Classification of a multi-activity dataset in a telecommunications network

Abstract

Classification of a multi-activity dataset in a telecommunications network. The invention relates to a method for classifying a dataset, comprising: - receiving (211) a dataset comprising a network trace identifying packets exchanged on a telecommunications network by at least one user during a given period; - identifying (217) a multi-activity category for the network trace, from among a predefined set of multi-activity categories by applying a prediction model to at least one characteristic of the network trace determined (216) from the packets identified in the network trace. Figure for the abstract: [Fig 2b]

Description

Title of the invention: Classification of a multi-activity dataset in a telecommunications network technical field

[0001] The invention relates to the field of telecommunications.

[0002] The classification of digital activities on a telecommunications network allows for better knowledge and therefore better management of the network by the operator in charge of its management. State of the art

[0003] A user can access a wide area network, in particular of the IP type, via an access point which can be a home gateway, or a mobile phone of the "Mobile Hotspot" type acting as a network gateway.

[0004] The access point can be accessed via a wireless connection, such as Wi-Fi. A local Wi-Fi network can thus be created by the access point, allowing home devices to communicate with each other and also to access the IP wide area network, particularly to access services offered by remote service platforms.

[0005] The digital activities that can be carried out from a user terminal are increasingly numerous, and they relate to increasingly varied applications and can involve different types of actions on the part of the user. Digital activities include, but are not limited to, chat or instant messaging, telephone calls via VoIP (Voice Protocol Over IP), video streaming, and access to applications, including social networking applications such as Facebook™, Instagram™, YouTube™, Twitter™, etc.

[0006] It is useful for a network operator to classify the digital activities implemented by network users and generating data packet flows in the network via access points such as home gateways, in order to facilitate network management, to prioritize certain services, to offer new services or for security purposes.

[0007] To this end, classification methods are known in order to:

[0008] - classify a stream of data packets as belonging to an application among Several predefined applications such as YouTube, Instagram, Facebook, etc. For example, the publication "Real-time encrypted traffic classification via lightweight neural networks," by J. Cheng et al., in Globecom 2020 IEEE Global Communications Conference, pp. 1-6, describes a method enabling such classification. The publication "Mimetic: Mobile encrypted traffic classification using multimodal deep learning", G. Aceto et al, Computer networks, vol. 165, p. 106944, 2019 describes another method enabling such classification;

[0009] - classifying packet streams into actions performed within applications, by Examples include "posting a tweet on Twitter™" and "commenting on a post on Facebook™". The publication "Eavesdropping on fine-grained user activities within smartphone apps over encrypted network traffic" by B. Saltaformaggio et al., published in the USENIX Workshop on Offensive Technologies (WOOT 16), 2016, describes a method for such a classification of actions. The publication "Analyzing Android encrypted network traffic to identify user actions" by M. Conti et al., published in IEEE Transactions on Information Forensics and Security, vol. 11, no. 1, pp. 114-125, 2015, describes another method for such a classification of actions.

[0010] - classify the data type of data packets, for example between data VoIP voice, chat data, and video streaming data are all examples of such data types. The publication "Online classification of user activities using machine learning on network traffic," by V. Labayen et al., *Computer Networks*, vol. 181, p. 107557, 2020, describes a method for such data type classification. The publication "Identification of encrypted traffic through attention mechanism based long short-term memory," by H. Yao et al., *IEEE Transactions on Big Data*, 2019, describes another method for such data type classification.

[0011] However, these methods are dedicated to the identification of a single digital activity, which implies that the packet flows of several digital activities carried out by the user, either in parallel (at the same time) or alternately, cannot be categorized.

[0012] However, such situations are becoming increasingly common, particularly when a user has several terminals on a home network, with the terminals accessing the same access point, which may be a home gateway. Such terminals may include a TV set-top box (STB), a mobile device such as a smartphone or tablet, connected devices such as a smartwatch, etc.

[0013] Thus, there is a need to classify sets of multi-activity data packets in a telecommunications network.

