Method for managing a set of data packets

Abstract

Method for managing a set of data packets. The invention relates to a method for managing a set (E) of data packets (P0, P5), the packets being sequences of bits divided into sections. The method comprises the following steps: Obtaining the set (E) of data packets; Counting the number of packets in the set (E) that have the same value for a given section; Recording representative data of the count result on a data storage medium (DS). Figure 1

Description

Title of the invention: Method for managing a set of data packets. Technical field

[0001] The technical field is that of telecommunications.

[0002] More specifically, the invention relates to a method for managing a set of data packets.

[0003] Modern networked computing and digital telecommunications operate on the principle of exchanging data packets between senders and receivers using protocols such as the IP protocol (acronym for Internet Protocol). A set of data packets relating to a given message is sent by the sender to a receiver, each packet corresponding to a part of the complete message. The packets contain the receiver's address. Using this information, a packet can be addressed to its final recipient through various routing algorithms. The overall content of the message is reconstructed by the recipient by regrouping the data contained in the different packets. The message can also be audio or visual media, as in the case of telephone or audiovisual communications, which also operate on the principle of packet transmission.To achieve complete communication, numerous protocols must be used, each fulfilling a role from the physical transmission of bits—the atomic elements that constitute digital data—to the interpretation of data for computer applications. Bits are typically grouped into bytes, sets of eight bits. The various protocols are generally viewed as being organized into layers, with a protocol at one layer relying on a protocol at the layer below. The OSI (Open Systems Interconnection) model and the Internet model describe the interaction of the various protocols between different layers.

[0004] A common feature of all protocols across all layers is the organization of exchanged data into data packets. A data packet is organized into two parts: the first part is the header, which contains the information necessary for the protocol responsible for processing the packet; the second part is the payload, which contains the data transported within the packet itself. If packets of a given protocol contain one or more encapsulated packets of another protocol, the payload of a packet of the first protocol may contain the header of that other protocol.

[0005] Packet headers include fields. A field is a continuous set of bits of fixed or variable length. A field has an identifier that indicates the nature of the value present in the field. The values ​​in the field are used by the relevant protocol to process the packet appropriately. For example, in the header of an IP packet, a field with the identifier Version contains the version number of the protocol used. The size of this field is four bits. Other fields relate, for example, to the source and destination IP addresses of the packet. A header is therefore naturally divided into several sections, namely the header fields. The packet's load can also be divided into several sections, for example, by defining sections of a constant length expressed in bits.

[0006] A data packet is therefore a sequence of bits which can be divided into several sections, these sections being able to correspond to fields of the header or to sections of the payload or to any other appropriate division of the packet.

[0007] A packet analysis tool such as Wireshark or tcpdump allows the capture and analysis of data packets. The analysis makes it possible to separate a data packet exchanged over a network into its header and payload, to read the information contained in the header and the data contained in the payload, and to identify the various sections of a packet, both in its header and in its payload.

[0008] To perform these packet processing operations, packet analysis software manipulates captured packets that are then stored in computer files. The standard format for representing data packets is the .pcap file format (from the English "packet capture"). An evolution of this file format is called .pcapng (for PCAP New / Next Generation).

[0009] The data packets described here assume that they are sequences of bits, that is, of symbols 0 or 1. In certain contexts (for example, wireless transmission using carrier wave phase modulation), the data packets transmitted on the carrier waves are sequences of symbols that can take more than two values. Phase modulations typically use 4, 8, or 16 symbols, and not just the two symbols 0 and 1.

[0010] All of these elements are well known in the prior art and will not be described further. State of the art

[0011] There is a need to compress data traffic to reduce the energy and hardware resource consumption of digital communications. Compression protocols exist for this purpose. These protocols are compression rules are applied to data packets. A compression rule will be applied to a data packet if a section of that packet takes on a value specified in the rule, and will then process the packet accordingly. For example, the corresponding value may not be transmitted. The packet is transmitted with a rule identifier so that, upon reception, the original compressed value can be reconstructed. Typical compression rules might, for example, delete a given value, replace it with a dictionary index, or remove a prefix from a section.

[0012] Compression rules are generally defined by experts who, after analyzing a particular traffic pattern, create a set of rules perfectly suited to that traffic. Such an analysis can take place, for example, during the deployment of a particular network. This expertise is costly to mobilize and must be repeated when network contexts change, for example, when protocol versions or even network addresses of equipment change. Given this cost, the use of compression rules is currently limited to very constrained contexts, in which compression is very useful, or even necessary, to improve the operation of the communication service.

[0013] Proposals for using machine learning to learn efficient compression rules in a given context are beginning to emerge in the prior art. A set of telecommunications packets can be trained, for example, to determine compression rules that would be efficient for compressing packets similar to those in the set. The use of machine learning would thus avoid the need for an expert and would therefore reduce the costs of using the compression algorithms presented above.

[0014] Machine learning is performed using training sets. Large sets of packets representative of the expected traffic are fed into the learning algorithm and are trained. This training can then derive efficient compression rules for this training set. Since the training set is representative of the expected traffic, the learned compression rules will be effective on the traffic actually observed.

[0015] For the training set to be representative, it will generally need to be large and contain many packets. The training set will thus generally consist of many packets captured from real traffic passing through telecommunications equipment. These captured packets must then be transmitted to a dedicated server capable of performing the training, which is generally located remotely from the equipment that captured the traffic.

[0016] However, current data packet capture formats contain all the information present in the data packets. The captured packets are therefore the same size as the transmitted packets, and training sets must, as we have seen, comprise a very large number of these packets. Communicating a training set from telecommunications equipment to a dedicated server can therefore involve approximately a doubling of the traffic. This is problematic in any context where machine learning compression rules are used, and even more so in constrained contexts that specifically require the use of compression algorithms.

[0017] Apart from the problem of learning compression rules, several functions of telecommunications networks, distinct from traffic routing, require the manipulation of large sets of data packets. For example, traffic monitoring involves duplicating data packets to send them to a dedicated monitoring server that will attempt to detect incidents and trigger alerts. It can also be useful to implement learning algorithms to learn about objects other than compression rules, for example, quality of service rules in which different treatment is offered to the various categories of packets belonging to the traffic.

[0018] In another example, when a telecommunications network is subjected to a denial-of-service attack, it is useful, in order to counter the attack, to be able to extract a set of data packets representative of the traffic taking place in the network under attack. The extracted packets will then be analyzed to determine how to counter the attack. If the extracted packets are transmitted as is, they will add to the traffic handled by the network, which is already subjected to a denial-of-service attack, and will therefore degrade the situation, at least initially.

[0019] In general, many ancillary functions of telecommunications networks involve manipulating large sets of data packets. Existing formats for storing data packets copy them verbatim. Large sets of data packets to be manipulated will therefore occupy a significant amount of memory or, if they must be transmitted during manipulation, will use a very large number of network resources.

