Generation of multi-activity network traces

Abstract

The invention relates to a method for generating a multi-activity network trace, the method involving generating (305) said at least one multi-activity network trace from at least a first dataset and a second dataset which respectively include at least one first single-activity network trace associated with a first digital activity and at least one second single-activity network trace associated with a second digital activity, the at least one multi-activity network trace identifying first packets of the first single-activity network trace and second packets of the second single-activity network trace.

Description

[0001] DESCRIPTION

[0002] Title of the invention: Generation of multi-activity network traces

[0003] Technical field

[0004] The invention relates to the field of telecommunications networks.

[0005] Monitoring digital activities on a telecommunications network allows for better knowledge and therefore better management of the network by an operator in charge of its management. State of the art

[0006] A user can access a wide area telecommunications network, particularly of the IP type, via an access point which may be a home gateway, and / or a mobile phone of the “Mobile Hotspot” type acting as a network gateway.

[0007] The access point can be accessed via a wireless connection, such as Wi-Fi. A local Wi-Fi network can be created by the access point, allowing domestic devices to communicate with each other, but also to access the IP wide area network, in particular to access services offered by remote service platforms.

[0008] The digital activities that can be implemented from a user terminal are increasingly numerous, and they relate to increasingly varied applications and may involve different types of action on the part of the user. Digital activities include, but are not limited to, chat or instant messaging, telephone calls via VOIP, for "Voice Protocol Over IP", video streaming, access to applications, in particular social network applications such as Facebook™, Instagram™, YouTube™, Twitter™, etc.

[0009] It is useful for a network operator to classify the digital activities implemented by network users and generating data packet flows in the network via access points such as home gateways, in order to facilitate network management, to prioritize certain services, to offer new services or for security purposes.

[0010] For this purpose, classification methods are known in order to:

[0011] - classify a data packet stream as belonging to one application among several predefined applications such as YouTube, Instagram, Facebook, etc. For example, the publication “Real-time encrypted traffic classification via lightweight neural networks”, J. Cheng et al, in Globecom 2020 IEEE Global Communications Conference, pp 1-6, describes a method for such classification. The publication “Mimetic: Mobile encrypted traffic classification using multimodal deep learning”, G. Aceto et al, Computer networks, vol. 165, p. 106944, 2019 describes another method for such classification;

[0012] - classify packet flows into actions performed within applications, for example “post a tweet on TwitterTM”, “comment on a post on FacebookTM”. The publication “Eavesdropping on fine grained user activities within smartphone apps over encrypted network traffic” B. Saltaformaggio et al, 10th USENIX Workshop on Offensive Technologies (WOOT 16), 2016, describes a method for such action classification. The publication “Analyzing android encrypted network traffic to identify user actions”, M. Conti et al, IEEE Transactions on Information Forensics and Security, vol.l 1, no. 1, pp 114-125, 2015, describes another method for such action classification;

[0013] - classify the data type of data packets, for example between VOIP voice data, chat data, video streaming data. The publication “Online classification of user activities using machine learning on network traffic”, V. Labayen et al, Computer Networks, vol. 181, p. 107557, 2020, describes a method for such data type classification. The publication “Identification of encrypted traffic through attention mechanism based long short-term memory”, H. Yao et al, IEEE Transactions on Big Data, 2019, describes another method for such data type classification.

[0014] Such methods most often exploit the availability of large databases comprising single-activity network traces, identifying data packets with their timestamp values, and corresponding to the implementation of a single digital activity by a user over a given period. Such databases are known. For example, the ISCXVPN2016 database comprises such single-activity network traces.

[0015] However, these methods are dedicated to the identification of a single digital activity per packet flow, which implies that packet flows by which a set of several digital activities is carried out by the user, either in parallel (at the same time) or alternately, cannot be detected as such and categorized.

[0016] However, such situations are becoming increasingly common, particularly when a user has multiple terminals in a home network, where the terminals accessing the same access point may be a home gateway. Such terminals may include a TV decoder such as an STB (Set Top Box), a mobile terminal such as a smartphone or a touchscreen tablet, connected objects such as a smartwatch, etc.

[0017] This impossibility is due in particular to the absence of large databases grouping together multi-activity network traces. The absence of such databases makes it difficult or even impossible to create models for categorizing datasets into multi-activity categories.

[0018] There is a need for multi-activity network traces, in particular to be able to train flow classification models, based on sets of rules or derived from machine learning.

[0019] The invention provides a solution which does not have the drawbacks of the prior art. Description of the invention

[0020] To this end, according to a functional aspect, the invention relates to a method for generating at least one multi-activity network trace, the method comprising the generation of said at least one multi-activity network trace from at least one first data set and a second data set respectively comprising at least one first single-activity network trace associated with a first digital activity and at least one second single-activity network trace associated with a second digital activity, said at least one multi-activity network trace identifying first packets of said first single-activity network trace and second packets of said second single-activity network trace.

[0021] Thus, the method according to the invention makes it possible to synthesize multi-activity network traces from single-activity network traces. The multi-activity network trace thus generated represents a situation in which a user performs two digital activities simultaneously or alternately, over a given period. Since databases comprising large sets of single-activity network traces are known, it is thus possible to synthesize a database comprising multi-activity network traces. The multi-activity network traces thus generated make it possible to develop models for recognizing / categorizing digital activities, including in multi-activity situations, for example models derived from machine learning, which allows for better knowledge of the digital activities implemented in a telecommunications network.This makes it possible to plan new services, prioritize certain services, optimize network resources, improve cybersecurity, etc. To this end, the generated multi-activity network trace can be associated with a multi-activity category defined by the first digital activity and by the second digital activity.

[0022] According to embodiments, the generation of said at least one multi-activity network trace can be implemented based on timestamp values ​​of the first packets of said first single-activity network trace and of the second packets of said second single-activity network trace.

[0023] Thus, it is made possible to generate multi-activity network traces by rearranging packets from at least two distinct single-activity network traces.

