Detection and reporting of keepalive messages for optimization of keepalive traffic in a mobile network

Abstract

Detection of network transactions or keepalives for maintaining long lived connections are disclosed. A keepalive detector can detect keepalive traffic based on keepalive parameters determined from an analysis of socket level network communication log data that record data transfer events including data sent from mobile applications or clients on a mobile device and data received by the mobile applications or clients on the mobile device, timing characteristics, protocol types, etc. Various statistical analyses can be performed on the network communication data to detect keepalives, taking into account variability in intervals of the data transfer events and sizes of data sent and received on each event. The keepalive detector can also detect keepalives from stream data on a mobile device by analyzing socket level communication messages including timing characteristics and amount of data transferred to detect keepalives and report keepalives using a data structure.

What is claimed is: 
     
       1. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:
 using at least a processor and memory for:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from the TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein the one or more network transaction parameters include a regular interval and a regular size, both determined from the patterns of data sent from and received by the mobile application based on the statistical analysis. 
 
 
     
     
       2. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:
 using at least a processor and memory for:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from the TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining a number of times a pattern occurs during a time interval; 
 performing a comparison of the number of times the pattern occurs to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
 
     
     
       3. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:
 using at least a processor and memory for:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from the TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining intervals between occurrences of a pattern; 
 determining a variance of the intervals; 
 performing a comparison of the variance to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
 
     
     
       4. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:
 using at least a processor and memory for:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from the TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining intervals between occurrences of a pattern; 
 determining a median of the intervals; 
 performing a comparison of the median to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
 
     
     
       5. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:
 using at least a processor and memory for:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from the TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 
 determining a number of times a pattern occurs sequentially; 
 performing a comparison of the number of times the pattern occurs sequentially to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
 
     
     
       6. A method of identifying network transactions from a Transport Control Protocol (TCP) stream, comprising:
 using at least a processor and memory for:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from the TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein optimizing in real-time the data sent further comprises: 
 
 minimizing a frequency of keepalive messages. 
 
     
     
       7. The method of  claim 6  wherein the one or more network transaction parameters include similar or repeating content within the patterns of data sent from and received by the mobile application. 
     
     
       8. The method of  claim 6  wherein the patterns of data sent from and received by the mobile application are recorded in a network communication log along with patterns of data sent from and received by other mobile applications on the mobile device. 
     
     
       9. The method of  claim 6  wherein examining patterns of data further comprises:
 storing the one or more network transaction parameters. 
 
     
     
       10. The method of  claim 6  wherein examining, using statistical analysis, patterns of data, further comprises:
 determining intervals between occurrences of a pattern; 
 determining a first quartile and a third quartile based on the determined intervals; 
 determining a difference between the first quartile and the third quartile; 
 determining a variance based on the difference and a median interval; 
 performing a comparison of the variance to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
     
     
       11. The method of  claim 6  wherein the identified network transactions are keepalive messages. 
     
     
       12. A device comprising:
 a communication interface operable to communicatively couple the device to a network; and 
 a processor and a memory storing program codes, coupled to the communication interface, operable to:
 examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determine one or more network transaction parameters based on the examination; 
 identify network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimize in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to: 
 determine a number of times a pattern occurs during a time interval; 
 perform a comparison of the number of times the pattern occurs to a threshold; and 
 based on the comparison, determine whether the pattern has been detected as regular. 
 
 
     
     
       13. A device comprising:
 a communication interface operable to communicatively couple the device to a network; and 
 a processor and a memory storing program codes, coupled to the communication interface, operable to:
 examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determine one or more network transaction parameters based on the examination; 
 identify network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimize in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to: 
 determine intervals between occurrences of a pattern; 
 determine a variance of the intervals; 
 perform a comparison of the variance to a threshold; and 
 based on the comparison, determine whether the pattern has been detected as regular. 
 
 
     
     
       14. A device comprising:
 a communication interface operable to communicatively couple the device to a network; and 
 a processor and a memory storing program codes, coupled to the communication interface, operable to:
 examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determine one or more network transaction parameters based on the examination; 
 identify network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimize in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to:
 determine intervals between occurrences of a pattern; 
 determine a median of the intervals; 
 perform a comparison of the median to a threshold; and 
 based on the comparison, determine whether the pattern has been detected as regular. 
 
 
 
     
     
       15. A device comprising:
 a communication interface operable to communicatively couple the device to a network; and 
 a processor and a memory storing program codes, coupled to the communication interface, operable to:
 examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determine one or more network transaction parameters based on the examination; 
 identify network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimize in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, where in order to examine, using statistical analysis, patterns of data, the device is further operable to: 
 determine a number of times a pattern occurs sequentially; 
 perform a comparison of the number of times the pattern occurs sequentially to a threshold; and 
 based on the comparison, determine whether the pattern has been detected as regular. 
 
 
     
     
       16. A device comprising:
 a communication interface operable to communicatively couple the device to a network; and 
 a processor and a memory storing program codes, coupled to the communication interface, operable to:
 examine, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determine one or more network transaction parameters based on the examination; 
 identify network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimize in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, where in order to optimize in real-time the data sent the device is further operable to: 
 minimize a frequency of keepalive messages. 
 
 
     
     
       17. The device of  claim 16  where in order to examine, using statistical analysis, patterns of data, the device is further operable to:
 determine intervals between occurrences of a pattern; 
 determine a first quartile and a third quartile based on the determined intervals; 
 determine a difference between the first quartile and the third quartile; 
 determine a variance based on the difference and a median interval; 
 perform a comparison of the variance to a threshold; and 
 based on the comparison, determine whether the pattern has been detected as regular. 
 
     
     
       18. The device of  claim 16  wherein the identified network transactions are keepalive messages. 
     
     
       19. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining a number of times a pattern occurs during a time interval; 
 performing a comparison of the number of times the pattern occurs to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
     
     
       20. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining intervals between occurrences of a pattern; 
 determining a variance of the intervals; 
 performing a comparison of the variance to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
     
     
       21. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining intervals between occurrences of a pattern; 
 determining a median of the intervals; 
 performing a comparison of the median to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
     
     
       22. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein examining, using statistical analysis, patterns of data, further comprises: 
 determining a number of times a pattern occurs sequentially; 
 performing a comparison of the number of times the pattern occurs sequentially to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
     
     
       23. A non-transitory computer-readable storage medium containing program instructions to cause a processor to perform a method comprising:
 examining, using statistical analysis, patterns of data sent from and received by a mobile application on a mobile device; 
 determining one or more network transaction parameters based on the examination; 
 identifying network transactions from a TCP stream based on the one or more network transaction parameters; and 
 optimizing in real-time data sent over a mobile network based on the identified network transactions, 
 wherein the network transactions occur over a same TCP session, and 
 wherein the one or more network transaction parameters include content following a certain pattern, wherein optimizing in real-time the data sent further comprises: 
 minimizing a frequency of keepalive messages. 
 
     
     
       24. The non-transitory computer-readable storage medium of  claim 23  wherein examining, using statistical analysis, patterns of data, further comprises:
 determining intervals between occurrences of a pattern; 
 determining a first quartile and a third quartile based on the determined intervals; 
 determining a difference between the first quartile and the third quartile; 
 determining a variance based on the difference and a median interval; 
 performing a comparison of the variance to a threshold; and 
 based on the comparison, determining whether the pattern has been detected as regular. 
 
     
     
       25. The non-transitory computer-readable storage medium of  claim 23  wherein the identified network transactions are keepalive messages.