[0020] The invention improves the situation. Description of the invention

[0021] According to a first functional aspect, the invention relates to a method for managing a set of data packets, the packets being sequences of bits divided into sections, the method comprising the following steps: • Obtaining the set of data packets; • Counting the number of packets in the set that take the same value for a given section; • Recording on a data medium of data representative of the result of the count.

[0022] Thanks to the invention, the duplication of data packets for different uses in the field of telecommunications, in particular to serve as a training set, is avoided.

[0023] Indeed, rather than using all the data packets, the method according to the invention counts the number of packets that take given values ​​for given sections of packets and, in one embodiment, for the different parts of these sections, and then records a data storage medium containing data representative of these counts. Therefore, it is not the entire set of packets that is recorded to serve subsequently, for example, as a training set, or for any other use, but a representation of this set, a representation that includes the information necessary for the proper functioning of a subsequent algorithm.

[0024] The information retained by the method of the invention in managing a set of data packets is therefore the number of packets that take a given value for a given section. This information is sufficient for many applications, for example, learning compression rules, but also, for example, for analyzing data packets transiting through a network during a denial-of-service attack. Recording counting information, instead of the content of the entire packets in the set, allows for savings, but at the cost of information loss. For example, if the values ​​taken by two distinct sections are very strongly correlated, this information is likely to be lost.

[0025] Rather than recording the contents of all the packets in the set using a conventional data packet capture format, and then possibly transmitting these contents, representations of sections are recorded, which takes up much less memory. The technical effect of the invention is therefore to save a significant amount of memory and network resources by recording and possibly transmitting a representation of the entire set of data packets rather than the packets themselves directly.

[0026] Dividing the packets of the set into sections and performing the count based on the values ​​taken by the packets for these sections allows the count to be guided by the useful information present in the packets of the set, information which will then be used for training or for denial-of-service attack analysis or for any other use. However, It is possible to consider the packages in the set as being formed from a single section in order to take into account all the contents of the packages. The count performed by the method of the invention will then contain the same information as an exact copy of the packages in the set.

[0027] It is possible to record and possibly transmit a representation of the set of data packets rather than the data packets themselves, particularly when the representation is intended for learning compression rules. Indeed, what is important for learning compression rules is the number of packets that take a given value, and not the packets themselves. Other subsequent uses may also be limited to the information of the number of packets taking a given value, and may not require having all the information present in the packets of the set, for example, to perform packet analysis during a denial-of-service attack or to perform traffic monitoring by seeking to identify specific values ​​for given sections.

[0028] In one embodiment of the invention, the method further includes a step of transmitting the data carrier on which representative data of the counting result is recorded. With this embodiment, the subsequent use of the packets is carried out on a server remote from the location where the data packets are obtained and where the counting is performed, using the representative data that is transmitted. In another embodiment, the data carrier is not transmitted but is used at the location where the counting and recording of the counting result are performed. In both embodiments, the method saves considerable memory resources by avoiding the need to record all the data packets.In the mode where the data carrier is transmitted, the process saves significant network resources by transmitting not the entire set of data packets, but just a data carrier on which a count result is recorded. This saving of network resources is, for example, very useful when the data carrier will be used to analyze traffic flowing through a network subjected to a denial-of-service attack.

[0029] In one embodiment of the invention, the counting step for a given section includes counting the number of packets that have the same value for a defined part of said given section. In one embodiment of the invention, the counting step for a given section includes associating the number of packets having the same value for a defined part of the section with said same value.

[0030] The counting function focuses on sections and, in one embodiment, on parts of sections. In the example of learning compression rules, Some learned rules compress only parts of sections. For example, if many packets for a given part of the section take the same value, this value will be worth compressing, and the corresponding compression rule will be easily learned. In particular, some compression rules remove prefixes from given sections if these prefixes take frequent values. A prefix is ​​the part of a section that starts at the beginning of the section and includes all the bits of the section up to a given point. A prefix can be empty, and it can also correspond to the entire section.

[0031] The count and the data representing the result of this count make it possible to determine the number of packets for which a given section or part of that section has a given value, and in particular the values ​​of the prefixes in that section. This information will guide the learning of compression rules by determining which parts or prefixes appear most frequently in the training set for a given section, and are therefore the most relevant to compress. Other uses besides learning compression rules may only require the number of packets having a given value for a part of the packet, such as learning quality of service rules, monitoring networks, or analyzing packets circulating in a network subjected to a denial-of-service attack.

[0032] The method counts the values ​​taken by sections of packets, rather than by the packets as a whole. This is another source of efficiency in terms of memory size. Indeed, some compression rules only apply to certain parts of the data packets. For example, the SCHC (Static Context Header Compression) protocol only seeks to compress the headers of the data packets and not the packet payloads. If the learning objective is therefore to learn compression rules for the SCHC protocol, it will only be necessary to represent the headers of the packets in the training set, and not their payloads. The gain in memory size and network resources achieved by the invention, by representing only the headers of the data packets and not their entirety, is very significant, and is possible because the representation is intended for use in a future learning algorithm.However, if one wishes to retain all the information present in the packets of the set, it is possible to consider that the packets are formed of a single section.

[0033] According to one embodiment of the first functional aspect, the counting step comprises, for a given section having a given length, obtaining a binary tree with edges labeled by 0 or 1 whose depth is the length of the section, a node of the tree having the value of the number of packets for which the section has as a prefix the same sequence of bits as that read from the edges of the path leading to the node from the root and the step of recording to a data medium includes recording node values ​​of the resulting tree corresponding to the section.

[0034] Thanks to this embodiment, a particularly compact representative data is recorded, which saves memory and network resources in the event of subsequent transmission.

[0035] Indeed, a binary tree is particularly well-suited to representing the values ​​taken by the prefixes of a given section. Starting from the root of the tree, which corresponds to an empty sequence, and traversing the tree, the labels '0' and '1' form a sequence up to a node. The node in question carries a number which is the number of packets for which the given section has as its prefix the sequence formed by the labels of the path leading to the node. At least one node value is recorded, or, in some embodiments, all the node values ​​of the tree are recorded and possibly transmitted in order to have a complete representation of the number of packets that take given values ​​for a given section.

[0036] The binary tree defined in this embodiment allows for compact recording of both the values ​​that can be taken by a data packet for the different prefixes and parts of the section (these possible values ​​can be read from the labels of the tree edges) and the number of packets in the set taking these values ​​(these numbers can be read from the nodes of the tree).

[0037] According to one embodiment, which can be carried out alternatively or cumulatively with the previous embodiment, the data packets are sequences of symbols belonging to an alphabet of a given size and the counting step includes, for a given section having a given length, obtaining a tree whose degree is equal to the size of the alphabet, whose edges are labeled by the symbols of the alphabet, whose depth is the length of the section, a node of the tree having as its value the number of packets for which the section has as a prefix the same sequence of symbols as that read on the edges of the path which leads to the node from the root.