[0024] According to embodiments, the method may further comprise forming at least one association of single-activity network traces comprising at least some or all of the first single-activity network trace, identifying a first set of first packets among the first packets of the first single-activity network trace, and some or all of the second single-activity network trace, identifying a second set of second packets among the second packets of the second single-activity network trace; said at least one multi-activity network trace is generated from said at least one association, based on the first timestamp values ​​of the first packets of the first set and the second timestamp values ​​of the second packets of the second set, said at least one multi-activity network trace identifying the first packets of the first set and the second packets of the second set.

[0025] Thus, it is made possible to control the size of the generated multi-activity network traces. According to embodiments, the method may comprise a time alignment of the first single-activity network trace and the second single-activity network trace by modifying the timestamp values ​​of the first packets identified in the first single-activity network trace and / or by modifying the timestamp values ​​of the second packets identified in the second single-activity network trace.

[0026] Such a step is implemented before the formation of at least one pair of single-activity network traces. It is thus made possible to synthesize at least one multi-activity network trace from single-activity network traces captured at different times or over different periods. It is thus made possible to generate a large number of multi-activity network traces from single-activity network traces.

[0027] Additionally, the first single-activity network trace and the second single-activity network trace may have different durations, the first single-activity network trace having a duration longer than a duration of the second single-activity network trace, and the temporal alignment may comprise a splitting of the first single-activity network trace into at least a first portion of duration as close as possible to a duration of the second single-activity network trace, and a remainder of a given duration, said at least one association of single-activity network traces may comprise a first association formed by the first portion resulting from the splitting of the first single-activity network trace and by the entire second single-activity network trace, at least one multi-activity network trace may be generated from the first association.

[0028] Thus, the generated multi-activity network trace illustrates a multi-activity situation over its entire duration, not just over a part of the generated multi-activity network trace. It therefore constitutes a better training data for building a model based on a set of flow recognition rules, or for building a flow recognition artificial intelligence model, obtained by machine learning.

[0029] Further in addition, said at least one association of single-activity network traces may comprise a second association formed by the remainder of the first single-activity network trace and by a part of the second single-activity trace having the duration closest possible to the given duration of the remainder, and at least one multi-activity network trace may be generated from the second association.

[0030] Thus, it is possible to generate multiple multi-activity network traces with a single association of single-activity network traces. This makes it possible to build a large database of multi-activity network traces.

[0031] Additionally or alternatively, the first single-activity network trace may have a duration at least twice as long as a duration of the second single-activity network trace, the first single-activity network trace may be split into the first part, the remainder and at least one second part of duration as close as possible to a duration of the second single-activity network trace, the second single-activity network trace may be duplicated into at least one copy, said at least one association of single-activity network traces may comprise at least one other association formed by the second part of the first single-activity network trace and said at least one copy of the second single-activity network trace, and at least one multi-activity network trace may be generated from said at least one other association.

[0032] Thus, the number of multi-activity network traces generated from the same association of single-activity network traces is maximized.

[0033] According to embodiments, according to a first merging technique, the first multi-activity network trace may be generated by ordering the first packets of the first set and the second packets of the second set based solely on the first timestamp values ​​of the first packets of the first set and the second timestamp values ​​of the second packets of the second set.

[0034] It is thus possible to generate a first multi-activity trace which illustrates a situation of simultaneous implementation of the first and second digital activities, also called a “multitasking” situation.

[0035] Additionally or alternatively, according to a second merging technique, the generation of the second multi-activity network trace may comprise the definition of a parameter P identifying a minimum duration for a given activity, and the second multi-activity network trace may comprise at least one alternation of a first subset of first packets of the first set and a second subset of second packets of the second set, each first and second subset having a duration greater than or equal to the minimum duration identified by the parameter P.

[0036] It is thus possible to generate a second multi-activity trace which illustrates a situation of alternating implementation of the first and second digital activities, also called a “task-switching” situation.

[0037] Additionally, the parameter P may be fixed, or may be defined randomly or pseudo-randomly within a predetermined range of values ​​for each first subset and each second subset.

[0038] Thus, the generation of multi-activity network traces is configurable according to the invention. The parameter P can be set to different values ​​for different iterations of the method, which allows for greater variability in the generated multi-activity network traces.

[0039] Additionally or alternatively, the generation of the second multi-activity network trace according to the second fusion technique may further comprise the definition of a parameter D identifying a transition duration between two digital activities, and the second multi-activity network trace may comprise an empty interval between each alternation from a first subset to a second subset or from a second subset to a first subset, the empty interval having a duration defined from the parameter D.

[0040] Thus, the second synthesized multi-activity network trace more faithfully represents a situation in which a user alternates between several digital activities.

[0041] According to embodiments, the method may be iterated after obtaining multiple first and second single-activity data sets, and the multi-activity network traces may be stored in a database.

[0042] It is thus made possible to constitute a large database, which can be used to train data flow classification models, which makes it possible to improve network management, network security, quality of service, or to propose new services. According to a material aspect, the invention relates to a module for generating at least one multi-activity network trace comprising:

[0043] - an interface capable of obtaining at least a first data set comprising at least a first single-activity network trace associated with a first digital activity, and of obtaining at least a second data set comprising at least a second single-activity network trace associated with a second digital activity;

[0044] - a processor configured to generate at least one multi-activity network trace from the first data set and the second data set, said at least one multi-activity network trace identifying first packets of said first single-activity network trace and second packets of said second single-activity network trace.

[0045] According to another material aspect, the invention also relates to a computer program capable of being implemented on a generation module, the program comprising code instructions which, when the program is executed by a processor, carry out the steps of the defined method.

[0046] Such programs can use any programming language. They can be downloaded from a communications network and / or stored on a computer-readable medium.

[0047] According to another material aspect, the invention relates to a data medium on which at least one series of program code instructions has been stored for the execution of the method defined above.

[0048] According to another material aspect, the invention relates to a system comprising a defined generation module, and at least one user terminal capable of transmitting and / or receiving said first packets and / or said second packets.

[0049] Brief description of the drawings

[0050] The invention will be better understood upon reading the following description, given by way of example and with reference to the appended drawings in which: [Fig 1] illustrates an example of an environment for implementing the invention according to embodiments.

[0051] [Fig 2] illustrates a plurality of single-activity datasets, each comprising at least one single-activity network trace.

[0052] [Fig 3] is a method of generating a multi-activity network trace according to embodiments of the invention.