[0014] The invention offers a solution that does not present the disadvantages of the prior art. Description of the invention

[0015] To this end, from a functional perspective, the invention relates to a method for classifying a dataset, comprising a current phase including the following steps: - reception of a dataset including at least one network trace, the network trace identifying packets exchanged on a telecommunications network over a given period; - identification of a multi-activity category s for the network trace, from a predefined set of multi-activities s, by applying the model to at least one characteristic of the network trace determined from the packets identified in the network trace, each multi-activity category identifying an alternating or simultaneous implementation of at least two digital activities.

[0016] Thus, extracting features and submitting them to a model makes it possible to identify a multi-activity category for each network trace. The model can, in particular, be a machine learning model. This makes it possible to process multi-activity network traces, unlike prior art solutions which are only suitable for single-activity network traces.

[0017] According to embodiments, the implementation of at least two digital activities identified by each multi-activity category is alternated or simultaneous.

[0018] According to embodiments, the method may further include a fragmentation of the network trace of the dataset into at least one fragment of predetermined duration T, said at least one feature may be extracted from said at least one fragment from the packets identified in said fragment, and a multi-activity category may be predicted for the network trace by applying the model to said at least one feature extracted from said at least one fragment.

[0019] Such fragmentation allows for the processing of fragments of a given duration. It thus becomes possible to analyze several fragments within the same dataset, in order to detect and isolate periods of multi-activity. The duration T can be predetermined so as to be short enough to allow for the real-time identification of multi-activity categories within the dataset, but long enough to encompass a sufficient amount of information for the model to identify the multi-activity situation.

[0020] In addition, said at least one fragment can be divided into N samples of equal duration T / N, N being an integer greater than or equal to two, at least one feature can be extracted for each sample from the packets identified in said sample, and the multi-activity category can be identified for the network trace by applying the model to the features extracted from the N samples of said at least one fragment.

[0021] Thus, a detailed representation of each segment is possible, in the form of a time series of features. The accuracy associated with the classification is thereby improved.

[0022] In addition or alternatively, the method may include, for each fragment, a check that said at least one fragment is a multi-activity fragment, and said at least one feature may be extracted from said at least one fragment if and only if said at least one fragment is a multi-activity fragment.

[0023] Thus, features are extracted and submitted to the model only for multi-activity fragments, which ensures better management of computing resources and accelerates the classification of the dataset. Indeed, single-activity fragments are thereby filtered out.

[0024] According to embodiments, said at least one feature extracted from packets may comprise one of the following features or a combination of the following features: - mean, variance, skewness coefficient, cluster size sharpness coefficient and sum of cluster sizes; - mean, variance, skewness coefficient, sharpness coefficient of arrival intervals of packets in the training sample; - number of packages.

[0025] Thus, the characteristics are statistics on the size of the packets or on their arrival intervals, which makes it possible to characterize the dataset precisely, and which facilitates its categorization by the model.

[0026] According to embodiments, the method may include a preliminary phase of training the model by supervised learning, from a set of training datasets, each training dataset being associated in a first database with a label identifying a multi-activity category from among the predefined set of multi-activity categories.

[0027] Such supervised learning allows obtaining a robust model in an automated manner.

[0028] In addition, the preliminary training phase may include the following steps: - receipt of a first training dataset including at least one training network trace, said first training dataset being associated with a first multi-activity category from the predefined set of multi-activity categories; - determination of at least one characteristic of the training network trace from packets identified in the training network trace; - training the model by comparing between a prediction of a multi-activity category obtained identified from said at least one characteristic of the training network trace and the first multi-activity category associated with the first training dataset.

[0029] Thus, by repeating such steps for several training datasets associated with different multi-activity categories, it is made possible to obtain a robust prediction model.

[0030] According to some embodiments, the model can be trained from one of the following models: - a random forest model, or "random forest" in English; - an eXtreme Growing Boosting model, or XGBoost; - a one-dimensional convolutional neural network, with an attention mechanism; - a bidirectional long short-term memory cell, BiLSTM, for "Bidirectional Long Short-Term Memory, with an attention mechanism; - a Transformer type encoder.

[0031] Such models are suitable for implementing classification operations, in particular for dealing with time series of features.