[0038] In this embodiment, the packets are not sequences of bits but sequences of symbols belonging to an alphabet. These symbols can, for example, correspond to quantities used in the physical transmission of the data packets formed by these symbols. For example, the data packets can be sequences of symbols corresponding to modulations of phase changes among four possible phase changes, that is, 4-PSK, 8-PSK, or 16-PSK symbols. The tree obtained by counting must then take this modification into account, but the principle remains the same: the The labels of the edges of the tree used bear the symbols of the alphabet used; a path in the tree corresponds to a sequence of symbols; and the node to which the path leads bears the number of packets of which a given section has as a prefix the value read on the path that leads to the node.

[0039] According to one embodiment, which can be implemented alternatively or cumulatively with the preceding embodiments, the recording of node values ​​forms sequences, a sequence corresponding to a breadth-first traverse of a resulting tree. According to another embodiment, which can be implemented cumulatively with the preceding embodiment, only the subtrees of nodes that have a strictly positive value are traversed. According to yet another embodiment, which can be implemented alternatively with the preceding embodiment, a sequence corresponds to a depth-first traverse of a resulting tree.

[0040] Thanks to these embodiments, a precise way of recording the values ​​of the tree nodes corresponding to the different sections is proposed. The subtrees of the nodes whose value is zero do not need to be traversed since, by definition, the underlying values ​​will also be zero. Only the subtrees of the nodes that have a strictly positive value are therefore traversed. This saves the size of the sequence to be recorded, which corresponds to a tree for a given section. This also saves the size of the sequence to be transmitted in the case where the representative values ​​of the set of data packets are transmitted to a remote server.

[0041] To obtain a sequence, it is possible to perform a breadth-first or depth-first search of the tree. In our experience, it is more practical to perform a breadth-first search because certain values ​​of the sequence corresponding to the search do not need to be recorded, and it is easier to decide which of these unrecorded values ​​to keep in a breadth-first search, which maintains a proximity between parent and child nodes.

[0042] According to another embodiment, which can be carried out alternatively or cumulatively with the preceding embodiments, the method includes recording on the data carrier the size of the set in a single location instead of the values ​​of the tree roots.

[0043] Thanks to this embodiment, further savings are achieved in terms of the data to be recorded on the data carrier, which may eventually be transmitted. The value at the roots of all trees recorded on a data carrier for a set of packets is necessarily the size of the set. Indeed, the root of a tree corresponds to an empty sequence of 0s and 1s read from the tree, and all packets in the set have as a prefix the empty sequence for all sections. The value for the root nodes of all trees is therefore necessarily the size of the represented set of packets. It suffices to record This size is recorded only once on the data storage, replacing the values ​​of the tree roots. It is not necessary to record the root node value for all trees, since this value will always be the recorded size.

[0044] According to another embodiment, which can be carried out alternatively or cumulatively with the preceding embodiments, only the values ​​of the tree nodes which are reached by an edge labeled with only one of the labels 0 or 1 are recorded.

[0045] Thanks to this embodiment, further savings are achieved in terms of data to be recorded. Since the packets are sequences of bits, which therefore take the value 0 or 1 at a given position in the section, it is only necessary to record one of the two values. The second value can be obtained as the difference between the value of the parent node and the first value.

[0046] In the embodiment where the packets are not sequences of bits but sequences of symbols from a larger alphabet, only the values ​​of the tree nodes reached by an edge labeled with a symbol from the alphabet other than a specific symbol are recorded. Indeed, similarly to what is done for bits, it is necessary to record the values ​​for all symbols except one, the specific symbol. The value of the node reached by a specific symbol can be deduced by subtracting the value of the parent node from the sum of the other values.

[0047] According to another embodiment, which can be carried out alternatively or cumulatively with the preceding embodiments, a value of a given node is recorded in the form of a variable-length bit sequence that depends on the maximum possible value for a given node, this maximum value being that of the parent node of the given node.

[0048] Thanks to this embodiment, further savings are achieved in terms of the data to be recorded and potentially transmitted. Indeed, the values ​​to be recorded are integers, since these values ​​correspond to the number of packets in the set. Integers can be represented by a sequence of bits. But while, in general, integers are represented by fixed sequences of 16 or 32 bits, it is possible to optimize this representation by using sequences of variable length. In fact, it is always possible to know the maximum value that a node can take. For a given node, this maximum value is that taken by the parent node, knowing that the value taken by the root node is that of the size of the data packet set.

[0049] According to another embodiment, which can be implemented alternatively or cumulatively with the preceding embodiments, for a given section having a given length, certain packets of the set take on a length value lower for this section and, when the process records node values ​​of the resulting tree for a given depth whose sum is strictly less than the number of packets in the set, then a predefined escape sequence is recorded followed by the two values ​​of the nodes reached by edges labeled by 0 and by 1.

[0050] Thanks to this embodiment, the method is adapted to the case where the packets in the set have variable lengths for given sections. In this case, it is no longer possible to record only the values ​​for 0 (or for 1). Indeed, it is possible that, at a given level, the section is no longer defined for one or more packets. In this case, the sum of the values ​​for the two child nodes will be strictly less than that of the parent node. One solution is to define an escape sequence, for example, a sequence consisting only of 1s, of the length intended for writing a value (which can therefore vary depending on the embodiment). When this sequence is recorded, the embodiment requires that the next two values ​​be recorded, and not just one of the two. In this way, the lack of definition caused by the fact that packets have sections of variable length is overcome.

[0051] According to another embodiment, which can be carried out alternatively with the previous embodiment, for a given section having a given length, some packets of the set take a lower length value for this section and the method records, outside the sequence representing a tree, information enabling the retrieval of which nodes are recorded the two values ​​of nodes reached by edges labeled by 0 and by 1.

[0052] This embodiment offers an alternative solution to the problem of packets having sections of variable length. Rather than recording an escape sequence (which reduces by one the maximum number that can be recorded on a bit sequence of a given length), the information indicating the tree nodes that are recorded for the two values ​​0 and 1 can be written in an area outside the sequence representing a tree.

[0053] According to another embodiment, which can be carried out alternatively or cumulatively with the preceding embodiments, the division into sections of the packets of the set corresponds to the division of the headers of the packets into identical fields, the charges of the packets not being taken into account.

[0054] Thanks to this embodiment, further memory savings are achieved since the packet loads are not represented. The sets of data packets represented using the invention are, for example, used to learn compression rules, and these compression rules to be learned will often be rules that apply to header fields, as in The case of the SCHC protocol. In this case, the only information to use for training is the values ​​taken by the packets for the different sections. The representation according to the embodiment retains this information well and is therefore very advantageous.