[0053] [Fig 4a] illustrates an alignment of a first single-activity network trace and a second single-activity network trace, selected when implementing a method for generating at least one multi-activity network trace, according to embodiments of the invention.

[0054] [Fig 4b] illustrates a formation of associations of single-activity network traces, when implementing a method for generating at least one multi-activity network trace, according to embodiments of the invention.

[0055] [Fig 5a] illustrates a first multi-activity network trace obtained by a first single-activity network trace fusion technique, according to embodiments of the invention.

[0056] [Fig 5b] illustrates a second multi-activity network trace obtained by a second single-activity network trace fusion technique, according to embodiments of the invention.

[0057] [Fig 6] illustrates a module for generating at least one multi-activity network trace according to embodiments of the invention.

[0058] Description of the embodiments

[0059] [Fig 1] illustrates an exemplary environment for implementing the invention according to embodiments.

[0060] An extended telecommunications network 100, of the IP type, is capable of allowing the exchange of data packets between various network entities which are described in the following.

[0061] Several access points 130.1 to 130.n are represented, n being an integer greater than or equal to two in the example represented in Figure 1. No restriction is attached to the integer n which can be equal to several hundreds, or even several thousands, or even several tens or hundreds of thousands.

[0062] In the environment of Figure 1, the access points 130.1 to 130.n may be home gateways associated with local wireless access networks, such as Wi-Fi networks, 131.1 to 131.n. Thus, user terminals 150.1, 150.2 and 150.n may access digital activity services in the network 100, for example services provided by platforms 121 and 122. Only one terminal has been shown for each access point, but several user terminals may access the network via the same access point. No restriction is attached to the services provided by the platforms 121 and 122, which may be platforms associated with mobile applications, streaming platforms, or any other service.

[0063] User terminals 150.1, 150.2 and 150.n of local access networks 131.1 to 131.n can access other types of digital activity services, such as VoIP, chat, mailing, file transfer services, etc.

[0064] A first database 111 comprises a set of single-activity data sets, each single-activity data set being associated with a digital activity identifier and comprising at least one single-activity network trace identifying data packets exchanged on the telecommunications network by a user of the network during a given period for the implementation of the digital activity.

[0065] In particular, each single-activity data set stored in the first database 111 comprises the single-activity network traces, or the single-activity network trace, of a user for a given digital activity, over a given period. For example, the digital activity may be, but is not limited to, chat or instant messaging, telephone calls via VOIP, for “Voice Protocol Over IP”, video streaming, access to applications, in particular social network applications such as Facebook™, Instagram™, Youtube™, Twitter™, etc.

[0066] Each digital activity implemented by a user over a given period involves the exchange of packets, for example between an access point 130.1-130.n of the user and a platform 121 or 122, generating a network trace which can be recorded by a network entity, for storage in the first database 111, in association with an identifier of the digital activity.

[0067] There are no restrictions on the digital activity identifier stored in association with a single-activity dataset. For example, the digital activity identifier may be chosen from a set of predefined digital activity identifiers, comprising strings that uniquely describe each digital activity: “chat”, “file transfer”, “video streaming”, “audio streaming”, “web browsing”, etc.

[0068] Such a first database 111 grouping single-activity datasets is well known, and no restrictions are attached to the manner in which such a database 111 is constituted. For example, the ISCXVPN2016 database groups together a large number of single-activity datasets comprising single-activity network traces.

[0069] Examples of single-activity datasets stored in the first database 111 are shown with reference to Figure 2, described below. No restriction is attached to the number of digital activities for which single-activity datasets are stored in the first database 111, which is any number greater than or equal to 2.

[0070] No restriction is furthermore attached to the number of single-activity data sets which are stored in the first database 111. Such databases being able to be exploited for machine learning purposes, the set of single-activity data sets stored in the first database 111 may comprise several hundreds, or even several thousands, or even several tens or hundreds of thousands of single-activity training data sets each comprising one or more single-activity training network traces.

[0071] Finally, there are no restrictions on the format of the single-activity network traces that each single-activity dataset includes. Single-activity network traces generally include one or more of the following information: duration of the single-activity network trace, size of each data packet exchanged, date of sending / receiving of each packet exchanged also called timestamp value, number of packets in the single-activity network trace, a source identifier such as a source port number and a source IP address, a destination identifier, such as a destination port number and a destination IP address. Each packet can be identified by the timestamp value and by the size of the packet. Thus, a single-activity network trace corresponds to all the packets exchanged on the network during the performance of a single digital activity over a given time range from or to an access point 130.1 to 130.n of a user.The packets exchanged may be indicated in sequence in the single-activity network trace. A single-activity dataset may comprise one single-activity network trace, or several single-activity network traces, for example all single-activity network traces of a given day for the traffic that concerns a given user. The user may in particular be identified by a network identifier of his access point 130.1 to 130.2.

[0072] Preferably, the single-activity datasets of the set are varied, that is to say that the set of single-activity datasets includes a large number of single-activity datasets for each of the predefined digital activities, and that within each category, the datasets differ from each other, by the duration of the network traces, by the users concerned, by the time slots concerned, etc.

[0073] According to the invention, a second database 112 can be generated by a generation module 110 capable of generating at least one multi-activity network trace from at least two single-activity data sets each comprising a single-activity network trace. The multi-activity network traces thus generated are stored in the second database 112. The generation of multi-activity network traces is detailed with reference to FIG. 3 below.

[0074] Figure 2 illustrates a plurality of single-activity data sets each comprising at least one single-activity network trace, the plurality being able to be stored in the first database 111 described previously.

[0075] Each single-activity data set may correspond to a given digital activity of a given user, or of a set of users using a given access point 130.1-130.n, over a given period T, for example over a given day, and may comprise one or more single-activity network traces for the given digital activity. It will be understood that the first database 111 comprises such pluralities of single-activity data sets for several periods T, for example for several days, and for several users, for several digital activities and / or for several access point identifiers 130.1-130.n.

[0076] The plurality of single-activity datasets of Figure 2 includes a first single-activity dataset 140.1, a second single-activity dataset 140.2, and a third single-activity dataset 140.3.

[0077] In the following, it is considered, for illustrative purposes, that the plurality of single-activity data sets of FIG. 2 concerns the user of the first access point 130.1 for a period T corresponding to a given day.

