System and method for detecting and categorizing sensitive traffic in a home gateway

Abstract

A method for classifying, by a residential gateway, a bidirectional network flow transiting through said gateway between a first and a second piece of equipment, the method comprising steps of collecting (200) network traffic data relating to said flow, comprising at least a number of bytes and a number of data packets transmitted and received by the first piece of equipment, of determining (201) an average packet size to the first piece of equipment, and a ratio between the amount of data to the first piece of equipment and the amount of data from the first piece of equipment, of comparing (202) the average size determined at a first particular threshold and the ratio determined at a second particular threshold, of categorizing (203) the traffic as sensitive or non-sensitive based on the results of the comparison, and of applying (204) at least one particular configuration associated with said flow when the traffic is determined to be sensitive.Abbreviated figure: figure 2.

Description

Title of the invention: System and method for detecting and categorizing sensitive traffic in a home gateway technical field

[0001] The invention belongs to the field of communication networks and relates more particularly to the management of data traffic in home gateways. Prior art

[0002] A home or residential gateway is a device that connects a local area network (LAN) to a wide area network (WAN). In other words, a home gateway allows devices on a local area network (such as computers, smartphones, tablets, or connected devices) to connect to the Internet. Such equipment may include router functions, for example, a Wi-Fi® router, allowing the various devices on the local area network to exchange data with each other and / or with remote devices or online services via the Internet.

[0003] Thus, a variety of flows pass through the home gateway, in the upstream and / or downstream direction, such as video flows, voice communications, data traffic, etc. These different types of flows do not exhibit the same sensitivity to disturbances that may affect them, such as packet loss, latency or jitter: for example, data transmissions that rely on a protocol such as TCP (for Transmission Control Protocol) benefit from error and flow control mechanisms, which makes them less sensitive to transmission errors than UDP (for User Datagram Protocol) protocols which do not benefit from such control.

[0004] Traffic generated by online video games or conversational applications, such as data transmitted during voice or video communication, is particularly sensitive to transmission hazards. Indeed, the interactivity required by conversational communications does not allow for retransmission or buffering, so excessive latency or packet loss has an immediate impact on voice interactions, causing interruptions, stuttering, or delays that can impair the interactivity of conversations.

[0005] Traffic prioritization or differentiation techniques have been proposed and deployed in communication networks and allow for the efficient management of data flows. Different priorities can thus be assigned according to the type of traffic to guarantee quality of service (or QoS). For example, voice data for VoIP (Voice over Internet Protocol) can higher priority is required to ensure clear and uninterrupted calls. For this reason, data packets are, for example, marked by the sender or intermediate equipment so that they receive differentiated processing during transmission.

[0006] However, the sender cannot always be relied upon to correctly mark the packets it generates, which is why marking is generally performed by intermediate equipment. Such marking of flows by intermediate equipment, such as a router, requires in-depth analysis of the data packets to identify the type of data they carry. For example, it is possible to identify a particular flow from the source and destination ports of an IP (Internet Protocol) packet, or based on features of certain protocols, such as the use of a specific sequence of characters in data packets, called a "protocol signature" or "magic number." These analysis techniques are effective but require significant computing power when inspecting a large number of packets.

[0007] The residential gateway, which centralizes all the traffic of a home network, is strategic for the application of this service differentiation. However, the limited capabilities of this equipment in terms of computing power and memory do not allow for the efficient identification of the type of traffic passing through it.

[0008] As a result, users may experience disruptions during voice or video calls, or during online gaming sessions, due to poor traffic prioritization.

[0009] There is therefore a need for a technique that allows for the efficient identification, with low computational cost, of the flows that pass through a residential gateway, in order to assign to each of them a priority that is adapted to their sensitivity to transmission hazards. Summary of the invention

[0010] To this end, a method is proposed for classifying, by means of a residential gateway, a bidirectional network flow transiting through said gateway between a first and a second piece of equipment, the method comprising the following steps: - Collect network traffic measurements relating to said flow, including at least a number of bytes and a number of data packets transmitted and received by the first device, - Determine, from the collected measurements, an average packet size destined for the first device, and a ratio between the amount of data destined for the first device and the amount of data originating from the first device. - Compare the average size determined at a first specific threshold and the ratio determined at a second specific threshold, - Categorize traffic as sensitive or non-sensitive based on the comparison results, and - Apply at least one specific configuration associated with said flow when the traffic is determined to be sensitive.