[0055] When the intended use is that of analyzing packets circulating in a network subjected to a denial-of-service attack, the useful information is also concentrated in the header of the data packets and this embodiment, which is very economical in memory size, can also be used in this context.

[0056] According to another embodiment, which can be carried out alternatively with the previous embodiment, the division into sections of the packages of the set includes only one section which corresponds to the header of the packages, the charges of the packages not being taken into account.

[0057] A drawback of the previous embodiment is that it loses the correlation that may exist between different section values ​​within the same packet. One solution to retain this information is to consider a single section that corresponds to the entirety of a header.

[0058] In another embodiment, the sectioning of the packets of the set includes sections of a given size which cover the load of the packets of the set.

[0059] It is also possible to want to learn compression rules that apply to the load of data packets, or to analyze this load in traffic monitoring actions or in response to denial-of-service attacks, and this embodiment makes it possible to represent sets of data packets that can be analyzed or used as training sets in order to search for compression rules capable of compressing the load of data packets.

[0060] In another embodiment, the packets are sequences of symbols divided into sections, the symbols belonging to an alphabet of size n, and the method comprises, for a given section of a given length, obtaining an n-ary tree with edges labeled by the n symbols, the depth of which is the length of the section, a node of the tree having the value of the number of packets for which the section has as a prefix the same sequence of bits as that read on the edges of the path leading to the node from the root. In an embodiment that can be implemented cumulatively with the preceding embodiment, only the values ​​of the nodes that can be reached by n - 1 symbols among the n symbols are recorded.

[0061] These embodiments make it possible to adapt the invention to the case where the packets are not sequences of bits but sequences of symbols in general.

[0062] According to one embodiment, the management process includes a preliminary step of obtaining information relating to the division into sections of packages of the whole.

[0063] Thanks to this embodiment, the method of the invention is made more generic and suitable for use in many different contexts. Before implementing the method according to the invention, the management entity implementing the method can obtain information regarding the segmentation of the packets in the set. This information could, for example, specify how to segment the packets in the set and which segments are retained for use in the subsequent counting and recording steps. In this way, the method is adapted to the subsequent use of the information recorded on the data medium. Indeed, learning compression rules will not necessarily require the information present in the data packets but only the values ​​taken from the various headers, and the segmentation of the packets will be done accordingly.Conversely, packet analysis for quality of service or security purposes will need to consider the data packet load, and packet segmentation can be performed solely on this load before implementing the process. Obtaining information about segmentation allows specifying which segmentation is actually implemented and thus adapting the process to subsequent uses of the recorded and potentially transmitted data.

[0064] According to one embodiment, the management process includes a preliminary step of obtaining information relating to the step of obtaining the set of packages.

[0065] Thanks to this embodiment, the method of the invention is improved by making it more generic. Again, depending on the subsequent use of the data medium on which the counting information is recorded, it may be useful to consider certain categories of packets to form the set of packets submitted to the method. For example, from the perspective of learning compression rules or monitoring traffic, only packets corresponding to a given protocol stack may be of interest. The information relating to obtaining the set of packets allows the method of the invention to be controlled so as to record information only for packets of this category. The information relating to obtaining the set may also include temporal criteria to indicate that only packets circulating during a given time range will be recorded by the method of the invention.Any other filtering criterion can be implemented by obtaining information relating to the acquisition of the set of data packets.

[0066] According to a second functional aspect, the invention relates to a method for obtaining information concerning a set of data packets, the packets being bit sequences divided into sections, the process comprising, for a given section, reading from a data medium a data representative of the result of a count followed by obtaining from this data representative the number of packets in the set which take the same value for the given section.

[0067] Thanks to this aspect of the invention, representations recorded on data carriers and possibly transmitted to remote servers are retrieved. They are suitable for learning, for example, compression rules, but can also be used for traffic monitoring or analyzing data packets circulating in a network subjected to a denial-of-service attack, or for other uses. The data packets can be captured at a network location and are representative of the network traffic at that location. The representation according to the invention is much more concise, so it is easy to transmit the data carrier containing the concise representation to a location where it will be used.The represented set of data packets thus becomes, for example, a training set for a machine learning algorithm or a representation of the packets to be analyzed by a traffic monitoring program. The information to be obtained is the number of packets in the set that have the same value for a given section. The representation recorded on the data storage medium has the advantage of being significantly smaller than a captured set of data packets. The invention therefore allows for very significant savings in memory size and network capacity for transferring such a set of data packets for analysis or training.

[0068] According to a first material aspect, the invention relates to a management entity implementing a method for managing a set of data packets, the packets being sequences of bits divided into sections, the management entity comprising the following modules: • A module for obtaining said set of data packets; • A module for counting the number of packets in the set that take the same value for a given section; • A module for recording data representative of the result of the count onto a data medium.

[0069] According to one embodiment of this first material aspect, the invention relates to telecommunications equipment comprising a management entity implementing a method according to the invention for managing a set of data packets.

[0070] According to another material aspect, the invention relates to a management entity implementing a method for obtaining information concerning a set of packets of data, the packets being sequences of bits divided into sections, the management entity comprising the following modules: • A reading module on a data storage medium, for a given section, of data representative of the result of a count; • A module for obtaining, from this representative data, the number of packets in the set that take the same value for the given section.

[0071] According to one embodiment of this other material aspect, the invention relates to telecommunications equipment comprising a management entity implementing a method according to the invention for obtaining information concerning a set of data packets.

[0072] According to another material aspect, the invention relates to a data carrier on which is recorded a computer program comprising a sequence of instructions for implementing the method of managing a set of packets according to the invention when it is loaded into and executed by a processor.

[0073] According to another material aspect, the invention relates to a data carrier on which is recorded a computer program comprising a sequence of instructions for implementing the method of obtaining information according to the invention when it is loaded into and executed by a processor.

[0074] According to a final material aspect, the invention relates to a data carrier on which is recorded data representing the result of a count of the number of packets in a set, the packets being sequences of bits cut into sections, which take the same value for a given section.

[0075] The data carrier on which the data representing the result of a count is recorded can be used locally by the equipment hosting the management entity that recorded it, or transmitted for later use by a process performed by another piece of equipment. Processes that can use this data carrier can include, for example, machine learning or traffic analysis processes. Machine learning can, for example, involve learning compression rules, quality of service rules, or traffic optimization through adjustments to parameters used in the transmission of data packets. Analysis can, for example, be a security analysis concerning the content of packet payloads or packet headers, and can take place, for example, during an attack on a telecommunications network. The analysis can then be performed in real time or after the fact.In all cases, rather than capturing a complete set of data packets, only count data is recorded on the data carrier and possibly transmitted for training, analysis, or other use. Since only count data is recorded and not the captured packets themselves, the data carrier is much more... Reduced memory size saves hardware and energy resources for storage. Network resources are also saved if the data storage medium is transmitted rather than used locally.