[0078] The first single-activity data set 140.1 may correspond to a first digital activity, for example video streaming, the second single-activity data set 140.2 may correspond to a second digital activity, for example chat, and the third single-activity data set 140.3 may correspond to a third digital activity, for example file transfer.

[0079] In the example described, the first single-activity data set 140.1 comprises a first network trace 141.10 identifying first packets exchanged over a period of several minutes, or even several hours. The first trace 141.10 may, for example, correspond to the viewing of a film in streaming, over a period of more than one hour, for example. The first single-activity data set 140.1 is thus associated in the first database 111 with the digital activity identifier “video streaming”.

[0080] The second single-activity data set 140.2 comprises several second single-activity network traces 141.20, 141.21, 141.22 and 141.23, each identifying the second data packets exchanged over a shorter period than the first single-activity network trace 141.10, for example over a few seconds or a minute. Each second network trace corresponds to the sending / receiving of messages on an instant messaging service. The second single-activity data set 140.2 is thus associated in the first database 111 with the digital activity identifier “chat”. The second network traces 141.20 to 141.23 may have different or identical durations. The third single-activity data set 140.3 includes a third single-activity network trace 141.30 identifying third data packets exchanged over a shorter period than the first trace 141.10, for example over a few seconds or a few minutes. The third network trace 141.30 corresponds to the reception of data packets when downloading a file, by a protocol such as FTP, for “File Transfer Protocol” in English.

[0081] The third network trace 141.30, although of a duration of the same order of magnitude as the duration of each second single-activity network trace 141.20-141.23, may comprise a number of third packets significantly greater than the number of second packets in each second trace 141.20-141.23. Thus, two single-activity network traces of similar durations may identify significantly different numbers of packets, which may differ by one or more orders of magnitude.

[0082] It will be understood that the single-activity network traces do not necessarily include the packets exchanged, but identify the packets exchanged by one or more of the following information: timestamp value of each packet or timestamp, size of each packet, source port number, destination port number, source IP address, destination IP address. In particular, a packet may be identified by the timestamp value and by the size of the packet. The single-activity network trace may further include the number of packets. Each packet may further correspond to a given index in a single-activity network trace, with consecutively exchanged packets having consecutive indices.

[0083] Figure 3 is a diagram illustrating the steps of a method for generating at least one multi-activity network trace, according to embodiments of the invention.

[0084] The steps of the generation method of Figure 3 can be implemented in the generation module 110 described with reference to Figure 1, which can be integrated into any hardware entity having access to the first database comprising the single-activity data sets. In the following, it is considered that the generation module 110 implements each of the steps of the generation method, for illustrative purposes. The generation module 110 can be a server, a communication terminal or a network access point such as a gateway for example. More generally, the generation module comprises any entity having computing capabilities and a memory allowing the implementation of the steps described in the following.

[0085] In a step 300, the generation module 110 obtains a first single-activity data set associated with a first digital activity, and comprising at least a first single-activity network trace identifying first packets exchanged on the network 100 and corresponding to the first digital activity. In the following, it is considered that the first single-activity data set obtained in step 300 is the first single-activity data set 141.1 illustrated with reference to FIG. 2. However, it will be understood that the first single-activity data set of step 300 is not limited to a first single-activity data set corresponding to a digital activity of the video streaming type.

[0086] The first single-activity data set can be obtained by consulting the first database 111.

[0087] In a step 301, the generation module 110 obtains a second single-activity data set associated with a second digital activity, different from the first digital activity, and comprising at least one second single-activity network trace identifying second packets exchanged on the network 100 and corresponding to the second digital activity. In the following, it is considered that the second single-activity data set obtained in step 301 is the second single-activity data set 141.2 illustrated with reference to FIG. 2. However, it will be understood that the second single-activity data set of step 301 is not limited to a second single-activity data set corresponding to a digital activity of the instant messaging / chat type.

[0088] In a step 302, the generation module 110 selects a first combination of a first single-activity network trace from the first single-activity data set and a second single-activity network trace from the second single-activity data set. In the example considered, the first single-activity data set 140.1 comprises a single first network trace 141.10, so the generation module 110 selects the single first network trace 141.10. On the other hand, the second single-activity data set 140.2 comprises four second network traces 141.20 to 141.23, so four distinct combinations can be obtained with the single first network trace 141.10. The generation module 110 selects one of them, for example the second network trace 141.20 arriving first in the sequence of second network traces 141.20-141.23. The first combination is therefore made up of the first single-activity network trace 141.10 and the second single-activity network trace 141.20.

[0089] In the following, multi-activity network traces are generated from the combination of two single-activity network traces. However, the invention also covers the generation of multi-activity network traces from the combination of three single-activity network traces, or more than three single-activity network traces.

[0090] In a step 303, the generation module 110 aligns the first single-activity network trace 141.10 with the second single-activity network trace 141.20, selected in the first combination. Such an alignment consists of modifying the timestamp of the first packets of the first single-activity trace 141.10 and / or the timestamp of the second packets of the second single-activity network trace 141.20, so that the shortest trace among the first and second single-activity network traces 141.10 and 141.20 is temporally included in the longest single-activity network trace. In this case, the longest single-activity network trace is the first single-activity network trace 141.10. For example, the timestamp values ​​of the first and / or second packets may be modified such that the first single-activity network trace 141.10 and the second single-activity network trace 141.20 start at the same time, i.e. the first packet with the lowest timestamp value of the first selected 141.10 single-activity network trace has the same timestamp value as the second packet with the lowest timestamp value of the second selected 141.20 single-activity network trace.

[0091] Alternatively, the timestamp values ​​of the first and / or second packets may be modified such that the first single-activity network trace 141.10 and the second single-activity network trace 141.20 end at the same time, i.e., the first packet having the highest timestamp value of the first single-activity network trace 141.10 has the same timestamp value as the second packet having the highest timestamp value of the second single-activity network trace.

[0092] Thus, the alignment may include adding a fixed value to the timestamp values ​​of the first packets, or to the timestamp values ​​of the second packets, such that the shorter selected single-activity network trace is temporally included within the longer selected single-activity network trace.