[0011] The method thus makes it possible to apply differentiated processing to certain flows transiting through the residential gateway based on easily obtainable indicators, such as the size and direction of data packets. Studying the average sizes and the ratio of traffic transmitted to received by the gateway makes it possible to estimate the probability that the traffic is associated with a particular type of application based on traffic characteristics determined beforehand for a plurality of application types. In other words, the method allows the detection of a certain type of traffic exhibiting a particular sensitivity to disturbances and the adjustment of a configuration parameter accordingly.

[0012] This detection can be performed without analyzing the content of the packets, allowing the method to be implemented on equipment with limited computing power. More specifically, the data used to calculate the proposed indicators (such as packet counters and packet size) are exposed by most network interfaces, making it possible to categorize the flows as they are received and retransmitted by the gateway, without requiring the data packets to be sent to the gateway's operating system.

[0013] In a particular embodiment, traffic is considered non-sensitive when the total amount of data exchanged over a particular time window is less than a particular third threshold.

[0014] In this way, no processing is applied when the traffic is not significant, even if the average sizes and ratios correspond to the thresholds. For example, if the sum of the data transmitted and received by a device is less than 4 Kbits / second, no prioritization is applied. This method thus avoids prioritizing traffic generated by a device in standby mode, for example.

[0015] In a particular embodiment, the first, second and third thresholds are determined by a machine learning algorithm from pre-labeled data streams.

[0016] It is therefore proposed to use a machine learning algorithm, for example a Random Forest type algorithm, to determine thresholds for distinguishing sensitive traffic from non-sensitive traffic. The algorithm is trained on data collected for flows whose sensitivity is known beforehand.

[0017] According to a particular embodiment, the step of applying at least one particular configuration includes marking at least one packet of said stream.

[0018] In this way, data packets can be processed differently depending on the marking applied during their transmission to the recipient. The marking can thus replace any marking performed by the equipment at the data source that may be irrelevant to the type of application. The marking can apply to packets traveling in either the upstream or downstream direction, or in both directions.

[0019] According to a particular embodiment, the step of applying at least one particular configuration includes prioritizing in the gateway the traffic associated with said flow.

[0020] Such an arrangement allows the gateway to apply traffic prioritization rules to ensure optimal quality of service when the communication flow is detected as sensitive, thus minimizing latency and packet loss, and ensuring clear and uninterrupted communication.

[0021] In a particular embodiment, the step of applying at least one particular configuration includes adjusting a trigger threshold for a diagnostic procedure.

[0022] The way in which network disturbances affect the quality perceived by a user when using an application depends on the application's sensitivity to transmission hazards. In other words, for the same packet loss rate and / or the same latency, the quality perceived by the user varies depending on the service used. Thus, the same degradation in transmission quality may, in some cases, trigger complaints to the network operator's customer service department, and in other cases, not generate any complaints.

[0023] By proposing the determination and / or adjustment of a trigger threshold for a diagnostic procedure, such as the display of a particular indicator on a communication terminal, the method makes it possible to avoid unjustified calls to a complaint service and / or to provide a context useful for understanding the problem encountered by the user.

[0024] According to a particular embodiment, traffic is determined to be sensitive when the average packet size is less than 2.2 KB and the ratio of downstream traffic to upstream traffic is within the range ]0, 6[.

[0025] The inventors have determined through analytical methods that sensitive traffic generally comprises at most six times more downstream data than upstream data, and that it uses packets smaller than 2.2 KB in the case of a WiFi® connection, and smaller than 1.1 KB in the case of a wired Ethernet connection. Thus, in certain embodiments, the method includes a step of determining the type of network interface through which the data is exchanged with the first equipment, and selection of a first threshold value based on the type of interface determined.

[0026] For example, interpersonal communication applications such as Voice over IP (VoIP), known to be particularly sensitive to transmission problems, generally use small packets (to limit latency) exchanged in roughly equal quantities in both directions of communication, so as to provide low latency and good interactivity. This type of traffic generally uses packet sizes smaller than the MTU (Maximum Transmission Unit). By comparing the traffic with appropriate thresholds, the process makes it possible to determine whether the traffic is associated with this type of application and to prioritize the traffic if so.

[0027] Similarly, online gaming applications generate a particular type of traffic because the equipment has to transmit data in addition to receiving it; it is therefore possible to identify this type of traffic from the proposed indicators.