[0032] According to a material aspect, the invention also relates to a classification device capable of accessing or storing a prediction model of a multi-activity category from among a predefined set of multi-activity categories, based on at least one feature received as input to the model, each multi-activity category identifying a situation of alternating or simultaneous implementation of at least two digital activities, the classification device further comprising: - a first interface capable of receiving a dataset comprising at least one network trace, the network trace identifying packets exchanged on a telecommunications network by at least one user during a given period; - a processor configured for determine at least one characteristic of the network trace from the packets identified in the network trace; identify a multi-activity category for the network trace by applying the prediction model to said at least one determined characteristic.

[0033] According to another material aspect, the invention relates to a system comprising the defined classification device, and a user terminal capable of implementing at least two digital activities, the data set received by the classification device identifying packets received and / or transmitted by the user terminal.

[0034] According to another material aspect, the invention also relates to a computer program suitable for implementation on a classification device, the program including code instructions which, when the program is executed by a processor, carry out the steps of the defined process.

[0035] Such programs can use any programming language. They can be downloaded from a communication network and / or stored on a computer-readable medium.

[0036] According to another material aspect, the invention relates to a data carrier on which at least one series of program code instructions for the execution of the process defined above have been stored. Brief description of the drawings

[0037] The invention will be better understood upon reading the following description, given by way of example and with reference to the accompanying drawings in which:

[0038] Fig. 1 illustrates a telecommunications system according to embodiments of the invention.

[0039] The [Fig.2a] is a diagram illustrating the steps of a training phase of a classification model of a dataset according to embodiments of the invention.

[0040] Fig. 2b is a diagram illustrating the steps of a method for classifying a dataset according to embodiments of the invention.

[0041] Figure 3 illustrates a data set classification device according to embodiments of the invention. Description of the implementation methods

[0042] Fig. 1 illustrates an example of an implementation environment for the invention according to embodiments.

[0043] An extended 100 telecommunications network, of the IP type, is capable of allowing the exchange of data packets between various network entities which are described below.

[0044] Several access points 130.1 to 130.n are represented, n being an integer greater than or equal to two in the example shown in [Fig.1]. No restriction is attached to the integer n, which can be equal to several hundred, or even several thousand, or even several tens or hundreds of thousands.

[0045] In the environment of [Fig. 1], access points 130.1 to 130.n can be home gateways associated with wireless local access networks, such as Wi-Fi networks, 131.1 to 131.n. Thus, user terminals 140.1, 140.2, and 140.n can access digital activity services in network 100, for example, services provided by platforms 121 and 122. Only one terminal is shown for each access point, but several user terminals can access the network through the same access point. No restrictions are attached to the services. provided by platforms 121 and 122, which may be platforms associated with mobile applications, streaming platforms, or any other service.

[0046] User terminals 140.1, 104.2 and 14O.n of local access networks 131.1 to 131.n can access other types of digital activity services, such as VoIP, chat, mailing, file transfer services, etc.

[0047] A first database 111 comprises a set of training datasets, each training dataset in the set comprising at least one multi-activity network trace for a given user or for several given users. Each training dataset is associated with (labeled or tagged with) a category, or class, of multi-activities from a set of predefined multi-activity categories.

[0048] No restriction is attached to the number of predefined categories, which is any number greater than or equal to 1.

[0049] Furthermore, no restrictions are attached to the multi-activity categories, which can identify situations of dual activity, during which a user performs two digital activities simultaneously or alternately, i.e., one after the other. The set of predefined categories can thus include the following categories, given by way of example: "video + email", "chat + email", "chat + video", "chat + internet browsing", "chat + file transfer", etc.

[0050] Furthermore, at least one of the predefined multi-activity categories may correspond to a situation in which a user performs three or more digital activities simultaneously or alternately. The set of predefined categories may thus also include at least one of the following categories, given by way of example: "video + email + chat", "video + internet browsing + email", etc.

[0051] No restrictions are attached to the manner in which the first database 111 is constructed, in particular to the manner in which the labels identifying the multi-activity category of each dataset were obtained, three distinct examples being detailed below by way of illustration with reference to [Fig. 2a]. Furthermore, no restrictions are attached to the number of training datasets stored in the first database 111. In order to enable machine learning of a classification model according to the invention, detailed below, the set stored in the first database 111 comprises several hundred, or even several thousand, or even several tens or hundreds of thousands of training datasets, each training dataset comprising at least one multi-activity training network trace for a given user or for several given users.

