Classification of a multi-activity dataset in a telecommunications network

Abstract

The invention relates to a method for classifying a dataset, the method involving: - receiving (211) a dataset comprising a network trace identifying packets exchanged over a telecommunications network by at least one user for a given period of time; - identifying (217) a multi-activity category for the network trace from a predefined set of multi-activity categories by applying a prediction model to at least one feature of the network trace (216) determined from the packets identified in the network trace.

Description

[0001] DESCRIPTION

[0002] Title of the invention: Classification of a multi-activity data set in a telecommunications network

[0003] Technical field

[0004] The invention relates to the field of telecommunications.

[0005] The classification of digital activities on a telecommunications network allows for better knowledge and therefore better management of the network by the operator in charge of its management.

[0006] State of the art

[0007] A user can access a wide area network, such as an IP network, via an access point which can be a home gateway, or a mobile phone such as a "Mobile Hotspot" acting as a network gateway.

[0008] The access point can be accessed via a wireless connection, such as Wi-Fi. A local Wi-Fi network can be created by the access point, allowing domestic devices to communicate with each other, but also to access the IP wide area network, in particular to access services offered by remote service platforms.

[0009] The digital activities that can be implemented from a user terminal are increasingly numerous, and they relate to increasingly varied applications and may involve different types of action on the part of the user. Digital activities include, but are not limited to, chat or instant messaging, telephone calls via VOIP, for "Voice Protocol Over IP", video streaming, access to applications, in particular social network applications such as Facebook™, Instagram™, Youtube™, Twitter™, etc.

[0010] It is useful for a network operator to classify the digital activities implemented by network users and generating data packet flows in the network via access points such as home gateways, in order to facilitate network management, to prioritize certain services, to offer new services or for security purposes.

[0011] For this purpose, classification methods are known in order to:

[0012] - classify a data packet stream as belonging to one application among several predefined applications such as YouTube, Instagram, Facebook, etc. For example, the publication “Real-time encrypted traffic classification via lightweight neural networks”, J. Cheng et al, in Globecom 2020 IEEE Global Communications Conference, pp 1-6, describes a method for such classification. The publication “Mimetic: Mobile encrypted traffic classification using multimodal deep learning”, G. Aceto et al, Computer networks, vol. 165, p. 106944, 2019 describes another method for such classification; - classify packet streams into actions performed within applications, for example “post a tweet on TwitterTM”, “comment on a post on FacebookTM”. The publication

[0013] “Eavesdropping on fine-grained user activities within smartphone apps over encrypted network traffic” B. Saltaformaggio et al, 10th USENIX Workshop on Offensive Technologies (WOOT 16), 2016, describes a method for such action classification. Another method for such action classification is described in “Analyzing android encrypted network traffic to identify user actions”, M. Conti et al, IEEE Transactions on Information Forensics and Security, vol.l 1, no. 1, pp 114-125, 2015;

[0014] - classify the data type of data packets, for example between VOIP voice data, chat data, video streaming data. The publication “Online classification of user activities using machine learning on network traffic”, V. Labayen et al, Computer Networks, vol. 181, p. 107557, 2020, describes a method for such data type classification. The publication “Identification of encrypted traffic through attention mechanism based long short-term memory”, H. Yao et al, IEEE Transactions on Big Data, 2019, describes another method for such data type classification.

[0015] However, these methods are dedicated to the identification of a single digital activity, which implies that the packet flows of several digital activities carried out by the user, either in parallel (at the same time) or alternately, cannot be categorized. However, such situations are increasingly common, particularly when a user has several terminals in a home network, the terminals accessing the same access point being able to be a home gateway. Such terminals can include a TV decoder type STB, for "Set Top Box" in English, a mobile terminal such as a Smartphone or a touch tablet, connected objects, such as a smart watch, etc.

[0016] Thus, there is a need to classify multi-activity data packet sets in a telecommunications network.

[0017] The invention offers a solution which does not have the drawbacks of the state of the art.