[0028] According to another aspect, the invention relates to a device for classifying a bidirectional data packet flow between a first and a second piece of equipment, said data flow passing through a residential gateway, the device comprising a processor coupled to a memory in which program instructions configured to implement the following steps are stored: - Collect network traffic measurements relating to said flow, including at least a number of bytes and a number of data packets transmitted and received by the first device, - Determine, from the collected measurements, an average packet size destined for the first device, and a ratio between the amount of data destined for the first device and the amount of data originating from the first device. - Compare the average size determined at a first specific threshold and the ratio determined at a second specific threshold, - Categorize traffic as sensitive or non-sensitive based on the comparison results, and - Apply at least one specific configuration associated with said flow when the traffic is determined to be sensitive.

[0029] The invention also relates to a residential gateway comprising a classification device as described above.

[0030] In a particular embodiment, the steps of the classification process are determined by computer program instructions.

[0031] Consequently, the invention also relates to a computer program comprising instructions adapted to the implementation of the steps of a classification process as described above, when the program is executed by a processor.

[0032] This program may use any programming language, and be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0033] The invention also relates to a computer-readable information medium on which is recorded a computer program comprising instructions for the execution of the steps of a process as described above.

[0034] The information medium can be any entity or device capable of storing the program. For example, the medium can include a storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, a flash memory, or a magnetic recording means, such as a hard drive.

[0035] On the other hand, the information medium can be a transmissible medium such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The program according to the invention can be downloaded onto an Internet-type network.

[0036] Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

[0037] The various modes or embodiments mentioned above can be added independently or in combination with each other, to the stages of the classification process.

[0038] The devices, control unit, programs and information media offer advantages similar to those conferred by the classification process. Brief description of the figures

[0039] Other features and advantages will become apparent upon reading a preferred embodiment described with reference to the accompanying drawings, among which: - Figure 1 represents a suitable environment for implementing the classification process according to a particular embodiment, - Figure 2 is a flowchart representing the main steps of a classification process according to a particular implementation, and - Fig. 3 is a diagram representing the architecture of a device adapted to implement the classification process in a particular realization.

[0040] Detailed embodiment

[0041] In the following description, embodiments are described on the basis of non-limiting examples to clarify the concepts on which the invention is based. In particular, although the examples and terminology used may refer to certain well-known technologies or standards, these references are not limiting and other technologies may be adapted to implement the concepts of the invention.

[0042] Fig. 1 represents a suitable environment for implementing the classification process according to a particular embodiment.

[0043] The environment shows a local area network (LAN) 100 comprising, for example, a personal computer 101. The computer 101 can access a remote communication network 103 via a residential gateway 102. For this purpose, the gateway 102 includes at least two network interfaces: a first interface (for example, a WiFi® and / or Ethernet interface) allows the connection of equipment on the local network, such as the computer 101, and a second interface (for example, an ADSL, fiber optic, 3G, 4G, or 5G interface) allows the gateway to be connected to a communication network 103 (WAN, for Wide Area Network), for example, the Internet. The gateway 102 includes routing rules that allow the transmission of data packets from the local network to the communication network 103 and vice versa.In this way, computer 101 can exchange messages and establish communication with a remote terminal 104, via the gateway 102 and the communication network 103. The network 103 may include equipment for routing data packets, for example, one or more routers 105. The network interfaces of the gateway 102 can be coupled so that data packets received on one interface can be retransmitted by the second interface without needing to forward the packets back to the operating system running on the gateway. Thus, address translation is performed directly by the network interfaces, which offloads the central processing unit of the gateway. However, the operating system of the gateway 102 can query these network interfaces to collect traffic measurements.For example, the operating system (and applications that may run on the operating system) can access packet counters and retransmitted byte counters for each communication flow and / or for each piece of equipment on the local network 100 without the need to send the data packets back up.

[0044] Such an architecture makes it possible, for example, to establish voice or audiovisual communications between software running on computer 101 and the terminal of communication 104. This architecture also allows computer 101 to access other services, such as a content server 106 to download files or view audiovisual content in continuous download.

[0045] Of course, the local network 100 can include a variety of connected devices (for example connected objects, communication terminals, tablets, connected televisions, etc.) which are not represented for reasons of clarity of the presentation.

[0046] A particular embodiment of the classification process will now be described with reference to [Fig.2].

[0047] Fig. 2 is a flowchart on which the main steps of a classification process are represented, according to a particular embodiment.