[0052] Finally, no restrictions are attached to the format of the network traces included in each dataset. Network traces generally include one or more The following information is included: the duration of the network trace, the identifier of each exchanged packet, the size of each exchanged data packet, the send / receive date of each exchanged packet, the number of packets in the network trace, a source identifier such as a source port number and source IP address, and a destination identifier such as a destination port number and destination IP address. Thus, a network trace corresponds to all the packets exchanged on the network during the execution of one or more digital activities, over a given time range, to or from a user's access point (130.1 to 130.n). The exchanged packets can be shown sequentially in the network trace. A dataset can include one or more network traces; for example, all network traces for a given day for traffic involving a given user.The user can be identified in particular by a network identifier of their access point 130.1 to 130.n.

[0053] Preferably, the training datasets of the set are varied, that is to say that the training dataset set includes a large number of datasets for each of the predefined multi-activity categories, and that within each category, the datasets differ from each other, by the duration of the training network traces, by the users concerned, by the time slots concerned, etc.

[0054] Furthermore, a second database 112 may include datasets to be identified, each dataset comprising at least one multi-activity network trace for a given user. Unlike the training datasets of the first database 111, the datasets to be identified in the second database 112 are not associated with labels identifying the multi-activity category of each dataset. The datasets in the second database 112 may be processed by a classification device 110 according to the invention in order to assign them a category from among the set of predefined multi-activity categories.

[0055] The first database 111 and the second database 112 are represented as separate and independent in [Fig. 1]. Alternatively, the first database 111 and the second database 112 may be one and the same database.

[0056] The classification device 110 is capable of receiving as input a dataset comprising at least one multi-activity network trace, and of indicating a multi-activity category corresponding to the received dataset. To this end, the classification device 110 can store a model for identifying a multi-activity category derived from machine learning, as will be better understood from the description of Figures 2a and 2b below.

[0057] Fig. 2a is a diagram illustrating the steps in the construction of a model for identifying a multi-activity category among several multi-activity categories, according to embodiments of the invention.

[0058] At a step 200, a set of training datasets is obtained. The set of training datasets can be taken from the first database 111 described previously.

[0059] Three techniques for obtaining such a set of training datasets are described below. These three techniques are given by way of illustration, and no restrictions are attached to the method of obtaining the set of training datasets.

[0060] According to a first technique, the set is obtained by synthesizing training datasets, each multi-activity network trace of a synthesized training dataset being obtained from several single-activity network traces, for example by merging several single-activity network traces. In practice, when merging two or more single-activity traces, their packets are grouped / combined into a single multi-activity trace, for example by taking into account the packet timestamp of the network trace. Databases containing a large quantity of single-activity network traces are known and accessible. This is notably the case for the ISCXVPN2016 database, given as an example.

[0061] For example, by synthesizing a first network trace labeled "chat" with a second network trace labeled "streaming", a multi-activity synthesis network trace can be obtained, which is labeled "chat-streaming", and which can be stored as a training dataset in the first database 111.

[0062] According to a second technique, computer scripts can be transmitted to access points 130.1 to 130.n. Each script, when executed by an access point 130.1 to 130.n, is capable of triggering several digital activities on at least one terminal connected to the access point 130.1 to 130.n. For example, a computer script can trigger a streaming activity and a chat activity, both predefined. A network trace can then be recorded during the execution of the script by a network entity, for example, the network entity responsible for broadcasting the scripts, and the recorded network trace is stored as a training dataset in the first database 111, in association with a label corresponding to the multi-activity category triggered by the script, i.e., "chat-streaming", in the example considered above.Scripts can be transmitted for each predefined multi-activity category, in order to have training datasets available for all predefined categories.

[0063] According to a third technique, instructions are sent to users of network 100, such as users of local access networks 131.1 to 131.n, each instruction specifying at least two digital activities and a given time slot, so that the user performs said at least two digital activities within the given time slot. For example, the instruction may instruct the user to perform a streaming activity and a chat activity during a given time slot. A network trace may then be recorded during the given time slot by a network entity, for example, the network entity responsible for transmitting the instructions, and the recorded network trace is stored as a training dataset in the first database 111, in association with a label corresponding to the multi-activity category triggered by the instruction, i.e., "chat-streaming" in the example considered above.Instructions can be passed for each predefined multi-activity category, in order to have training datasets available for all predefined categories.