[0018] Statement of the invention

[0019] To this end, according to a functional aspect, the invention relates to a method for classifying a data set, comprising a current phase comprising the following steps:

[0020] - reception of a data set comprising at least one network trace, the network trace identifying packets exchanged on a telecommunications network during a given duration;

[0021] - identification of a multi-activity category for the network trace, from a predefined set of multi-activities, by applying the model to at least one characteristic of the network trace determined from the packets identified in the network trace, each multi-activity category identifying an alternating or simultaneous implementation of at least two digital activities. Thus, the extraction of characteristics and their submission to a model makes it possible to identify a multi-activity category for each network trace. The model may in particular be a model resulting from machine learning. It is thus made possible to process multi-activity network traces, unlike the solutions of the prior art which are only adapted to single-activity network traces.

[0022] According to embodiments, the implementation of at least two digital activities identified by each multi-activity category is alternated or simultaneous.

[0023] According to embodiments, the method may further comprise fragmenting the network trace of the dataset into at least one fragment of predetermined duration T, said at least one feature may be extracted from said at least one fragment from the packets identified in said fragment, and a multi-activity category may be predicted for the network trace by applying the model to said at least one feature extracted from said at least one fragment.

[0024] Such fragmentation makes it possible to process fragments of given duration. This makes it possible to analyze several fragments in the same data set, in order to be able to detect periods of multi-activity in particular, and to isolate them. The duration T can be predetermined so as to be short enough to allow identification of multi-activity categories in real time of the data set, but long enough to include a sufficient quantity of information for the model to be able to identify the multi-activity situation.

[0025] Additionally, said at least one fragment can be divided into N samples of equal duration T / N, N being an integer greater than or equal to two, at least one feature can be extracted for each sample from the packets identified in said sample, and the multi-activity category can be identified for the network trace by applying the model to the features extracted from the N samples of said at least one fragment.

[0026] Thus, a fine representation of each segment is allowed, in the form of a time series of characteristics. The accuracy associated with the classification is thus improved. In addition or as a variant, the method may comprise, for each fragment, a verification that said at least one fragment is a multi-activity fragment, and said at least one characteristic may be extracted from said at least one fragment if and only if said at least one fragment is a multi-activity fragment.

[0027] Thus, features are extracted and submitted to the model only for multi-activity fragments, which allows for better management of computing resources and accelerates the classification of the dataset. Indeed, single-activity fragments are thus filtered.

[0028] According to embodiments, said at least one feature extracted from packets may comprise one of the following features or a combination of the following features: - mean, variance, skewness coefficient, sharpness coefficient of packet sizes and sum of packet sizes;

[0029] - mean, variance, asymmetry coefficient, acuity coefficient of packet arrival intervals of the training sample;

[0030] - number of packages.

[0031] Thus, the features are statistics on the size of the packets or on their arrival intervals, which allows to characterize the dataset precisely, and which facilitates its categorization by the model.

[0032] According to embodiments, the method may comprise a preliminary phase of training the model by supervised learning, from a set of training data sets, each training data set being associated in a first database with a label identifying a multi-activity category among the predefined set of multi-activity categories.

[0033] Such supervised learning allows for the automated production of a robust model. In addition, the preliminary training phase can include the following steps:

[0034] - receiving a first training data set comprising at least one training network trace, said first training data set being associated with a first multi-activity category from among the predefined set of multi-activity categories;

[0035] - determining at least one characteristic of the training network trace from packets identified in the training network trace;

[0036] - training the model by comparison between a prediction of a multi-activity category obtained identified from said at least one characteristic of the training network trace and the first multi-activity category associated with the first training data set.

[0037] Thus, by repeating such steps for multiple training datasets associated with different multi-activity categories, it is made possible to obtain a robust prediction model.

[0038] According to embodiments, the model may be trained from one of the following models:

[0039] - a random forest type model;

[0040] - an extreme Grandient Boosting model, or XGBoost;

[0041] - a one-dimensional convolutional neural network, with attention mechanism;

[0042] - a bidirectional long short-term memory cell, BiLSTM, for “Bidirectional Long Short-Term Memory, with attention mechanism;

[0043] - a Transformer type encoder.

[0044] Such models are suitable for implementing classification operations, in particular for processing time series of characteristics. According to a hardware aspect, the invention also relates to a classification device capable of accessing or storing a prediction model of a multi-activity category s from among a predefined set of multi-activity categories, as a function of at least one characteristic received as input to the model, each multi-activity category identifying a situation of alternating or simultaneous implementation of at least two digital activities, the classification device further comprising:

[0045] - a first interface capable of receiving a data set comprising at least one network trace, the network trace identifying packets exchanged on a telecommunications network by at least one user during a given duration;

[0046] - a processor configured to identify a multi-activity category for the network trace by applying the prediction model to at least one characteristic of the network trace determined from the packets identified in the network trace.