[0093] The result of such an alignment is shown in Figure 4a. In the example of Figure 4a, the alignment allows the first selected single-activity network trace 141.10 to start at the same time as the second selected single-activity network trace 141.20. This example is considered in the following for illustrative purposes only.

[0094] Referring again to Figure 3, in a step 304, the generation module 110 forms at least one association of single-activity network traces from the first network trace 141.10 and the second network trace 141.20 aligned. Preferably, said at least one association of single-activity network traces comprises network traces of the same duration. In the following, for illustration purposes, the associations are pairs, i.e. each association comprises two single-activity network traces. However, an association of single-activity network traces according to the invention may comprise strictly more than two single-activity network traces. It is then made possible to generate multi-activity network traces from more than two single-activity network traces.

[0095] The term "pair" therefore corresponds to the association mentioned above, in the particular embodiment in which each association comprises two single-activity network traces.

[0096] Preferably, several pairs of single-activity network traces are formed by the generation module at step 304.

[0097] In particular, if N is the integer part of the ratio of the duration of the longest single-activity network trace to the duration of the shortest single-activity network trace, N+1 pairs of network traces can be created from the first selected 141.10 network trace and the second selected 141.20 network trace, and aligned.

[0098] Figure 4b illustrates an example of forming associations, including pairs, of single-activity network traces, each pair comprising a single-activity network trace comprising some or all of the first single-activity network trace 141.10 and a network trace comprising some or all of the second single-activity network trace 141.20. Thus, the pair comprises a single-activity network trace identifying a first set of first packets from among the first packets of the first single-activity network trace 141.10, and a single-activity network trace identifying a second set of second packets from among the second packets of the second single-activity network trace 141.20.

[0099] As illustrated in Figure 4b, in order to constitute four pairs, N being equal to three in the example considered, the first single-activity network trace 141.10, which is the longest, is decomposed into four parts, comprising a first part 141.101, a second part

[0100] 141.102, a third part 141.103, of duration equal to the duration of the second single-activity network trace, and a fourth part 141.104 which is a remainder of the first single-activity network trace 141.10 when the first, second and third parts 141.101 to 141.103 have been obtained.

[0101] The first packets identified by the information described above, including timestamp values, are thus distributed between parts 141.101 to 141.103 and the remainder 141.104.

[0102] The second single-activity network trace 141.20 can be duplicated into a first copy 141.20' and a second copy 141.20”.

[0103] The timestamp values ​​of the second packets identified in the first copy 141.20' are incremented so that the first copy 141.20' is aligned with the second part

[0104] 141.102.

[0105] The timestamp values ​​of the second packets identified in the second copy 141.20” are incremented so that the second copy 141.20” is aligned with the third part 141.103.

[0106] A third copy 141.20'” of a portion of the second network trace 141.20 of a duration equal to the remainder 141.104 is created by the generation module 110, and the timestamp values ​​of the packets identified in the third copy 141.20'” are incremented so that the third copy 141.20'” is aligned with the remainder 141.104 of the first single-activity network trace 141.10.

[0107] The following four pairs are thus formed by the generation module 110:

[0108] - a first pair 401.1 of single-activity network traces is formed by the first part 141.101 of the first single-activity network trace 141.10 and by the second single-activity network trace 141.20; - a second pair 401.2 of single-activity network traces is formed by the second part

[0109] 141.102 of the first single-activity network trace 141.10 and by the first copy 141.20' of the second single-activity network trace 141.20;

[0110] - a third pair 401.3 of single-activity network traces is formed by the third part

[0111] 141.103 of the first single-activity network trace 141.10 and by the second copy 141.20” of the second single-activity network trace 141.20;

[0112] - a fourth pair 401.4 of single-activity network traces is formed by the remainder 141.104 of the first single-activity network trace 141.10 and by the third copy 141.20'” of the part of the second network trace 141.20.

[0113] Each of the first copy 141.20' and the second copy 141.20” includes all of the second packets identified by the information indicated previously, including timestamp values, of the second single-activity network trace 141.20.

[0114] Note that according to the invention, the generation module 110 forms at least one of these pairs 401.1 to 401.4. For example, the generation module 110 forms at least the first pair 401.1.

[0115] In the following, the following steps are applied to the first pair 401.1, in order to simplify the disclosure of the invention. However, the following steps are preferably iterated and applied to each pair formed in step 304, so as to increase the number of multi-activity network traces generated by the method according to the invention.

[0116] In a step 305, the generation module generates at least one multi-activity network trace from the first pair 401.1 formed in step 304, the multi-activity network trace identifying the first packets of the first set and the second packets of the second set. The packets thus grouped together identify packets relating to two distinct digital activities, and the network trace generated is therefore indeed a multi-activity network trace. The multi-activity network trace thus generated may further be associated with a multi-activity category, which may identify the first digital activity and the second digital activity. For example, the multi-activity category associated with the multi-activity network trace obtained from the first pair 401.1 is a “video streaming - chat” category.Other multi-activity categories may be predefined, based on at least some of the pairs formed by two different digital activities, such as “audio streaming - chat”, “audio streaming - mail”, “video streaming - mail”, etc. Such an association between a multi-activity network trace and the multi-activity category to which it corresponds makes it easier to exploit the generated data, whether for the purposes of analyzing the quality of service of the network, for security purposes, or for the purposes of identifying data flows, in particular when the associations between multi-activity network traces and multi-activity categories are used as training data for artificial intelligence models constructed by machine learning, in particular by supervised learning. The generation step 305 may comprise merging the single-activity network traces of the first pair 401.1 according to a first fusion technique (described below with reference to FIG. 5a), corresponding to a first fusion step 306.1, to obtain a first multi-activity network trace. The generation step 305 may comprise, alternatively or in a complementary manner, the fusion of the single-activity network traces of the first pair 401.1 according to a second fusion technique (described below with reference to FIG. 5b), corresponding to a second fusion step 306.2, to obtain a second multi-activity network trace.