[0048] In this embodiment, the classification process is implemented by the gateway 102 to determine the sensitivity of the traffic associated with a communicating device such as the computer 101 in [Fig. 1]. Of course, the invention is not limited by the nature of the communicating device; it could be a communication terminal, a connected object, a voice assistant, a multimedia decoder, a connected television, etc. To this end, the gateway comprises a processor coupled with memory in which program instructions are stored, configured to implement the steps of a classification process according to a particular embodiment.

[0049] The residential gateway 102 is configured to collect, during a step 200, real-time traffic data for at least one device connected to the local network 100, for example, computer 101 (and / or for one or more applications run by a device accessing network services through the gateway 102). The collection concerns, for example, a bidirectional data stream exchanged during a voice call established between computer 101 and the communication terminal 104, or a data stream exchanged between computer 101 and the content server 106. To do this, the gateway queries the LAN and / or WAN network interfaces equipping gateway 102 in order to obtain at least a certain number of packets and a certain volume of data exchanged during a particular call established between computer 101 and terminal 104.The number of packets and the data volume are obtained for a specific measurement period, for example over a sliding 10-second window. To do this, the gateway can query a network interface at regular intervals, for example every 10 seconds, and calculate a difference with the last counter values ​​obtained to obtain the number of packets or bytes exchanged over the elapsed measurement period.

[0050] The collected data corresponds to a specific data stream, identified, for example, by an IP address and a port. In this way, it is possible to distinguish between sensitive and non-sensitive streams originating from the same equipment. For example, computer 101 can establish initial communication with communication terminal 104 and simultaneously download content from server 106. These two data streams are distinguishable by the gateway based on the IP address / port pair. In some embodiments, the method is applied to all streams associated with a particular piece of equipment. In this case, the indicators are calculated from the overall traffic data associated with a particular piece of equipment, across all services.Thus, the collected measurements and calculated indicators can relate to the totality of flows emitted and received by a particular piece of equipment, or to a subset of these flows, including, for example, the flows associated with one or more particular applications or communication protocols.

[0051] During a step 201, the gateway 102 determines an average packet size for computer 101, and a ratio between the volume of data transmitted (Tx) and the volume of data received (Rx) by computer 101.

[0052] To do this, the gateway periodically calculates, for example every 10 seconds, the following indicators for each connected device: - The average size of packets received by computer 101, determined by dividing the total number of bytes received by the total number of packets received during the measurement period. - The Tx / Rx traffic ratio, calculated by dividing the total number of bytes transmitted by the total number of bytes received.

[0053] According to a particular embodiment, the gateway further determines a total volume of data exchanged by computer 101 (and / or by a particular application executed by computer 101), obtained by adding the total number of bytes transmitted and received over the measurement period.

[0054] In step 203, gateway 102 compares the indicators determined in step 201 to thresholds and categorizes the traffic accordingly.

[0055] More specifically, the gateway compares the average packet size determined by computer 101 for the last measurement period with a first threshold, and the traffic ratio determined with a second threshold. The first and second thresholds are defined beforehand and stored in the gateway's memory. In a preferred embodiment, the first threshold is greater than the MTU, preferably between 1100 bytes and 2500 bytes, for example 2200 bytes (or 2000 bytes in Wi-Fi with aggregated packets).

[0056] The value of the first threshold can be selected according to the type of network interface used to exchange data with computer 101. For example, the first threshold can be set to a value of 2200 bytes when the network interface is a WiFi® interface, and to 1100 bytes when the network interface used is an Ethernet interface.

[0057] The second threshold, corresponding to the Tx / Rx ratio, is strictly between 0 and 6; that is, traffic comprising up to 6 times more data transmitted to the equipment than data received from the terminal remains characteristic. In other words, traffic is classified as sensitive when the ratio is strictly less than 6 and strictly greater than 0 (the value 0 is excluded because it implies an absence of Tx traffic, and therefore too little usage to classify the flow as sensitive).

[0058] In a particular embodiment, the gateway further compares the total volume of data exchanged with a third threshold also defined beforehand.

[0059] The third threshold is, for example, set at a value between 3500 and 4500 bits / second, for example 4000 bits / second, so that traffic is categorized as non-sensitive when the total volume of data exchanged over a measurement period of duration Tm seconds is less than 4000*Tm. Such a threshold makes it possible to disregard low traffic (for example, residual traffic associated with a standby state).

[0060] If the total volume of data exchanged is at least equal to the third threshold, then the gateway compares the average size of the packets received by computer 101 with the first threshold.