[0064] The three techniques mentioned above can be implemented in an alternative or complementary manner.

[0065] At a step 201, a first training dataset is obtained from the first database 111.

[0066] In the described embodiment, at a step 202, the classification device 110 fragments each training network trace of the first training dataset into at least one training fragment of a predetermined duration T. For example, the duration T can be predetermined and can correspond to a duration greater than a minimum duration required to identify a fragment as a multi-activity fragment or not.

[0067] Depending on the duration of each training network trace of the first training dataset, one or more training fragments can be obtained.

[0068] At a step 203, the classification device 110 determines at least one characteristic of a training fragment, for example the first training fragment obtained, referred to as the first training fragment in what follows.

[0069] Preferably, several different characteristics of the first training fragment are determined. The first training fragment of duration T can be decomposed into N training samples of equal duration T / N, and at least one characteristic can be determined for each training sample. For each training sample, at least one characteristic can be derived from statistical indicators of the size of the data packets identified in the training sample or of their arrival interval, or "interarrival time." For example, at least one characteristic of the training sample, or a combination of characteristics, can be determined from among the following characteristics:

[0070] - mean, variance, skewness coefficient, sharpness coefficient (or "kurtosis" in English) of the package sizes identified in the training sample and sum of the package sizes identified in the training sample;

[0071] - mean, variance, skewness coefficient, sharpness coefficient (or "kurtosis") » in English) arrival intervals of identified packets in the training sample;

[0072] - the number of packets identified in the training sample.

[0073] According to an advantageous embodiment, all the aforementioned characteristics are determined for each training sample.

[0074] At a step 204, the classification device 110 trains a machine learning model, submitting as input to the model the feature(s) determined for the first training fragment. The model is trained to predict the multi-activity category of the first training fragment, and the model's output is compared to the label of the first training set to which the first training fragment belongs. Predicting the multi-activity category of the first training fragment may, for example, involve evaluating the respective probabilities for the different multi-activity categories and selecting the multi-activity category with the highest probability.

[0075] The model parameters are then modified based on the result of the comparison between the model output and the label of the first training set. This training principle is called supervised learning, is well known, and is not described in further detail herein.

[0076] No restrictions are attached to the model that is trained in step 204. The model may, in particular, be chosen from one of the following models:

[0077] - a random forest type model, or "random forest" in English;

[0078] - an eXtreme Gradient Boosting, or XGBoost, model;

[0079] - a one-dimensional convolutional neural network, with mechanism attention;

[0080] - a bidirectional, short-term long memory cell, BiLSTM, for " Bidirectional Long Short-Term Memory, with attention mechanism;

[0081] - a Transformer type encoder.

[0082] At step 205, the classification device 110 checks whether there is at least one other training fragment remaining in the first training dataset that was not used to train the model. The other training fragment may be part of the same network trace as the first training fragment described above, or may come from another network trace in the first training dataset. If If the first training set includes at least one other training fragment, steps 202 to 204 are repeated for the other training fragment. If no training fragments remain in the first training dataset, the process proceeds to step 206.

[0083] In step 206, the classification device 110 checks whether there is at least one other training dataset remaining in the first database 111 that has not been used to train the model. If so, that is, if there is at least one other training dataset remaining in the first database 111, the process returns to step 201 to perform steps 202 to 204 on the other training dataset.

[0084] Otherwise, if all the training datasets from the first database 111 have been used to train the model, the process ends at a step 207.

[0085] Alternatively, step 206 may consist of checking a convergence criterion of the model: the model may be considered sufficiently trained, although there remain training datasets in the first database 111 which have not yet been used for training the model, if the classification error rate of the model is below a given threshold.

[0086] The steps in [Fig.2a] have been described as being implemented by the classification device 110. However, the model can be trained by any entity comprising computing capabilities and memory enabling the implementation of the aforementioned steps, and then the model is stored in the classification device 110. In order to train the model, such an entity is able to access the first database 111, via the network 100 or via a direct link.

