only one socket; o 25 and the method further comprises the steps of g 3 obtaining, from a service of said operating system, names of the processes

S corresponding to process identifiers of at least said processes associated with said

E active network sockets, < 30

S transmitting, to a network server, a report of data transfer during at least one period < of time, said report indicating at least amount of data transfer determined to be generated by a process and the name of said process or a software application associated with said process.

According to a second embodiment of this first aspect of the invention, the method further comprises at least the following steps: if in said step of determining the number of active sockets it is found that more than one socket is active, the amount of data transfer associated with each process with at least one active socket is determined at least in part by determining the lengths of data queues of each active socket, determining a relative amount of data transfer associated with a process by comparing the total length of data queues of each active socket associated with said process to the total length of data queues of all active sockets, and determining the amount of data transfer generated by said process during said period of time by calculating a corresponding relative amount of data transfer from said total amount of traffic transferred via said network interface during said period of time.

According to a third embodiment of this first aspect of the invention, a period of time — over which information about amount of data transferred is collected is defined by a starting condition and an ending condition, and a first starting condition is a start of data transfer over said network interface.

According to a fourth embodiment of this first aspect of the invention, a first ending o 25 condition is an end of data transfer over said network interface. g 3 According to a fifth embodiment of this first aspect of the invention, a second ending

S condition is the length of said time period exceeding a predefined limit. j < 30 According to a sixth embodiment of this first aspect of the invention, said report

S further comprises information identifying the network said network interface is < connected to.

The inventive method can in an embodiment of the invention be provided as software arranged to perform the inventive method. According to a second aspect of the invention, a non-transitory computer-readable medium is provided. This medium has stored thereon computer readable instructions for carrying out a method forcollecting information about amount of data transferred over a network interface of a computing device.

According to a first embodiment of this second aspect of the invention said computer readable instructions comprise instructions which when executed by a processor of a computing device cause said processor to collect information about amount of data transferred over the network interface over consecutive periods of time, and said computer readable instructions comprise instructions which when executed by said processor cause said processor to perform at least the following steps during each of a plurality of consecutive periods of time: determining from network traffic counters associated with said network interface the total amount of traffic transferred via said network interface during said period of time, reguesting network socket information from a service of said operating system software, determining from said reguested network socket information which network sockets o 25 are active and the process identifiers of processes associated with said active

N network sockets, 3

S determining the number of active sockets from said reguested network socket

E information, < 30

S and if only one socket is active, said total amount of traffic transferred during said < period of time is determined to be generated by the process associated with said only one socket;

said computer readable instructions comprise instructions which when executed by said processor cause said processor to perform at least the further steps of obtaining, from a service of operating system software executed by said processor, names of the processes corresponding to process identifiers of at least said processes associated with said active network sockets, transmitting, to a network server, a report of data transfer during at least one period of time, said report indicating at least amount of data transfer determined to be generated by a process and the name of said process or a software application associated with said process.

The non-transitory machine-readable medium can be for example a memory means such as a CD-ROM, a storage device such as a flash memory device or a hard disk.

The processor can be for example a processor of a mobile device, such as a mobile communications device.

According to a second embodiment of this second aspect of the invention if in said step of determining the number of active sockets it is found that more than one socket is active, the amount of data transfer associated with each process with at least one active socket is determined at least in part by determining the lengths of data gueues of each active socket, o 25 determining a relative amount of data transfer associated with a process by

N comparing the total length of data gueues of each active socket associated with said

S process to the total length of data gueues of all active sockets, and 3

E determining the amount of data transfer generated by said process during said < 30 period of time by calculating a corresponding relative amount of data transfer from

S said total amount of traffic transferred via said network interface during said period > of time.

According to a third embodiment of this second aspect of the invention a period of time over which information about amount of data transferred is collected is defined by a starting condition and an ending condition, and in that, that a first starting condition is a start of data transfer over said network interface.

According to a fourth embodiment of this second aspect of the invention a first ending condition is an end of data transfer over said network interface.

According to a fifth embodiment of this second aspect of the invention a second ending condition is the length of said time period exceeding a predefined limit.

According to a sixth embodiment of this second aspect of the invention said report further comprises information identifying the network said network interface is connected to.

CERTAIN FURTHER CONSIDERATIONS

In view of the foregoing description it will be evident to a person skilled in the art that various modifications may be made within the scope of the invention. While a preferred embodiment of the invention has been described in detail, it should be apparent that many modifications and variations thereto are possible, all of which fall within the true spirit and scope of the invention. o 25 ltis to be understood that the embodiments of the invention disclosed are not limited

N to the particular structures, process steps, or materials disclosed herein, but are 3 extended to equivalents thereof as would be recognized by those ordinarily skilled in

S the relevant arts. It should also be understood that terminology employed herein is

E used for the purpose of describing particular embodiments only and is not intended < 30 to be limiting. x < Reference throughout this specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases “in one embodiment” or “in an embodiment’ in various places throughout this specification are not necessarily all referring to the same embodiment.