[0047] According to another material aspect, the invention relates to a system comprising the defined classification device, and a user terminal capable of implementing at least two digital activities, the data set received by the classification device identifying packets received and / or transmitted by the user terminal.

[0048] According to another material aspect, the invention also relates to a computer program capable of being implemented on a classification device, the program comprising code instructions which, when the program is executed by a processor, carry out the steps of the defined method.

[0049] Such programs can use any programming language. They can be downloaded from a communications network and / or stored on a computer-readable medium.

[0050] According to another material aspect, the invention relates to a data medium on which at least one series of program code instructions has been stored for the execution of the method defined above.

[0051] Brief description of the drawings

[0052] The invention will be better understood on reading the following description, given by way of example and with reference to the appended drawings in which:

[0053] [Fig 1] illustrates a telecommunications system according to embodiments of the invention.

[0054] [Fig 2a] is a diagram illustrating the steps of a training phase of a classification model of a dataset according to embodiments of the invention.

[0055] [Fig 2b] is a diagram illustrating the steps of a method for classifying a dataset according to embodiments of the invention.

[0056] [Fig 3] illustrates a device for classifying a data set according to embodiments of the invention. Description of the embodiments

[0057] [Fig 1] illustrates an exemplary environment for implementing the invention according to embodiments.

[0058] An extended telecommunications network 100, of the IP type, is capable of allowing the exchange of data packets between various network entities which are described in the following.

[0059] Several access points 130.1 to 130.n are represented, n being an integer greater than or equal to two in the example represented in Figure 1. No restriction is attached to the integer n which can be equal to several hundreds, or even several thousands, or even several tens or hundreds of thousands.

[0060] In the environment of Figure 1, the access points 130.1 to 130.n may be home gateways associated with local wireless access networks, such as Wi-Fi networks, 131.1 to 131.n. Thus, user terminals 140.1, 140.2 and 140.n may access digital activity services in the network 100, for example services provided by platforms 121 and 122. Only one terminal has been shown for each access point, but several user terminals may access the network via the same access point. No restrictions are attached to the services provided by the platforms 121 and 122, which may be platforms associated with mobile applications, streaming platforms, or any other service.

[0061] User terminals 140.1, 104.2 and 140.n of local access networks 131.1 to 131.n can access other types of digital activity services, such as VoIP, chat, mailing, file transfer services, etc.

[0062] A first database 111 comprises a set of training datasets, each training dataset in the set comprising at least one multi-activity network trace for a given user or for several given users. Each training dataset is associated with (labeled or tagged with) a multi-activity category, or class, from a set of predefined multi-activity categories.

[0063] There is no restriction on the number of predefined categories, which is any number greater than or equal to 1.

[0064] No restriction is also attached to the multi-activity categories, which can identify dual activity situations, during which a user performs two digital activities at the same time or alternately, i.e., one after the other. The set of predefined categories can thus include the following categories, given by way of example: “video + email”, “chat + email”, “chat + video”, “chat + internet browsing”, “chat + file transfer”, etc. In addition, at least one of the predefined multi-activity categories can correspond to a situation during which a user performs three or more digital activities at the same time or alternately. The set of predefined categories can thus further include at least one of the following categories, given by way of example: “video + email + chat”, “video + internet browsing + email”, etc.

[0065] No restriction is attached to the way in which the first database 111 is constructed, in particular to the way in which the labels / labels identifying the multi-activity category of each dataset were obtained, three distinct examples being detailed below for illustrative purposes with reference to FIG. 2a. No restriction is also attached to the number of training datasets that are stored in the first database 111. In order to allow machine learning of a classification model according to the invention, detailed in the following, the set stored in the first database 111 comprises several hundreds, or even several thousands, or even several tens or hundreds of thousands of training datasets, each training dataset comprising at least one multi-activity training network trace for a given user or for several given users.