[0117] As indicated, the merging steps 306.1 and 306.2 may be alternative, that is to say that the generation module 110 may be able to implement one or the other of the two merging techniques, and to obtain one or the other of the first and second multi-activity network traces. According to a variant, the generation module 110 is able to implement the two merging techniques, and selects one or the other according to a determined criterion, for the implementation of the generation step 305, to obtain one or the other of the first and second multi-activity network traces. Still as a variant, preferably, the generation module 110 is able to implement the two merging techniques, and implements them sequentially or in parallel during the generation step 305, so as to obtain the first and second multi-activity network traces from each pair of single-activity network traces resulting from the step 304.This makes it possible to generate more multi-activity network traces, which is particularly advantageous when using multi-activity network traces for supervised learning of artificial intelligence models.

[0118] In a step 307, said at least one multi-activity network trace generated in step 305 may be stored in the second database 112, each multi-activity network trace preferably being stored in association with a multi-activity category from a set of predefined multi-activity categories.

[0119] Other multi-activity network traces can be obtained by iterating the method previously described, following step 307:

[0120] - if other pairs than the first pair 401.1 have been created in step 304, steps 305 and 307 can be repeated for the other pairs, in order to generate other multi-activity network traces;

[0121] - otherwise, and if a combination of a first single-activity network trace of the first single-activity data set and a second single-activity network trace of the second single-activity data set other than the first combination has not yet been selected during step 302 by the generation module 110, the method can be iterated by returning to step 302 for selection of a second combination. In the example described, the second combination can comprise the single first single-activity network trace 141.10 and another second single-activity network trace of the second single-activity data set 140.2, for example the second single-activity network trace 141.21;

[0122] - otherwise, i.e. if all the pairs created in step 304 have been used to generate multi-activity network traces, and if all the combinations of the first and second single-activity network traces of the first and second single-activity data sets 140.1 and 140.2 have been selected in step 302 to generate multi-activity network traces, the method can be iterated by the generation module from step 300, until receiving new first and second single-activity data sets in steps 300 and 301.

[0123] The successive storage of multi-activity network traces in step 307, following several iterations, for example, following several hundreds, several thousands, or even several tens of thousands of iterations, thus makes it possible to constitute a set of multi-activity network traces in the second database 112. Preferably, the method is implemented on first and second single-activity data sets, corresponding to varied first and second activities, so that the second database 112 comprises at least several hundreds, or even several thousands, of multi-activity network traces for each multi-activity category among the set of predefined multi-activity categories. Furthermore, for each multi-activity category, multi-activity network traces with varied durations can be obtained.For example, the variance of the distribution of the durations of the multi-activity network traces for each multi-activity category may be greater than a given threshold. Furthermore, as described previously, multi-activity network traces may be generated from associations of strictly more than two single-activity network traces, for example from triplets or quadruplets formed during step 304, after a combination of more than two single-activity network traces has been selected during step 302. Figure 5a shows a first multi-activity network trace generated during step 306. 1 corresponding to the first technique for merging single-activity network traces of a pair created by the generation module, according to embodiments of the invention. Such a first merging technique is applicable to an association of strictly more than two single-activity network traces created by the generation module.

[0124] According to the invention, the first fusion technique allows the generation of a first multi-activity network trace of a first type, the first type representing a situation of simultaneous implementation of the first digital activity and the second digital activity, also called a “multitasking” situation in English.

[0125] Step 306.1 of the first fusion technique may be based on the logical substeps described below.

[0126] Let trace_l be the single-activity network trace belonging to the first pair 401.1 and coming from the first single-activity network trace 141.10, i.e. the first part 141.101 in the example described previously; Let trace_2 be the single-activity network trace belonging to the first pair 401.1 and coming from the second single-activity network trace 141.20, i.e. the second single-activity network trace 141.20 itself;

[0127] Let index_l be the variable representing the index of the packets identified in trace_l. Thus, trace_l[index_l] denotes the packet with index index_l identified in the single-activity network trace trace_l;

[0128] Let index_2 be the variable representing the index of the packets identified in trace_2. Thus, trace_2[index_2] denotes the packet with index index_2 identified in the single-activity network trace trace_2;

[0129] Let length() be the function representing the length of a trace, in number of indices; length() therefore represents the number of packets identified by a given trace;

[0130] Let date() be a function indicating a date of arrival of a packet, which corresponds to the timestamp value presented previously;

[0131] Let multitasking_trace 1 be the first multi-activity network trace of the first type from step 306.1.

[0132] The variables index_l and index_2 can be initialized to a predetermined initialization value, for example to zero or 1.

[0133] While index_l < length(trace_l) and index_2 < length(trace_2):

[0134] - if date(trace_l[index_l])< date(trace_2[index_2]): add trace_l[index_l] to multitasking_trace 1; increment index_l by 1;

[0135] - otherwise, if date(trace_l[index_l])>date(trace_2[index_2]): add trace_2[index_2] to multitasking_trace 1; increment index_2 by 1;

[0136] - otherwise, if date(trace_l[index_l]) =date(trace_2[index_2]): choose (randomly or according to a given criterion) one of the packets trace_l[index_l] and trace_2[index_2], add the chosen packet to multitasking_tracel, and increment the index of the trace of the chosen packet. Note that in this case, the unchosen packet is added to multitasking_trace 1 in the next iteration.

[0137] Thus, according to the above logic, the first packets from the first part 141.101 of the first single-activity network trace 141.10 and the second packets from the second single-activity network trace 141.20 are ordered only according to their timestamp values ​​in the first multi-activity network trace generated in step 306.1.

[0138] This makes it possible to obtain the first multi-activity trace of the first type.

[0139] Figure 5a illustrates the implementation of the first technique on the first pair 401.1 of single-activity network traces. In Figure 5a, for illustration purposes, the first portion 141.101 of the first single-activity network trace 141.10 comprises four first packets with indices between 1 and 4, and the second single-activity network trace 141.20 comprises three second packets with indices between 1 and 3. The respective timestamp values ​​of the first packets are indicated in a line 502.1 and the respective timestamp values ​​of the second packets are indicated in a line 502.2.

[0140] The first multi-activity network trace 501 is obtained by ordering the first packets and the second packets only according to their respective timestamp values, indicated in a line 502.3, and the first multi-activity network trace 501 thus comprises seven packets, including four first packets and three second packets.

[0141] In the example in Figure 5a, the timestamp values ​​for lines 502.1, 502.2, and 502.3 are expressed in seconds.