As used herein, a plurality of items, structural elements, compositional elements, and/or materials may be presented in a common list for convenience. However, these lists should be construed as though each member of the list is individually identified as a separate and unique member. Thus, no individual member of such list should be construed as a de facto equivalent of any other member of the same list solely based on their presentation in a common group without indications to the contrary. In addition, various embodiments and example of the present invention may be referred to herein along with alternatives for the various components thereof. It is understood that such embodiments, examples, and alternatives are not to be construed as de facto equivalents of one another, but are to be considered as separate and autonomous representations of the present invention.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the previous description, numerous specific details are provided, such as examples of lengths, widths, shapes, etc, to provide a thorough understanding of embodiments of the invention. One skilled in the relevant art will recognize, however, that the invention can be practiced without one or more of the specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the o 25 invention. & 3 while the forgoing examples are illustrative of the principles of the present invention

S in one or more particular applications, it will be apparent to those of ordinary skill in

E the art that numerous modifications in form, usage and details of implementation < 30 can be made without the exercise of inventive faculty, and without departing from

S the principles and concepts of the invention. Accordingly, it is not intended that the < invention be limited, except as by the claims set forth below.

Claims

1. Method in a computing device for collecting information about amount of data transferred over a network interface, a processor of the computing device executing operating system software, characterized in that in said method, information about amount of data transferred over a network interface of said operating system software is collected over consecutive periods of time, and in that, that during each of a plurality of consecutive periods of time at least the following steps are executed: determining from network traffic counters associated with said network interface the total amount of traffic transferred via said network interface during said period of time, requesting (130) network socket information from a service of said operating system software, determining from said requested network socket information which network sockets are active and the process identifiers of processes associated with said active network sockets, determining (170) the number of active sockets from said requested network socket information, N and if only one socket is active, said total amount of traffic transferred during said 3 period of time is determined to be generated by the process associated with said S only one socket; x a 3 30 and in that, that the method further comprises the steps of = o 2 obtaining (160), from a service of said operating system, names of the processes corresponding to process identifiers of at least said processes associated with said active network sockets,

transmitting (190), to a network server, a report of data transfer during at least one period of time, said report indicating at least amount of data transfer determined to be generated by a process and the name of said process or a software application associated with said process.

2. A method according to claim 1, characterized in that the method further comprises at least the steps of if in said step of determining the number of active sockets it is found that more than one socket is active, the amount of data transfer associated with each process with at least one active socket is determined at least in part by determining the lengths of data queues of each active socket, determining a relative amount of data transfer associated with a process by comparing the total length of data queues of each active socket associated with said process to the total length of data queues of all active sockets, and determining the amount of data transfer generated by said process during said period of time by calculating a corresponding relative amount of data transfer from said total amount of traffic transferred via said network interface during said period of time. e 25 S

3 3. A method according to claim 1, characterized in that a period of time over which S information about amount of data transferred is collected is defined by a starting z condition and an ending condition, 2 30 5 and in that, that a first starting condition is a start of data transfer over said network S interface.

4. A method according to claim 3, characterized in that a first ending condition is an end of data transfer over said network interface.

5. A method according to claim 3, characterized in that a second ending condition is the length of said time period exceeding a predefined limit.

6. A method according to claim 1, characterized in that said report further comprises information identifying the network said network interface is connected to.

7. A non-transitory computer-readable medium having stored thereon computer readable instructions for carrying out a method for collecting information about amount of data transferred over a network interface of a computing device, characterized in that said computer readable instructions when executed by a processor of the computing device cause said processor to collect information about amount of data transferred over the network interface over consecutive periods of time, and said computer readable instructions comprise instructions which when executed by said processor cause said processor to perform at least the following steps during each of a plurality of consecutive periods of time: N 25 determining from network traffic counters associated with said network interface the N total amount of traffic transferred via said network interface during said period of 3 time, S z requesting (130) network socket information from a service of said operating system 9 30 software, = 2 determining from said requested network socket information which network sockets are active and the process identifiers of processes associated with said active network sockets,

determining (170) the number of active sockets from said requested network socket information, and if only one socket is active, said total amount of traffic transferred during said period of time is determined to be generated by the process associated with said only one socket; said computer readable instructions comprise instructions which when executed by — said processor cause said processor to perform at least the further steps of obtaining (160), from a service of operating system software executed by said processor, names of the processes corresponding to process identifiers of at least said processes associated with said active network sockets, transmitting (190), to a network server, a report of data transfer during at least one period of time, said report indicating at least amount of data transfer determined to be generated by a process and the name of said process or a software application associated with said process.

8. The non-transitory computer-readable medium according to claim 7, characterized in that if in said step of determining the number of active sockets it is found that more than one socket is active, the amount of data transfer associated N 25 — with each process with at least one active socket is determined at least in part by O N 3 determining the lengths of data queues of each active socket, S z determining a relative amount of data transfer associated with a process by 3 30 comparing the total length of data queues of each active socket associated with said o process to the total length of data gueues of all active sockets, and R determining the amount of data transfer generated by said process during said period of time by calculating a corresponding relative amount of data transfer from said total amount of traffic transferred via said network interface during said period of time.

9. The non-transitory computer-readable medium according to claim 7, characterized in that a period of time over which information about amount of data transferred is collected is defined by a starting condition and an ending condition, and in that, that a first starting condition is a start of data transfer over said network interface.

10. The non-transitory computer-readable medium according to claim 9, characterized in that a first ending condition is an end of data transfer over said network interface.

11. The non-transitory computer-readable medium according to claim 9, characterized in that a second ending condition is the length of said time period exceeding a predefined limit.

12. The non-transitory computer-readable medium according to claim 7, characterized in that said report further comprises information identifying the network said network interface is connected to. N 25 QA O N o <Q QA O I Ao o i LO O N o O N