[0076] Data carriers can be any entity or device capable of storing programs. For example, the carriers can include a storage means, such as a ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means such as a hard drive. On the other hand, the carriers can be transmissible media such as an electrical or optical signal, which can be transmitted via an electrical or optical cable, by radio, or by other means. The programs according to the invention can, in particular, be downloaded from a network such as the Internet. Alternatively, the information carrier can be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.The programs according to the invention can use any type of computer technology in terms of compiled programming languages, interpreted languages, or a combination of both, as well as in terms of operating systems. Brief description of the figures.

[0077] The invention will be better understood upon reading the following description, given by way of example, and made with reference to the accompanying drawings in which:

[0078] [Fig. 1] represents a management entity implementing the management process, a management entity implementing the obtaining process and a data carrier.

[0079] [Fig.2] illustrates an example of several data representative of a set of data packets.

[0080] [Fig.3] illustrates an example of representing integers by sequences of bits of variable length.

[0081] [Fig.4] illustrates an example of implementation of the management process according to the invention.

[0082] [Fig.5] illustrates another example of implementation of the management process according to the invention. Detailed description

[0083] Fig. 1 represents an example of implementation of the invention.

[0084] Figure 1 represents a management entity 100 which implements a process of Management of a set E of PO to P5 data packets. Management entity 100 includes: • A module 101 for obtaining said set E of data packets; • A module 102 for counting the number of packets in the set which take the same value for a given section; • A module 103 for recording on a DS data carrier, for the purpose of learning, a data representative of the result of the count.

[0085] Figure 1 also represents a management entity 200 that implements a method for obtaining information about a set E of data packets. The management entity 200 comprises: • A 201 module for reading data representative of the result of a count from a DS data storage medium; • A module 202 for obtaining from the representative data the number of packets in set E that take the same value.

[0086] In the embodiment shown in [Fig.1], the management and obtaining processes are carried out for the purpose of learning compression rules, but other subsequent uses can be implemented after the execution of the processes of the invention.

[0087] Management entities 100 and 200 represent the hardware architecture of conventional computers. They include, in particular, processors, RAM and read-only memory such as Flash memory, ROM (not shown in the figure), as well as input / output devices such as keyboards and / or screens (not shown in the figure).

[0088] The management entities 100 and 200 can be integrated into devices present in telecommunications networks that capture data packets. These can be servers running complete programs for recording and retrieving data packets, such as Wireshark and tcpdump programs adapted to implement the methods of the invention.

[0089] Management entities 100 and 200 can, in particular, be integrated into telecommunications equipment or computer network equipment through which data packets pass, and / or which transmit data packets, and / or which receive data packets. Management entities 100 and 200 will then enable, in addition to the data packet processing performed by the equipment, the implementation of data packet management, for example, for the purpose of learning compression rules.Rather than simply storing the data packets (which consumes a large amount of memory) or duplicating them to send to a server for training (which duplicates the traffic and therefore consumes significant network resources), management entity 100 extracts from the set E of data packets the information needed to train compression rules, namely the number of packets in the set that have the same value for a given section, and then stores this information on a data storage device (DS) for training purposes. In the example implementation presented here, the packets... The elements of set E are sequences of bits; the information is arranged in a binary tree; and the data stored on the DS medium are the values ​​of the tree's nodes written sequentially. Management entity 200 then reads this information from the DS data medium to learn compression rules specifically designed to compress data packet traffic, of which set E is representative.

[0090] The DS data carrier can be transmitted over a communications network. The management entity 100 can thus be deployed at a suitable location to capture a set E of data packets representative of a given traffic flow. The management entity 100 will then record on the DS data carrier, in our example, the values ​​of binary tree nodes. These binary trees allow us to count the number of packets in the set E whose data sections have a given prefix. The management entity 100 can be deployed at a suitable location to capture a given traffic flow, for example, on a router, a base station, a gateway of a local network, on a mobile terminal, or on any suitable network or computer equipment. The DS data carrier is much more memory-efficient than simply capturing data packets.Management entity 200 can therefore be located remotely from management entity 100 and will read the DS media to extract the representation of set E. Management entity 200 can, for example, be deployed in a co-located manner with a server that performs compression rule training, and the representation read by management entity 200 will then be used for this training.

[0091] In another embodiment, management entities 100 and 200 can be co-located on the same equipment. In this case, the two entities allow, in our example, the implementation of compression rule learning in telecommunications equipment, adapted to the traffic passing through this equipment, and the advantage of the process is the saving of memory space. It is not necessary to save a set E of large data packets (say, several tens of thousands or millions of packets) to perform the learning, but only the information relating to the number of packets that take the same value for a given section.

[0092] Figure 1 shows six data packets PO to P5. These six data packets are sequences of 0 or 1 bits. For example, they could be packets passing through telecommunications equipment, such as a router. In another example, they could be packets received or transmitted by a mobile terminal, a connected object, a connected vehicle, or any other object capable of transmitting or receiving data packets.

[0093] Management entity 100 will obtain a set E of data packets. Module 101 of management entity 100 performs this retrieval. In embodiment examples, all packets passing through the equipment encompassing management entity 100 are concerned and module 101 simply performs a duplication of the passing packets for the following processing of the management process.

[0094] Module 101 can also perform more sophisticated processing. For example, if the equipment encompassing management entity 100 is a router, it may be useful to train the data packets passing through the router that are destined for, or originate from, a particular subnet. In this case, Module 101 will not duplicate all the traffic passing through the router encompassing management entity 100 to form set E, but only those destined for or originating from the subnet in question. Similarly, the training may only aim to compress packets corresponding to the implementation of a given protocol. Here again, Module 101 will perform the appropriate filtering. Furthermore, the training may concern specific time periods if the traffic to be compressed varies significantly between different time periods.Module 101 will create E sets for the different time slots, allowing it to learn compression rules adapted to these different time slots. If management entity 100 belongs to a mobile terminal, module 101 can distinguish between transmitted and received packets. These different criteria for obtaining packets can be modified according to various possible future uses (training, analysis, monitoring, etc.).

[0095] In [Fig. 1], the PO to P5 packets are bit sequences. In other examples, the packets of set E obtained from the PO to P5 packets are symbol sequences that can take more than two values. These may be, for example, symbols corresponding to phase modulations used for wireless data transmissions. In these cases, the symbols used can typically take four, eight, sixteen, thirty-two, or more values. The principles of the invention remain the same in these cases, with a few exceptions that we will detail later.In particular, if the number of symbols that form the sequences of symbols that are the packets of set E is different from 2, the trees used in certain embodiments that represent the number of packets for which a given section has a given sequence as a prefix will no longer be binary trees but trees whose degree is the number of symbols used to form the packets.