[0087] The identification phase described below with reference to [Fig. 2b] is implemented by the classification device 110, which can be implemented in any network element capable of accessing network 100. The classification device 110 can thus be implemented in a server, in a network access point, in a router, or even in a user terminal. Alternatively, the classification device 110 is implemented in a hybrid manner between one of the aforementioned network elements and a component of a cloud architecture.

[0088] Fig. 2b is a diagram illustrating the steps of a process for classifying a dataset (or identifying a multi-activity category of a dataset) comprising at least one network trace identifying data packets exchanged over the network.

[0089] In step 210, the model previously trained according to the construction method of [Fig. 2a] is stored by the classification device 110. Such storage may be in an internal memory of the classification device 110, or can be stored remotely, for example on a remote cloud-type server, which the 110 classification device has access to.

[0090] The steps in [Fig.2a] can thus be considered as steps of a phase prior to a current phase described with reference to [Fig.2b].

[0091] In step 211, the classification device 110 receives a first dataset comprising at least one network trace. As previously stated, a network trace comprises all the packets exchanged over a time period for the performance of one or more digital activities. Each exchanged packet can be identified by a packet identifier, a packet size, a packet date, a source port and a destination port, a source IP address and a destination IP address.

[0092] The first dataset received may be from the second database 112 presented previously, or may be captured in real time on the network 100. Alternatively, the dataset may be received from another network entity not shown in [Fig.1].

[0093] At step 212, the classification device 110 fragments each network trace of the first dataset into at least one fragment of duration T. For example, as explained previously, the duration T can be predetermined and can correspond to a duration greater than a minimum duration allowing a fragment to be identified as a multi-activity fragment or not.

[0094] In step 213, a first fragment of duration T thus obtained for a given first trace is evaluated to determine whether the first fragment is a multi-activity fragment or not. For example, such a determination can be based on the detection of two different types of packets in the first fragment. If at least two packets of two different types are detected in the first fragment, then the first fragment is considered multi-activity and the process proceeds to step 216.

[0095] Otherwise, if it is assessed that the first fragment is not multi-activity, the process proceeds to step 214.

[0096] In step 214, it is determined whether at least one other fragment was obtained in step 212 for the first dataset, the other fragment not having yet been evaluated in step 213. The other fragment may be from the same first network trace as the first fragment, or may be from a different network trace of the first dataset. If at least one other fragment was obtained in step 212 and has not been evaluated in step 213, then the process returns to step 213 to evaluate whether the other fragment is a multi-activity fragment or not. Otherwise, if all the fragments obtained from the first dataset have Once evaluated at step 213, the process is completed at step 215, until a new dataset is received at step 211.

[0097] In step 216, the classification device 110 determines at least one characteristic of the first fragment. Preferably, several different characteristics of the first fragment are determined. The determination of the characteristic, or characteristics, of the first fragment is identical to the determination of the characteristics of the training fragments described with reference to step 203.

[0098] At step 217, the feature, or features thus determined for the first fragment, are submitted to the machine learning model for prediction of a multi-activity category. The predicted category is associated with the first network trace comprising the first fragment.

[0099] The process then proceeds to step 214, in order to check whether the dataset includes other fragments that have not been subjected to steps 213, 216, and 217 described previously. The other fragment may be a fragment of the first network trace or a fragment of a subsequent network trace, in which case steps 213, 216, and 217 are repeated to predict a multi-activity category for the subsequent network trace.

[0100] When all the fragments of the first dataset have been processed, the process ends at step 215, each network trace of the first dataset having been associated with a multi-activity category.

[0101] Figure [Fig. 3] shows the structure of a classification device 110 according to embodiments of the invention.

[0102] The classification device 110 comprises a processor 301 configured to communicate unidirectionally or bidirectionally, via one or more buses or via a direct wired connection, with a memory 302 such as a Random Access Memory (RAM), a Read Only Memory (ROM), or any other type of memory (Flash, EEPROM, etc.). Alternatively, the memory 302 comprises several memories of the aforementioned types.

[0103] The memory 302 comprises at least one non-volatile memory in which the data used and / or resulting from the implementation of the steps of the classification process according to the invention described with reference to [Fig.2b] are stored, temporarily or permanently.

[0104] In particular, memory 302 can store the model during step 210 described above. Memory 302 can also store methods for determining one or more features of fragments of datasets, as described above, for example in the form of software instructions.