[0142] Figure 5b shows a second multi-activity network trace obtained in step 306.2 corresponding to the second technique for merging single-activity network traces of a pair created by the generation module, according to embodiments of the invention. Such a second merging technique is applicable to an association of strictly more than two single-activity network traces created by the generation module.

[0143] According to the invention, the second fusion technique allows the generation of at least one second multi-activity network trace of a second type, the second type representing a situation of alternating implementation of the first digital activity and the second digital activity, also called a “task-switching” situation in English. In an alternating situation, each activity is carried out for a given duration, noted P in the following, and the generation module 110 further takes into account a transition duration D from one digital activity to the other.

[0144] Step 306.2 of the second merging technique may be based on the logical substeps described below.

[0145] Let P be a parameter that defines a duration during which a digital activity is performed before alternating with the other activity. No restriction is attached to the value of P, which can be fixed or can be selected randomly or semi-randomly within a given interval. In the following, P is a fixed value equal to 2 seconds, for illustration purposes.

[0146] Let D be a parameter that defines a transition duration between the two digital activities. No restrictions are attached to the value of D, which can be a fixed value or can be selected randomly or semi-randomly within a given interval. In the following, it is considered, for illustrative purposes, that D is selected randomly within an interval between 0.1 and 0.5 seconds.

[0147] Let trace_l be the single-activity network trace belonging to the first pair 401.1 and coming from the first single-activity network trace 141.10, that is to say the first part 141.101 in the example described previously.

[0148] Let trace_2 be the single-activity network trace belonging to the first pair 401.1 and coming from the second single-activity network trace 141.20, that is to say the second single-activity network trace 141.20 itself.

[0149] Let multitasking_trace2 be the second multi-activity network trace of the second type from step 306.2.

[0150] Let the function sub_trace(P,T) be a function that returns a subtrace of duration P (or of duration closest to P, depending on the packets in trace T) from a single-activity network trace T. Alternatively, sub_trace(P,T) returns the smallest subtrace of the single-activity network trace T whose duration is greater than P.

[0151] As long as trace_l and trace_2 are non-empty, the following steps are implemented:

[0152] - generate a parameter value P. In the example considered here, the parameter P is fixed and equal to 2 seconds;

[0153] - add the packets identified in the subtrace sub_trace(P,trace_l) to multitasking_trace2;

[0154] - delete the subtrace sub_trace(P,trace_l) from trace_l;

[0155] - generate a value of parameter D. In the example considered here, parameter D is randomly selected in the interval [0.1; 0.5];

[0156] - add an empty interval of duration D to multitasking_trace2. Adding such an interval is equivalent to changing the timestamp value of the next added packet to a value equal to the sum of the timestamp value of the last added packet and D;

[0157] - generate a parameter value P. In the example considered, P being fixed, this new generation of P leads to obtaining again a value equal to 2 seconds;

[0158] - add the packets identified in the subtrace sub_trace(P,trace_2) to multitasking_trace2;

[0159] - delete the subtrace sub_trace(P,trace_2) of trace_2;

[0160] - generate a value of parameter D. In the example considered here, parameter D is randomly selected in the interval [0.1; 0.5];

[0161] - add an empty interval of duration D to multitasking_trace2.

[0162] In other words, the second multi-activity trace is obtained by alternating sub-traces, or sets of packets, of given duration P of the two single-activity network traces of the first pair 401. 1, an empty interval of duration D being provided in the second multi-activity trace between two consecutive sub-traces from different single-activity network traces.

[0163] Figure 5b illustrates the implementation of the second technique on the first pair 401.1 of single-activity network traces.

[0164] In Figure 5b, for illustration purposes, the first portion 141.101 of the first single-activity network trace 141.10 comprises five first packets with indices between 1 and 5, and the second single-activity network trace 141.20 comprises four second packets with indices between 1 and 4. The respective timestamp values ​​of the first packets are indicated in a line 512.1 and the respective timestamp values ​​of the second packets are indicated in a line 512.2.

[0165] The second multi-activity network trace 511 is obtained by alternating sub-traces, or sets of packets, of given duration P of the two single-activity network traces of the first pair 401. 1, an empty interval of duration D being provided in the second multi-activity trace between two consecutive sub-traces from different single-activity network traces.

[0166] Thus, a first subtrace comprises the second packets of index 1 to 3 of the second single-activity network trace 141.20, a second subtrace comprises the first packets of index 1 and 2 of the first part 141.101, a third subtrace comprises the second packet of index 4 of the second single-activity network trace 141.20, and a fourth subtrace comprises the first packets of index 3 to 5 of the first part 141.101.

[0167] A 512.3 line shows the packet timestamp values ​​of the subtraces above. The packet timestamp values ​​of a given subtrace are determined by summing:

[0168] - the timestamp value of the last packet of the previous subtrace;

[0169] - the empty interval of duration D determined between the previous subtrace and the given subtrace;

[0170] - the timestamp value initially assigned to the packet, i.e. the timestamp values ​​of lines 512.1 and 512.2.

[0171] The D values ​​of the empty intervals between the subtraces are determined randomly in the interval [0.1-0.5], and the following D values ​​are obtained, as an example:

[0172] - 0.3 seconds for the empty interval between the first subtrace and the second subtrace; - 0.1 seconds for the empty interval between the second subtrace and the third subtrace;

[0173] - 0.5 seconds for the empty interval between the third subtrace and the fourth subtrace.

[0174] In the example in Figure 5b, the timestamp values ​​for lines 512.1, 512.2, and 512.3 are expressed in seconds.

[0175] Figure 6 presents the structure of a generation module 110 of at least one multi-activity network trace, according to embodiments of the invention.

[0176] The generation module 110 comprises a processor 601 configured to communicate unidirectionally or bidirectionally, via one or more buses or via a direct wired connection, with a memory 602 such as a memory of the “Random Access Memory” type, RAM, or a memory of the “Read Only Memory” type, ROM, or any other type of memory (Flash, EEPROM, etc.). Alternatively, the memory 602 comprises several memories of the aforementioned types.

[0177] The memory 602 comprises at least one non-volatile memory in which the data used and / or resulting from the implementation of the steps of the generation method according to the invention described with reference to FIG. 3 are stored, temporarily or permanently.