[0096] The packets of set E are cut into sections. In the example in [Fig. 1], the captured packets from which set E is obtained are cut into five sections F0 to F4. In embodiments such as in [Fig. 1], the sections cut and cover the total length of the packets of set E, but this is not This is always the case. In other examples, the sections correspond to the header fields of the data packets. In still other examples, only one section is defined, which corresponds to the header of the packets in set E. Module 101 can perform this selection when building set E to ensure that subsequent use, such as learning future compression rules, will focus on the elements that are intended to be compressed. The sectioning to be used can be communicated to management entity 100 to manage set E of packets in a way that is suitable for subsequent use.

[0097] Module 101 will generally provide the packets of set E progressively to module 102, which will then count the packets that have the same value for a given section. In this way, it is not necessary to store all the packets of set E, which represents a saving in memory resources. The packets of set E obtained by module 101 therefore only occupy memory space for the time necessary for their processing by the counting module 102. In some cases, set E is stored in its entirety to allow for different counts to be performed on the same set of packets, for example by changing the sections that divide the packets. This can be adapted to perform different training exercises depending on this division into sections.

[0098] In the example in [Fig. 1], module 102 produces a count resulting in a single tree with values ​​of 6-4-2. Its node values ​​are recorded on the DS storage by management entity 100 and then read by management entity 200 to reconstruct the 6-4-2 binary tree. This example of a binary tree is given for the sake of the figure and does not necessarily correspond to packets PO to P5. The following figures will show how to precisely construct the binary tree in question. Such a tree makes it possible to represent, for a given section, the number of packets in set E that have a given prefix for that section. In general, management entity 100 will record several sequences of values ​​corresponding to several trees on the DS storage. In this way, the prefixes taken by the packets in set E for the different sections will be accurately counted.Other information may be recorded on the data carrier by the management entity 100.

[0099] Module 103 of management entity 100 performs this recording on the DS data carrier by implementing various inventive optimizations presented later.

[0100] In addition to the value sequences corresponding to the binary trees, the management entity 100 can register other data useful for representing set E. For example, the set E of data packets can be chosen by taking only Packets that correspond to a given stack of protocol layers. In this case, all packets in set E will have an identical structure with regard to their headers, which will all have the same fields. Module 103 of management entity 100 can store information about this structure on the data storage medium DS, for example, by giving it a global identifier for the structure and a description of all the fields that will be found in the packets of set E, which will include, for example, the name and length of the field (which are defined by the relevant protocols). For each field, a sequence of node values ​​corresponding to a binary tree will then be associated, allowing the counting of packets for which the field in question takes a given prefix as its value.

[0101] The DS data carrier will then be read by the management entity 200 in order to extract information useful for learning compression rules or for any other use. The DS data carrier can be transmitted if the management entity 200 is not co-located with the management entity 100, for example, if the management entity belongs to a computer server that performs compression rule learning for different telecommunications equipment.

[0102] The invention aims to concisely represent the set E of data packets for various subsequent uses, such as machine learning of compression rules, analysis of packets circulating in a network subjected to a denial-of-service attack, or traffic monitoring, among other possible subsequent uses. In this sense, only the relevant sections will be represented using the methods of the invention in order to maximize memory savings. For example, if the objective is to generate compression rules for the SCHC protocol, which seeks to compress packet headers, the relevant sections will be sections of the packet headers, without taking into account the packet load.Rather than transferring a capture of packets from set E, transferring the data carrier DS is much more memory-efficient, and therefore more energy-efficient throughout the processing chain. The memory savings are also very significant if management entities 100 and 200 are co-located.

[0103] Figure 2, meanwhile, presents examples of packet representation by binary trees.

[0104] In the example in [Fig. 2], set E comprises six packets (here denoted packetO to packetS). Five sections are of interest for learning compression rules and are denoted FieldO to Field4. Alongside these sections, [Fig. 2] shows five binary trees to explain how these trees allow represent the values ​​taken by the packets of set E. Other modes of representation are possible.

[0105] The trees in [Fig. 2] are binary trees, meaning that exactly two edges originate from each node, one edge labeled with 0 and the other with 1. The tree labels are not shown in [Fig. 2]. By convention, for each node, the left edge is labeled with 0 and the right edge with 1. The edge labels are not shown in [Fig. 2], nor in Figures 4 and 5.

[0106] According to the invention, for a given section of a given length, the corresponding tree has a depth equal to the length of the section, and a node of the tree has a value equal to the number of packets for which the section has as a prefix the same sequence of bits as that read on the edges of the path leading to the node from the root.

[0107] This explains why, for all the trees in [Fig. 2], the root node (enclosed in a square) has the value 6. Indeed, the paths leading from root to root are empty paths and therefore correspond to packets prefixed with an empty sequence. This is obviously the case for all six packets in the set shown. In some embodiments, rather than repeating this value for the roots of all the trees corresponding to a section, the number of packets in the set will be recorded on the data storage device DS, and the value of the roots, which corresponds to this number of packets, will not be recorded on DS.

[0108] If we look at the FieldO section, the six packets of set E have the same value for this section, namely the sequence 0110. The corresponding tree reflects this. Starting from the root, we follow the left edge, labeled with zero, and arrive at a node with a value of 6. This means that six packets have a prefix of 0 for this sequence. The right edge from the root, labeled with one, leads to a node with a value of 0. Indeed, no packet in set E begins with 1 for this FieldO section. The subtrees located below nodes with a value of 0 are not represented since all the nodes below them necessarily have a value of 0.

[0109] From this first node, which has a value of 6 below the root, the right edge, corresponding to one, leads to a new node with a value of 6. This corresponds to the six packets in the set that have 01 as a prefix for this section. The path continues to depth 4, corresponding to the length of the section, and defines a single value for the six packets for this section, namely the sequence 0110.

[0110] The advantage of this representation for learning compression rules is easily understood. If the set E is representative of traffic to be compressed, machine learning can deduce from the representation that the packets of the traffic have a high probability of taking the same value of 0110 for This first section. A learned compression rule can then include the deletion of this section, which will be reconstructed upon reception. Other uses will find this type of information highly valuable.

[0111] For the next Fieldl section, which comprises two bits, three packets take the value 00 and three packets the value 01. This translates in the corresponding tree into a root which is 6 (as for all trees) and then into a node below the root, led by the left edge which corresponds to zero, which is 6, representing the six packets of the set whose Fieldl section begins with 0. Below this node, however, the two nodes connected by the edge labeled with zero and the one labeled with one have the same value 3. This corresponds to the three packets for which the Fieldl section is 00 on the one hand, and to the three packets for which the section is 01 on the other.

[0112] The following three trees similarly represent the number of packets prefixed with a given sequence for the corresponding sections. It is noted that all six packets have the same bit sequence for the Field3 section. This field will therefore also be a possible candidate for creating a compression rule that removes this field value, within the context of this subsequent use.