[0066] Finally, there are no restrictions on the format of the network traces included in each data set. Network traces generally include one or more of the following information: duration of the network trace, identifier of each packet exchanged, size of each data packet exchanged, date of sending / receiving of each packet exchanged, number of packets in the network trace, a source identifier such as a source port number and a source IP address, a destination identifier, such as a destination port number and a destination IP address. Thus, a network trace corresponds to all the packets exchanged on the network during the performance of a digital activity or several digital activities, over a given time range from or to an access point 130.1 to 130.n of a user. The packets exchanged may be indicated in sequence in the network trace.A dataset may include one or more network traces, for example, all network traces for a given day for traffic that relates to a given user. The user may in particular be identified by a network identifier of their access point 130.1 to 130.n.

[0067] Preferably, the training datasets of the set are varied, that is to say that the set of training datasets comprises a large number of datasets for each of the predefined multi-activity categories, and that within each category, the datasets differ from each other, by the duration of the training network traces, by the users concerned, by the time slots concerned, etc. In addition, a second database 112 may comprise datasets to be identified, each dataset to be identified comprising at least one multi-activity network trace for a given user. Unlike the training datasets of the first database 111, the datasets to be identified of the second database 112 are not associated with labels / tags identifying the multi-activity category of each dataset.The data sets of the second database 112 can be processed by a classification device 110 according to the invention in order to assign them a category from among the set of predefined multi-activity categories.

[0068] The first database 111 and the second database 112 are shown as separate and independent in FIG. 1. Alternatively, the first database 111 and the second database 112 may be one and the same database.

[0069] The classification device 110 is capable of receiving as input a data set comprising at least one multi-activity network trace, and of indicating a multi-activity category corresponding to the received data set. For this purpose, the classification device 110 can store a model for identifying a multi-activity category resulting from machine learning, as will be better understood upon reading the description of FIGS. 2a and 2b which follow.

[0070] Figure 2a is a diagram illustrating the steps of constructing a model for identifying a multi-activity category among several multi-activity categories, according to embodiments of the invention.

[0071] In a step 200, a set of training data sets is obtained. The set of training data sets may come from the first database 111 described previously.

[0072] Three techniques for obtaining such a set of training datasets are described below. These three techniques are given for illustrative purposes, and no restrictions are attached to how to obtain the set of training datasets.

[0073] According to a first technique, the set is obtained by synthesizing training data sets, each multi-activity network trace of a synthesized training data set being obtained from several single-activity network traces, for example by merging several single-activity network traces. In practice, when merging two or more single-activity traces, their packets are grouped / gathered at the level of a single multi-activity trace, for example by taking into account the packet timestamp of the network trace. Databases comprising a large quantity of single-activity network traces are known and accessible. This is particularly the case of the ISCXVPN2016 database, given as an example.

[0074] For example, by synthesizing a first network trace labeled "chat" with a second network trace labeled "streaming", a synthesized multi-activity network trace may be obtained, which is labeled "chat-streaming", and which may be stored as a training dataset in the first database 111.

[0075] According to a second technique, computer scripts can be transmitted to the access points 130.1 to 130.n. Each script, when executed by an access point 130.1 to 130.n, is capable of triggering several digital activities on at least one terminal connected to the access point 130.1 to 130.n. For example, a computer script can trigger a streaming activity and a chat activity, both predefined. A network trace can then be recorded during the execution of the script, by a network entity, for example the network entity in charge of broadcasting the scripts, and the recorded network trace is stored as a training data set in the first database 111, in association with a label corresponding to the multi-activity category triggered by the script, i.e. “chat-streaming”, in the example considered above.Scripts can be passed for each predefined multi-activity category, in order to have training datasets for all predefined categories.

[0076] According to a third technique, instructions are sent to users of the network 100, such as users of the local access networks 131.1 to 131.n, each instruction indicating at least two digital activities and a given time slot, so that the user performs said at least two digital activities in the given time slot. For example, the instruction may indicate to the user to perform a streaming activity and a chat activity during a given time slot. A network trace may then be recorded during the given time slot, by a network entity, for example the network entity in charge of transmitting the instructions, and the recorded network trace is stored as a training data set in the first database 111, in association with a label corresponding to the multi-activity category triggered by the instruction, i.e. “chat-streaming”, in the example considered above.Instructions can be passed for each predefined multi-activity category, in order to have training datasets for all predefined categories.