[0061] These first, second, and third thresholds are, for example, predetermined by machine learning techniques such as the Random Forest machine learning model. These thresholds are defined in such a way as to allow the identification of sensitive traffic, which is characterized by an average size of downstream packets below a specific threshold, a Tx / Rx traffic ratio below another threshold, and in some embodiments, a total amount of traffic exceeding a third threshold.

[0062] Preferably, the decision tree used to determine the thresholds is configured with a relatively shallow depth, for example a depth of 3, so as to best match the algorithm implemented for detection. For example, a first division corresponding to the minimum data volume, a second division corresponding to the average packet size, and a third division corresponding to the ratio.

[0063] In a particular embodiment, to avoid false detections, the categorization of traffic as sensitive is confirmed after a minimum observation period, for example 1 minute, during which the threshold conditions must be met consecutively.

[0064] In step 204, the gateway applies at least one specific configuration associated with said flow when the traffic is determined to be sensitive. The configuration can apply to the upstream flow and / or the downstream flow.

[0065] In a particular embodiment, the results of traffic classification are used to optimize the management of the local network 100. For example, if sensitive traffic is detected, the residential gateway 102 prioritizes this traffic to minimize latency and packet loss, for example by activating a traffic prioritization rule for the flow in question in the gateway (by directing packets to priority queues, for example, or by combining transmission channels). More generally, the residential gateway 102 can adapt its routing rules and traffic management policies based on the traffic categorization, thus enabling better allocation of network resources and an optimized user experience for services with sensitive exchanges.

[0066] Thus, the user experience is improved for applications whose traffic is sensitive to transmission hazards, such as voice or audiovisual communications or video games between the computer 101 and the communication terminal 104.

[0067] According to a particular embodiment, the application of a particular configuration may include enabling prioritization of traffic identified as sensitive, including, for example, packet marking, so that packets are treated differently during their transmission. For example, packets are marked before being retransmitted, so that intermediate equipment can prioritize this traffic, for example by assigning flows to priority queues to reduce latency, or by directing packets to paths offering a better quality of service.

[0068] In a particular embodiment, the application of a specific configuration includes adjusting a trigger threshold for a diagnostic procedure. For example, the display of a quality of service indicator on computer 101 typically depends on indicators such as the loss rate or latency. The method improves this situation by allowing the sensitivity of the flow to be taken into account, that is, the perceived influence of a particular loss rate on the user.

[0069] The process makes it possible to avoid unjustified calls to a complaint service and / or to provide a context useful for understanding the problem encountered by the user.

[0070] Fig. 3 represents the architecture of a device 300 adapted to implement the process according to a particular embodiment.

[0071] The device 300 includes a data processing module comprising a storage space 301, for example a memory (MEM), a processing unit 302, equipped for example with a microprocessor (PROC), and controlled by a computer program (PGR) 303 whose instructions are configured to implement the classification process as described above in relation to the [Fig.2], and in particular the steps of collecting network traffic data relating to said flow, including at least a number of bytes and a number of data packets transmitted and received by the first equipment, of determining an average packet size to the first equipment, and a ratio between the amount of data coming from the first equipment and the amount of data going to the first equipment, of comparing the average size determined at a first particular threshold and the ratio determined at a second particular threshold, of categorizing the traffic as sensitive or non-sensitive according to the results of the comparison, and of applying at least one particular configuration associated with said flow when the traffic is determined to be sensitive.

[0072] At initialization, the code instructions of the computer program 303 are, for example, loaded into memory 301 before being executed by the processor of the processing unit 302. The microprocessor of the processing unit 302 implements, according to the instructions of the computer program 303, the steps of the classification process described above with reference to [Fig.2].

[0073] To this end, in addition to the memory 301 and the processing unit 302, the device includes communication modules 304 and 305 corresponding, for example, to WiFi, Ethernet, Bluetooth, Optical, 3G, 4G, 5G, etc. network interfaces. These interfaces allow the device to establish communication with other devices belonging to the same communication network or to separate networks. Interfaces 304 and 305 are coupled in such a way as to allow the retransmission on a first interface of data received on a second interface without sending this data back to the device's operating system. Interfaces 304 and 305 expose a control interface allowing the processing unit 302 to obtain measurements concerning data flows to and / or from one or more specific devices and / or one or more services executed by these devices.

[0074] The device 300 also includes a collection module 306. This module is, for example, implemented by computer program instructions configured to collect, through a control interface exposed by at least one of the communication interfaces 304 and 305, traffic measurements comprising at least, for a particular flow and / or a particular piece of equipment, a number of bytes and a number of data packets transmitted and received. In a particular embodiment, the collection module is further configured to collect a representative value of the total amount of data (Tx and Rx) exchanged over a particular time window by a particular piece of equipment or service.