[0178] In particular, the memory 602 can store the single-activity data sets obtained in steps 300 and 301, the single-activity network traces from these data sets, the single-activity network traces aligned during step 303, the pairs of single-activity network traces from step 304 as well as said at least one multi-activity network trace generated during step 305. The storage of step 307 can however correspond to storage in a memory external to the generation module 110, such as storage in the second database 112 for example. Alternatively, at least one of the databases 111 and 112 is integrated into the memory 602. However, the size of the databases 111 and 112 being preferably very large, of the order of several thousands, or even hundreds of thousands of network traces, storage in databases 111 and 112 external to the generation module 110 is preferable.

[0179] The processor 601 is capable of executing instructions, stored in the memory 602, for implementing the steps of the generation method according to the invention, described with reference to FIG. 3.

[0180] The generation module 110 comprises a first interface 603 capable of receiving single-activity data sets during the steps 300 and 301 described previously. For example, the first interface 603 is capable of querying the first database 111 to obtain the first and second single-activity data sets.

[0181] The generation module 110 further comprises a second interface 604 capable of transmitting the at least one multi-activity network trace generated during step 305, in particular for storage in the second database 112 during step 307.

Claims

CLAIMS 1. A method for generating at least one multi-activity network trace, the method comprising generating (305) said at least one multi-activity network trace (501; 511) from at least one first data set (140.1) and a second data set (140.2) respectively comprising at least one first single-activity network trace (141.10) associated with a first digital activity and at least one second single-activity network trace (141.20-141.23) associated with a second digital activity, said at least one multi-activity network trace identifying first packets of said first single-activity network trace and second packets of said second single-activity network trace.

2. Method according to claim 1, wherein the generation (305) of said at least one multi-activity network trace (501; 511) is implemented as a function of timestamp values ​​of the first packets of said first single-activity network trace (141.10) and of the second packets of said second single-activity network trace (141.20-141.23).

3. The method of claim 1 or 2, further comprising forming (304) at least one association (401.1-401.4) of single-activity network traces comprising at least part or all of the first single-activity network trace, identifying a first set of first packets among the first packets of the first single-activity network trace, and part or all of the second single-activity network trace, identifying a second set of second packets among the second packets of the second single-activity network trace; said at least one multi-activity network trace (501; 511) is generated from said at least one association, based on first timestamp values ​​of the first packets of the first set and second timestamp values ​​of the second packets of the second set, said at least one multi-activity network trace identifying the first packets of the first set and the second packets of the second set.

4. The method of claim 2 or 3, comprising time alignment (303) of the first single-activity network trace (141.10) and the second single-activity network trace (141.20-141.23) by modifying the timestamp values ​​of the first packets identified in the first single-activity network trace and / or by modifying the timestamp values ​​of the second packets identified in the second single-activity network trace.

5. The method of claim 4, wherein the first single-activity network trace (141.10) and the second single-activity network trace (141.20) have different durations, the first trace single-activity network having a duration longer than a duration of the second single-activity network trace, and wherein the temporal alignment (303) comprises a splitting of the first single-activity network trace into at least a first part (141.101) of duration as close as possible to a duration of the second single-activity network trace, and a remainder (141.104) of a given duration, wherein said at least one association (401.1-401.4) of single-activity network traces comprises a first association (401.1) formed at least by the first part resulting from the splitting of the first single-activity network trace and by the whole of the second single-activity network trace, wherein at least one multi-activity network trace is generated (305) from the first association.

6. Method according to claim 5, wherein said at least one association (401.1-401.4) of single-activity network traces comprises a second association (401.4) formed by the remainder (141.104) of the first single-activity network trace (141.10) and by a part (141.20'”) of a copy of the second single-activity trace (141.20-141.23) having the duration closest possible to the given duration of the remainder, wherein at least one multi-activity network trace is generated (305) from the second association.

7. Method according to one of the preceding claims, in which, according to a first fusion technique, the first multi-activity network trace (501) is generated (305) by ordering the first packets of the first set and the second packets of the second set only according to the first timestamp values ​​of the first packets of the first set and the second timestamp values ​​of the second packets of the second set.

8. Method according to one of the preceding claims, in which, according to a second fusion technique, the generation of the second multi-activity network trace (511) comprises the definition of a parameter P identifying a minimum duration for a given activity, and in which the second multi-activity network trace comprises at least one alternation of a first subset of first packets of the first set and a second subset of second packets of the second set, each first and second subset having a duration greater than or equal to the minimum duration identified by the parameter P.

9. Method according to claim 8, in which the parameter P is fixed, or is defined randomly or pseudo-randomly in a predetermined range of values ​​for each first subset and each second subset.

10. The method of claim 8 or 9, wherein generating the second multi-activity network trace (511) according to the second fusion technique further comprises defining a parameter D identifying a transition duration between two digital activities, and wherein the second multi-activity network trace comprises an empty interval between each alternation from a first subset to a second subset or from a second subset to a first subset, the empty interval having a duration defined from the parameter D.

11. Method according to one of the preceding claims, in which the method is iterated after obtaining (300; 301) several first and second single-activity data sets, and in which the multi-activity network traces are stored (307) in a database.

12. Generation module (110) of at least one multi-activity network trace (501; 511) comprising: - an interface (603) capable of obtaining at least a first data set (140.1) comprising at least a first single-activity network trace (141.10) associated with a first digital activity, and of obtaining at least a second data set (140.2) comprising at least a second single-activity network trace (141.20-141.23) associated with a second digital activity; - a processor (601) configured to generate at least one multi-activity network trace (501; 511) from the first data set (140.1) and the second data set (140.2), said at least one multi-activity network trace identifying first packets of said first single-activity network trace and second packets of said second single-activity network trace.

13. A computer program capable of being implemented in a generation module as defined in claim 12, the program comprising code instructions which, when executed by a processor (601), performs the steps of the method defined in one of claims 1 to 11.

14. Computer-readable data carrier on which at least one series of program code instructions has been stored for executing the method according to one of claims 1 to 11.

15. System comprising a generation module according to claim 12, and at least one user terminal (150.1- 150.n) capable of transmitting and / or receiving first packets and / or second packets.

Images