[0077] All three techniques mentioned above can be implemented alternatively or in a complementary manner.

[0078] In a step 201, a first training data set is obtained from the first database 111.

[0079] In the described embodiment, at a step 202, the classification device 110 fragments each training network trace of the first training data set into at least one training fragment of a determined duration T. For example, the duration T may be predetermined and may correspond to a duration greater than a minimum duration making it possible to identify a fragment as being a multi-activity fragment or not. Depending on the duration of each training network trace of the first training data set, a single or several training fragments may be obtained.

[0080] In a step 203, the classification device 110 determines at least one characteristic of a training fragment, for example the first training fragment obtained, called first training fragment in the following.

[0081] Preferably, several different characteristics of the first training fragment are determined. The first training fragment of duration T can be decomposed into N training samples of equal duration T / N and at least one characteristic can be determined for each training sample. For each training sample, at least one characteristic can be derived from statistical indicators on the size of the data packets identified in the training sample or on their arrival interval, or "interarrival time" in English. For example, at least one characteristic of the training sample, or a combination of characteristics, can be determined from the following characteristics:

[0082] - mean, variance, asymmetry coefficient, acuity coefficient (or “kurtosis” in English) of the packet sizes identified in the training sample and sum of the packet sizes identified in the training sample;

[0083] - mean, variance, asymmetry coefficient, acuity coefficient (or “kurtosis” in English) of the packet arrival intervals identified in the training sample;

[0084] - the number of packets identified in the training sample.

[0085] According to an advantageous embodiment, all of the aforementioned characteristics are determined for each training sample.

[0086] In a step 204, the classification device 110 trains a model by machine learning submitting as input to the model the characteristic(s) determined for the first training fragment, the model being trained to predict the multi-activity category s of the first training fragment, and the output of the model is compared to the label of the first training set to which the first training fragment belongs. The prediction of the multi-activity category of the first training fragment may for example comprise the evaluation of respective probabilities for the different multi-activity categories, and the selection of the multi-activity category having the highest probability.

[0087] The model parameters are then modified based on the result of the comparison between the model output and the label of the first training set. Such a training principle is called supervised learning, is well known and is not detailed further in this description.

[0088] No restrictions are attached to the model that is trained in step 204. The model may notably be chosen from one of the following models:

[0089] - a random forest type model; - an extreme Gradient Boosting model, or XGBoost;

[0090] - a one-dimensional convolutional neural network, with attention mechanism;

[0091] - a bidirectional long short-term memory cell, BiLSTM, for “Bidirectional Long Short-Term Memory, with attention mechanism;

[0092] - a Transformer type encoder.

[0093] In a step 205, the classification device 110 checks whether there remains at least one other training fragment in the first training data set, not having been used to train the model. The other training fragment may be part of the same network trace as the first training fragment previously described, or may come from another network trace of the first training data set. If the first training set comprises at least one other training fragment, steps 202 to 204 are repeated for the other training fragment. If there remains no training fragment in the first training data set, the method proceeds to a step 206.

[0094] In step 206, the classification device 110 checks whether there remains at least one other training data set in the first database 111, which has not been used to train the model. If this is the case, i.e. if there remains at least one other training data set in the first database 111, the method returns to step 201, for implementation of steps 202 to 204 on the other training data set.

[0095] Otherwise, if all the training data sets of the first database 111 have been used to train the model, the method ends at a step 207.

[0096] Alternatively, step 206 may consist of verifying a convergence criterion of the model: the model may be considered to be sufficiently trained, although there remain training data sets in the first database 111 which have not yet been used for training the model, if the classification error rate of the model is lower than a given threshold.

[0097] The steps of Figure 2a have been described as being implemented by the classification device 110. However, the model can be trained by any entity comprising computing capabilities and memory allowing the implementation of the aforementioned steps, then the model is stored in the classification device 110. In order to train the model, such an entity is able to access the first database 111, via the network 100 or via a direct link.

[0098] The identification phase described below with reference to Figure 2b is implemented by the classification device 110 which can be implemented in any network element capable of accessing the network 100. The classification device 110 can thus be implemented in a server, in an access point to the network 100, in a router or even in a user terminal. Alternatively, the classification device 110 is implemented in a hybrid manner between one of the aforementioned network elements and a component of a cloud architecture. Figure 2b is a diagram illustrating the steps of a method for classifying a data set (or identifying a multi-activity category of a data set) comprising at least one network trace identifying data packets exchanged on the network.