[0105] The processor 301 is capable of executing instructions, stored in memory 302, for the implementation of steps 211 to 217 of the classification process according to the invention, described with reference to [Fig.2b]. Optionally and complementaryly, the processor 301 is capable of executing instructions, stored in memory 302, for the implementation of steps 200 to 207 of the method of training the model according to the invention, described with reference to [Fig.2a].

[0106] The classification device 110 includes a first interface 303 capable of receiving datasets during step 211 described above. The first interface 303 can also be capable of receiving training datasets during step 201 of the model training process.

[0107] The classification device 110 further includes a second interface 304 capable of transmitting the predicted category or categories for each dataset received on the first interface 303.

Claims

Demands

1. A method for classifying a dataset, comprising the following steps: - receiving (211) a dataset comprising at least one network trace, the network trace identifying packets exchanged over a telecommunications network during a given duration; - fragmenting (212) the network trace of the dataset into at least one fragment of predetermined duration T; - verifying (213) that said at least one fragment is a multi-activity fragment; - extracting (216) at least one feature of said at least one fragment from the packets identified in said fragment if and only if said at least one fragment is a multi-activity fragment;- identification (217) of a multi-activity category for the network trace, from among a predefined set of multi-activities, by applying a prediction model to said at least one extracted feature, each multi-activity category identifying an implementation of at least two digital activities.;

2. A method according to claim 1, wherein said at least one fragment is divided into N samples of equal duration T / N, N being an integer greater than or equal to two, wherein at least one feature is extracted for each sample from the packets identified in said sample, and wherein the multi-activity category is identified for the network trace by applying the model to the features extracted from the N samples of said at least one fragment.

3. A method according to any one of the preceding claims, wherein said at least one feature extracted (216) from identified packets comprises one or a combination of the following features: - mean, variance, skewness coefficient, acuity coefficient of packet sizes and sum of packet sizes; - mean, variance, skewness coefficient, acuity coefficient of arrival intervals of packets from the training sample; - number of packets.

4. A method according to any one of the preceding claims, comprising a preliminary phase (200-207) of training the model by supervised learning, from a set of training datasets, each training dataset being associated in a first database (111) with a label identifying a multi-activity category from the predefined set of multi-activity categories.

5. A method according to claim 4, wherein the preliminary training phase comprises the following steps: - obtaining (201) a first training dataset comprising at least one training network trace, said first training dataset being associated with a first multi-activity category from the predefined set of multi-activity categories; - determining (203) at least one feature of the training network trace from packets identified in the training network trace; - training (204) the model by comparison between a prediction of a obtained multi-activity category identified from said at least one feature of the training network trace and the first multi-activity category associated with the first training dataset.

6. A method according to any one of the preceding claims, wherein the trained model is one of the following models: - a random forest model; - an eXtreme Gradient Boosting (XGBoost) model; - a one-dimensional convolutional neural network with an attention mechanism; - a bidirectional long short-term memory (BiLSTM) cell with an attention mechanism; - a Transformer encoder.

7. Classification device (110) capable of accessing or storing a prediction model of a multi-activity category from among a predefined set of multi-activity categories, based on at least one feature received as input to the model, each multi-activity category identifying an alternative implementation or simultaneous of at least two digital activities, the classification device further comprising: - a first interface (303) capable of receiving a dataset comprising at least one network trace, the network trace identifying packets exchanged on a telecommunications network by at least one user during a given duration; - a processor (301) configured to fragment the network trace of the dataset into at least one fragment of predetermined duration T; verify that said at least one fragment is a multi-activity fragment; extract at least one feature of said at least one fragment from the packets identified in said fragment if and only if said at least one fragment is a multi-activity fragment; identify a multi-activity category for the network trace by applying the prediction model to said at least one extracted feature.

8. System comprising a classification device according to claim 7 and a user terminal capable of implementing at least two digital activities, the dataset received by the classification device identifying packets received and / or transmitted by the user terminal.

9. A computer program capable of being implemented in a classification device as defined in claim 7, the program comprising code instructions which, when executed by a processor (301), carries out the steps of the process defined in any one of claims 1 to 6.

10. Computer-readable recording medium on which is recorded at least one series of program code instructions for carrying out the method according to any one of claims 1 to 6.