[0113] It can be noted that, by definition of the tree representing the bundles in the set for a given section, the values ​​of the nodes at a given rank are necessarily less than or equal to the value of their parent node. Since the bundles have sections of identical size for all in the set, one can even say that the sum of the values ​​of two nodes originating from the same parent is equal to the value of the parent node.

[0114] Fig. 3, on the other hand, presents bit sequences that allow integer values ​​to be represented.

[0115] The methods according to the invention will write and then read onto a data storage device (DS) integer values ​​corresponding to the values ​​of nodes in trees representing numbers of packets, as seen previously. The integer values ​​are typically represented by bit sequences.

[0116] In computer science, the predefined types intlô and int32 allow the representation of integer values ​​using 16 or 32 bits. Using 16 bits, it is possible to represent up to 65,536 integer values, although the maximum value for the intlô type is 32,767 due to sign representation limitations. However, a training set can easily contain tens or even hundreds of thousands of packets. Therefore, the node values ​​to be written to the DS data storage may require the use of the predefined type int32, i.e., being written using 32 bits.

[0117] Since the objective of the invention is to have a concise representation of the values ​​taken by the packets of the set, certain embodiments of the invention will Use variable-length bit sequences to represent integer values. For this, an important piece of information is that the maximum value a node in a given tree can take is known.

[0118] Indeed, as seen previously, the values ​​found in the root nodes of the trees are at most equal to the number of packets present in the set E. And the maximum value for a given node is by definition the value taken by its parent node.

[0119] It is therefore possible to choose variable-length bit sequences to represent the node values ​​of the trees, taking into account the maximum value that the nodes can take. In some embodiments, which we will see in [Fig. 5], it is necessary to have escape sequences (esc). The chosen escape sequences consist of only 1s. The integer value 15 will therefore not be represented by the sequence 1111, which will serve as the escape sequence, but by the sequence 01111. The same applies to the values ​​7, 3, and 1.

[0120] Finally, the bit sequences shown in the table in [Fig. 3] are the shortest possible sequences. However, the actual sequences will depend on the maximum values ​​that can be taken. If the integer value 4 is to be represented, the table in [Fig. 3] suggests the sequence 100. But if the integer value 4 is to be represented in a context where its maximum value can be 16, the integer value 4 must be represented by a 5-bit sequence to take into account the maximum possible value. The value 4 will then be represented by the sequence 00100.

[0121] Fig. 4, meanwhile, represents an example of implementation of the management process according to the invention.

[0122] In this example, the data packet set E comprises 6 packets (from PO to P5). The packets are, in this example, 4-bit long sequences. More realistically, one can consider that a single section is represented for the six packets, and the example shown in [Fig. 4] will demonstrate how to record the values ​​taken for this section by the six packets of set E. The values ​​taken by other sections would then be represented by other sequences recorded on the same data storage medium DS. Again, in a more realistic example, the number of packets in set E would be in the tens of thousands or even millions. The data storage medium DS is not shown in the figure, which demonstrates how to construct the sequence of values ​​that, in this embodiment, is recorded on the DS.

[0123] The binary tree corresponding to set E is shown in [Fig. 4]. [Fig. 2] shows in more detail how the values ​​written on the nodes allow us to deduce the number of packets having given prefixes. For example, We find on the tree in [Fig.4] that the six packets of set E start with 0. There are two packets with the identical value 0110 (packets P4 and P5) which correspond to the value 2 found at the lowest line of the tree.

[0124] Writing to the DS support by module 103 a sequence of node values ​​representing the tree obtained by module 102 can proceed as follows in an example embodiment.

[0125] The process begins by performing a breadth-first search of the tree to record all the node values. The resulting sequence is the sequence S0. In this embodiment, subtrees located below nodes that take the value 0 are not recorded. Indeed, all the nodes of these subtrees will necessarily take the value 0. It is therefore not necessary to record them; it will be possible to reconstruct their values ​​upon reading.

[0126] The first number in the S0 sequence can be deleted (indicated by a slash). This is because it represents the value of the root node. As seen previously, this value is necessarily the number of packets in the set E. This number of packets can be recorded on the DS data medium and will be used as the root value for all recorded trees. The resulting sequence is the SL sequence.

[0127] In the SI sequence, in this embodiment example, the even numbers in the sequence are omitted. These numbers correspond to the values ​​of the nodes reached by an edge labeled with a 1. These values ​​can be retrieved by knowing only the value of the parent node (or the root for the nodes in the first rank of the tree) and the value of the node accessed by the edge labeled with 0. Indeed, the sum of the two values ​​of the child nodes is equal to the value of the parent node (or the root). In the example in [Fig. 4] we have: 6+0=6; 4+2=6; 2+2=4; 0+2=2, etc. The sequence thus obtained is the S2 sequence.

[0128] The S2 sequence is then transformed into a bit sequence using variable-length sequences to represent the different integer values. We saw in [Fig. 3] how to represent integer values ​​with such variable-length sequences. The length to be chosen for the bit sequence is not determined by the integer value itself, but by the maximum value that the integer can take, to avoid any ambiguity. The resulting bit sequence is the S3 sequence. This is the sequence that will be recorded on the data carrier DS.

[0129] The S3 sequence comprises 16 bits. It is therefore more concise than the explicit representation of the six packets of set E, each 4 bits long, i.e., 24 bits in total. However, it allows us to know the exact number of packets having a given prefix value, which is very relevant information for performing machine learning of compression rules or for other uses. Subsequently, the memory savings are, of course, much greater when the set E of data packets has a more realistic size of several tens of thousands, or even millions of packets, each packet comprising different sections that can total lengths of hundreds of bits. The gains in bandwidth and network resources when the DS data carrier is transmitted to a management entity 200 are also very significant.

[0130] Fig. 5, meanwhile, represents another example of implementation of the management process according to the invention.

[0131] In this example, the packets in set E are not all the same length for the section that will be represented by a tree. Here, packets PO, P2, and P3 have a length of four bits. Packet PI, on the other hand, has a length of three bits and is equal to the sequence 000. Packets P4 and P5 have a length of two bits and are both equal to 01. The undefined bits of packets PI, P4, and P5 are denoted by the letter X in [Fig. 5].

[0132] The resulting tree, which represents the number of packets in set E with given prefixes, is shown alongside set E. The difference compared to the trees previously presented is that the sum of the values ​​of two nodes with the same parent is no longer equal to the value of their parent node. This is because not all packets in set E have the same length. For example, we see that node 2, located at the second position, which corresponds to the two packets P4 and P5 with a value of 01, has two descendants with a value of 0. This is because there are no packets in set E with the same prefix 01 as nodes P4 and P5 that could continue under this tree.

[0133] The method according to the invention cannot, therefore, in this example, assume that the sum of the values ​​of nodes having the same parent will always be equal to the value of the parent. This information allows, in certain examples, for only one value to be written out, since the second value can be found by subtraction.