[0099] In step 210, the model previously trained in accordance with the construction method of FIG. 2a is stored by the classification device 110. Such storage may be in an internal memory of the classification device 110, or may be stored remotely, in a remote cloud-type server for example, to which the classification device 110 has access. The steps of FIG. 2a may thus be considered as steps of a phase prior to a current phase described with reference to FIG. 2b.

[0100] In step 211, the classification device 110 receives a first data set comprising at least one network trace. As indicated previously, a network trace comprises all the packets exchanged over a time range for the performance of one or more digital activities. Each packet exchanged can be identified by a packet identifier, a packet size, a packet date, a source port and a destination port, a source IP address and a destination IP address.

[0101] The first received data set may be from the second database 112 presented previously, or may be captured in real time on the network 100. Alternatively, the data set may be received from another network entity not shown in FIG. 1.

[0102] In step 212, the classification device 110 fragments each network trace of the first data set into at least one fragment of duration T. For example, as explained previously, the duration T may be predetermined and may correspond to a duration greater than a minimum duration making it possible to identify a fragment as being a multi-activity fragment or not.

[0103] In step 213, a first fragment of duration T thus obtained for a given first trace is evaluated in order to determine whether the first fragment is a multi-activity fragment or not. For example, such a determination may be based on the detection of two different types of packets in the first fragment. If at least two packets of two different types are detected in the first fragment, then the first fragment is considered multi-activity and the method proceeds to step 216.

[0104] Otherwise, if it is evaluated that the first fragment is not multi-activity, the method proceeds to a step 214.

[0105] In step 214, it is determined whether at least one other fragment was obtained in step 212 for the first data set, the other fragment not having yet been evaluated in step 213. The other fragment may be from the same first network trace as the first fragment, or may be from another network trace of the first data set. If at least one other fragment was obtained in step 212 and not evaluated in step 213, then the method returns to step 213 to evaluate whether the other fragment is a multi-activity fragment or not. Otherwise, if all the fragments obtained from the first data set have been evaluated in step 213, the method ends in step 215, until a new data set is received in step 211.

[0106] In step 216, the classification device 110 determines at least one characteristic of the first fragment. Preferably, several different characteristics of the first fragment are determined. The determination of the characteristic, or characteristics, of the first fragment is identical to the determination of the characteristics of the training fragments described with reference to step 203.

[0107] In a step 217, the characteristic, or characteristics thus determined for the first fragment, are submitted to the model resulting from machine learning, for prediction of a multi-activity category. The predicted category is associated with the first network trace comprising the first fragment.

[0108] The method then proceeds to step 214, in order to check whether the dataset includes other fragments that have not been subjected to the steps 213, 216 and 217 described previously. The other fragment may be a fragment of the first network trace or a fragment of a subsequent network trace, in which case steps 213, 216 and 217 are repeated to predict a multi-activity category for the subsequent network trace.

[0109] When all fragments of the first dataset have been processed, the method ends at step 215, each network trace of the first dataset having been associated with a multi-activity category.

[0110] Figure 3 shows the structure of a classification device 110 according to embodiments of the invention.

[0111] The classification device 110 comprises a processor 301 configured to communicate unidirectionally or bidirectionally, via one or more buses or via a direct wired connection, with a memory 302 such as a “Random Access Memory” type memory, RAM, or a “Read Only Memory” type memory, ROM, or any other type of memory (Flash, EEPROM, etc.). Alternatively, the memory 302 comprises several memories of the aforementioned types.

[0112] The memory 302 comprises at least one non-volatile memory in which the data used and / or resulting from the implementation of the steps of the classification method according to the invention described with reference to FIG. 2b are stored, temporarily or permanently.

[0113] In particular, the memory 302 can store the model during the step 210 described previously. The memory 302 can also store methods for determining one or more characteristics of fragments of data sets, as described previously, in the form of software instructions for example.