[0075] The device 300 also includes a calculation module 307. The calculation module 307 is implemented, for example, by program instructions configured to calculate indicators from the data collected by the collection module 306. In particular, the program instructions are adapted to calculate an average size of the packets transmitted to a piece of equipment (and / or service), and a ratio between the amount of data transmitted to the equipment (and / or service) and the amount of data received from the equipment (and / or service). In a particular embodiment, the indicators are calculated over a sliding window, for example, over the last ten seconds.

[0076] The device includes a comparator 308 adapted to compare the indicators determined by the module 307 with predefined thresholds. Such a comparison module is, for example, implemented by computer program instructions configured to compare the average packet size determined by the module 307 with a first specific threshold stored in memory 301, and to compare the ratio determined by the module 307 with a second specific threshold stored in memory 301. In a particular embodiment, the instructions are further configured to compare an overall volume of data exchanged with a piece of equipment (or a service) with a third threshold stored in memory 301. The comparator is further configured to categorize the traffic as sensitive or non-sensitive based on the results of the comparison.In a particular embodiment, the comparator determines that a particular flow is sensitive (or that a particular piece of equipment generates sensitive traffic) when the average packet size is less than 2.5 KB, preferably less than 2.2 KB, and the ratio of transmitted traffic to received traffic is strictly between 0 and 6, and the overall volume of data exchanged is greater than 4 Kb / s.

[0077] The device 300 finally includes a configuration module 309 adapted to apply a particular configuration associated with the flow when the traffic is determined to be sensitive by the comparator 308. For this purpose, the module 309 includes program instructions configured to mark retransmitted packets so that they benefit from differentiated treatment and / or to adjust the triggering threshold of a diagnostic procedure and / or to prioritize in the device the traffic associated with said flow.

[0078] According to a particular embodiment, the device 300 is integrated into a communication device, such as a residential gateway, a router, a WiFi access point, a communication terminal, etc.

Claims

Demands

1. A method for classifying, by a residential gateway, a bidirectional network flow transiting through said gateway between a first and a second device, the method comprising the following steps: - Collecting (200) network traffic measurements relating to said flow, comprising at least a number of bytes and a number of data packets transmitted and received by the first device, - Determining (201), from the collected measurements, an average packet size destined for the first device, and a ratio between the amount of data destined for the first device and the amount of data originating from the first device, - Comparing (202) the determined average size to a particular first threshold and the determined ratio to a particular second threshold, - Categorizing (203) the traffic as sensitive or non-sensitive based on the results of the comparison,and - Apply (204) at least one specific configuration associated with said flow when the traffic is determined to be sensitive.

2. A method according to claim 1 in which traffic is considered non-sensitive when the total amount of data exchanged over a particular time window is less than a particular third threshold.

3. A method according to any one of the preceding claims wherein the first, second and third thresholds are determined by a machine learning algorithm from pre-labeled data streams.

4. A method according to any one of the preceding claims wherein the step of applying at least one particular configuration includes marking at least one packet of said stream.

5. A method according to any one of the preceding claims wherein the step of applying at least one particular configuration includes prioritizing in the gateway the traffic associated with said flow.

6. A method according to any one of the preceding claims wherein the step of applying at least one particular configuration includes adjusting a trigger threshold for a diagnostic procedure.

7. A method according to any one of the preceding claims wherein traffic is determined to be sensitive when the average packet size is less than 2.2 KB and the determined ratio is strictly between 0 and 6.

8. A device for classifying a bidirectional data packet flow between a first and a second device, said data flow passing through a residential gateway, the device comprising a processor (302) coupled to a memory (301) in which are stored program instructions (303) configured to implement the following steps: - Collect network traffic measurements relating to said flow, comprising at least a number of bytes and a number of data packets transmitted and received by the first device, - Determine, from the collected measurements, an average packet size destined for the first device, and a ratio between the amount of data destined for the first device and the amount of data originating from the first device, - Compare the average size determined at a first particular threshold and the ratio determined at a second particular threshold,- Categorize traffic as sensitive or non-sensitive based on the comparison results, and - Apply at least one specific configuration associated with said flow when the traffic is determined to be sensitive.

9. Residential gateway comprising a classification device according to claim 8.

10. Computer program comprising program instructions configured to implement a classification method according to any one of claims 1 to 7, when the program is executed by a processor.

Images