[0134] The solution presented here is to write ESC escape sequences in sequence S2 when the summed child nodes do not equal the parent node, and then to write the two parent node values. The escape sequence chosen in this example consists of a series of 1s, for the entire variable length of the bit sequence representing integer values. Sequences S2 and S3 in [Fig. 5] illustrate this implementation.

[0135] Another possibility is to record elsewhere on the DS data carrier the locations in the tree, for a given section, where the two values ​​of child nodes of a parent node are recorded, and not just one, because their sum does not give the value of the parent node. This information can then be used in the process information retrieval implemented by management entity 200 to reconstruct the complete information.

[0136] In all the examples presented here, the trees representing numbers of packets are binary trees. This corresponds to the representation of sets of packets that are sequences of bits. The embodiments of the methods according to the invention described here can obviously be adapted to the representation of sets of packets that are sequences of symbols other than bits. For this, the following adaptations must be made: • Suppose that the data packets of set E are sequences of symbols other than bits, and that the symbols used are n in number instead of two like the bits. • The first adaptation of the methods of the invention is that the trees, for given sections, representing the number of packets are no longer binary trees, but n-ary trees. The edges of the trees are then labeled with the n symbols used, to be used in the same way as the edges labeled with 0 and 1 in the binary case. • The second adaptation of the methods of the invention is that, when sequences of values ​​of tree nodes are recorded, it is not only one value out of two that is recorded (those reached by the edges labeled by 0 or by 1), as in the binary case, but n - 1 values ​​out of n. Indeed, it is only possible to deduce a single value from the n - 1 other values ​​and the value of the parent node.

[0137] All the examples of embodiments of the methods according to the invention presented here can be used to represent sets of packets that are not sequences of bits using these two adaptations.

[0138] The tree representation of the set E presented here is particularly efficient, but other representations can be used. For example, lists of values, tables, or databases can be stored on the DS data carrier. The essential point of the invention is that, for many applications, it is not necessary to store the data packets in their entirety, but simply a representation of the number of packets in the set that take the same value for a given section or for parts of that section.

[0139] Finally, it should be noted here that, in this text, the term "module" can refer to a software component, a hardware component, or a set of hardware and software components, a software component itself corresponding to one or more computer programs or subprograms, or more generally to any element of a program capable of implementing a function or a A set of functions as described for the modules in question. Similarly, a hardware component corresponds to any element of a hardware set capable of implementing a function or set of functions for the module in question (integrated circuit, smart card, memory card, etc.).

Claims

Demands

1. Method for managing a set (E) of data packets (PO, P5), the packets being sequences of bits cut into sections (FO, F4), the method comprising the following steps: • Obtaining the set (E) of data packets; • Counting the number of packets in the set (E) that take the same value for a given section; • Recording on a data medium (DS) a data representative of the result of the count.

2. A method for managing a set (E) of data packets (PO, P5) according to claim 1 characterized in that the counting step comprises, for a given section having a given length, obtaining a binary tree with edges labeled by 0 or 1 which has a depth of the length of the section, a node of the tree having the value of the number of packets for which the section has as a prefix the same sequence of bits as that read on the edges of the path which leads to the node from the root and characterized in that the recording step on a data medium (DS) comprises recording the values ​​of nodes of the obtained tree corresponding to the section.

3. Management method according to claim 2 characterized in that the recording of node values ​​forms sequences, a recorded sequence corresponding to a breadth-first traversal of a tree obtained.

4. Management method according to claim 3 characterized in that only the subtrees of the nodes which have a strictly positive value are traversed.

5. Management method according to any one of claims 2 to 4 characterized in that the method comprises recording on the data carrier (DS) the size of the set (E) in a single location in place of the values ​​of the tree roots.

6. Management method according to any one of claims 2 to 5 characterized in that only the values ​​of the tree nodes which are reached by an edge labeled with only one of the labels 0 or 1 are recorded.

7. A management method according to any one of claims 2 to 6, characterized in that a value of a given node is recorded in the form of a variable-length bit sequence that depends on the maximum possible value for a given node, this maximum value being that of the parent node of the given node.

8. A management method according to any one of claims 2 to 7 characterized in that, for a given section having a given length, certain bundles of the set (E) take a lower length value for that section and characterized in that, when the method records node values ​​of the resulting tree for a given depth whose sum is strictly less than the number of bundles in the set, then a predefined escape sequence is recorded followed by the two values ​​of the nodes reached by edges labeled by 0 and by 1.

9. A management method according to any one of claims 2 to 7 characterized in that, for a given section having a given length, certain packets of the set (E) take a lower length value for that section and characterized in that the method records, outside the sequence representing a tree, information enabling the retrieval for which nodes are recorded the two node values ​​reached by edges labeled by 0 and by 1.

10. Management method according to any one of claims 1 to 9 characterized in that the division into sections of the packages of the set (E) corresponds to the division of the headers of the packages into identical fields, the charges of the packages not being taken into account.

11. Management method according to any one of claims 1 to 9 characterized in that the sectioning of the packages of the set (E) comprises only one section which corresponds to the header of the packages, the charges of the packages not being taken into account.

12. Method of obtaining information concerning a set (E) of data packets (PO, P5), the packets being sequences of bits cut into sections (FO, F4), the method comprising, for a given section, reading on a data medium (DS) a data representative of the result of a count followed by obtaining from this data representative the number of packets in the set (E) which take the same value for the given section.

13. Management entity (100) implementing a process for managing a set (E) of data packets (PO, P5), the packets (PO, P5) being sequences of bits cut into sections (FO, F4), the management entity (100) comprising: • A module (101) for obtaining said set (E) of data packets; • A module (102) for counting the number of packets in the set (E) that take the same value for a given section; • A module (103) for recording on a data medium (DS) a data representative of the result of the counting.

14. Telecommunications equipment comprising a management entity (100) according to claim 13.

15. Management entity (200) implementing a method for obtaining information concerning a set (E) of data packets (PO, P5), the packets being sequences of bits divided into sections (F0, F4), the management entity comprising the following modules: • A module (201) for reading from a data medium (DS), for a given section, data representative of the result of a count; • A module (202) for obtaining from this data representative the number of packets in the set (E) which take the same value for the given section.

16. Telecommunications equipment comprising a management entity (200) according to claim 15.

17. Data carrier on which is recorded a computer program comprising a sequence of instructions for implementing the management method according to claim 1 when loaded into and executed by a processor.

18. Data carrier on which is recorded a computer program comprising a sequence of instructions for carrying out the method of obtaining according to claim 12 when loaded into and executed by a processor.

19. Data carrier (DS) on which data representative of the result of a packet count is recorded of a set (E), the packets being sequences of bits cut into sections, which take the same value for a given section.

Images