[0114] The processor 301 is able to execute instructions, stored in the memory 302, for the implementation of steps 211 to 217 of the classification method according to the invention, described with reference to FIG. 2b. Optionally and additionally, the processor 301 is able to execute instructions, stored in the memory 302, for the implementation of steps 200 to 207 of the method for training the model according to the invention, described with reference to FIG. 2a. The classification device 110 comprises a first interface 303 able to receive data sets during the step 211 described above. The first interface 303 may also be able to receive training data sets during step 201 of the method for training the model.

[0115] The classification device 110 further comprises a second interface 304 capable of transmitting the predicted category(ies) for each data set received on the first interface 303.

Claims

CLAIMS 1. Method for classifying a data set, comprising the following steps: - reception (211) of a data set comprising at least one network trace, the network trace identifying packets exchanged on a telecommunications network during a given duration; - identification (217) of a multi-activity category for the network trace, from a predefined set of multi-activities, by applying a prediction model to at least one characteristic of the network trace determined (216) from the packets identified in the network trace, each multi-activity category identifying an implementation of at least two digital activities.

2. Method according to claim 1, further comprising a fragmentation (212) of the network trace of the data set into at least one fragment of predetermined duration T, in which said at least one characteristic is extracted (216) of said at least one fragment from the packets identified in said fragment, and in which the multi-activity category is identified for the network trace by applying the model to said at least one characteristic extracted from said at least one fragment.

3. The method of claim 2, wherein said at least one fragment is divided into N samples of equal duration T / N, N being an integer greater than or equal to two, wherein at least one feature is extracted for each sample from the packets identified in said sample, and wherein the multi-activity category is identified for the network trace by applying the model to the features extracted from the N samples of said at least one fragment.

4. Method according to claim 2 or 3, comprising, for each fragment, a verification (213) that said at least one fragment is a multi-activity fragment, and in which said at least one characteristic is extracted from said at least one fragment if and only if said at least one fragment is a multi-activity fragment.

5. Method according to one of the preceding claims, wherein said at least one characteristic extracted (216) from identified packets comprises one or a combination of the following characteristics: - mean, variance, asymmetry coefficient, acuity coefficient of packet sizes and sum of packet sizes; - mean, variance, asymmetry coefficient, acuity coefficient of arrival intervals of training sample packets; - number of packages.

6. Method according to one of the preceding claims, comprising a preliminary phase (200-207) of training the model by supervised learning, from a set of training data sets, each training data set being associated in a first database (111) with a label identifying a multi-activity category s from the predefined set of multi-activity categories s.

7. Method according to claim 6, in which the preliminary training phase comprises the following steps: - obtaining (201) a first training data set comprising at least one training network trace, said first training data set being associated with a first multi-activity category from among the predefined set of multi-activity categories; - determining (203) at least one characteristic of the training network trace from packets identified in the training network trace; - training (204) the model by comparison between a prediction of a multi-activity category obtained identified from said at least one characteristic of the training network trace and the first multi-activity category associated with the first training data set.

8. Method according to one of the preceding claims, in which the trained model is one of the following models: - a random forest type model; - an eXtreme Gradient Boosting model, or XGBoost; - a one-dimensional convolutional neural network, with attention mechanism; - a bidirectional long short-term memory cell, BiLSTM, for “Bidirectional Long Short-Term Memory, with attention mechanism; - a Transformer type encoder.

9. Classification device (110) capable of accessing or storing a prediction model of a multi-activity category from a predefined set of multi-activity categories, based on at least one characteristic received as input to the model, each multi-activity category identifying an alternating or simultaneous implementation of at least two digital activities, the classification device further comprising: - a first interface (303) capable of receiving a data set comprising at least one network trace, the network trace identifying packets exchanged on a telecommunications network by at least one user for a given period; - a processor (301) configured to identify a multi-activity category s for the network trace by applying the prediction model to at least one characteristic of the network trace determined from the packets identified in the network trace.

10. System comprising a classification device according to claim 9 and a user terminal capable of implementing at least two digital activities, the data set received by the classification device identifying packets received and / or transmitted by the user terminal.

11. A computer program capable of being implemented in a classification device as defined in claim 9, the program comprising code instructions which, when executed by a processor (301), performs the steps of the method defined in one of claims 1 to 8.

12. Computer-readable recording medium on which at least one series of program code instructions is recorded for executing the method according to one of claims 1 to 8.

Images