WO2011073568A1

WO2011073568A1 - Measure of activity between a client and a server site

Info

Publication number: WO2011073568A1
Application number: PCT/FR2010/052718
Authority: WO
Inventors: Jean-Philippe Le Brenn; Olivier Montanuy; Jean Monne
Original assignee: France Telecom
Priority date: 2009-12-17
Filing date: 2010-12-14
Publication date: 2011-06-23
Also published as: EP2514179A1

Abstract

The invention relates to a method for measuring activity between a client entity (20, 22) and at least one site (42, 44) hosted by a server (40) in a communication network, said method including the following steps implemented by a device (30) for measuring activity: a step of obtaining a record of activity of a stream relating to the client entity, said record including a destination address in the communication network, information representing activity between the client entity and the destination address, and a time interval; a step of obtaining for said client entity an association between the destination address and a site name, said association being implemented during said time interval; a step of processing the record of activity, in which the destination address is replaced with said site name. The method is also suitable for determining a measurement of the audience of a site.

Description

MEASUREMENT OF CUSTOMER ACTIVITY WITH A SERVER SITE

The invention lies in the field of audience measurement at a site in communication networks. More specifically, it is later placed in the field of audience measurement of services offered on a packet communication network.

As is known, it is possible to measure an audience by analyzing trace files, these traces being recorded on a server offering a given service. However, this audience measurement can only be relative to this single server.

Furthermore, the patent document US2007 / 0174295 proposes a system for collecting usage data from a panel of clients, in which all the traffic of the panel's clients is routed to a known domain in the Internet network. where it is then forwarded to the original recipient. In the known domain, servers filter the traffic and constitute a database of use of the different customers. However, this system makes it possible to obtain the usage data only for the customers of the panel and can not extend to all the users of a communication network.

One of the aims of the invention is to overcome disadvantages of the state of the art and / or to make improvements.

According to a first aspect, the invention proposes a method for measuring the activity of a client entity with at least one site hosted by a server in a communication network, said method comprising the following steps implemented by a device activity measurement:

a step of obtaining an activity record of a flow relating to the client entity, said record comprising a destination address in the communication network, information representative of an activity between the client entity and the destination address, and a time interval;

a step of obtaining for said client entity an association between the destination address and a site name, this association being implemented during said time interval;

a step of processing the activity record, in which the destination address is replaced by said site name

The invention takes advantage of a collection of activity records made by equipment of the communication network. However, during this collection, only the destination address in the communication network is available. The destination address alone does not discriminate the respective traffic of a plurality of sites hosted by the same server. The association between the destination address and a site name for a given client entity during a certain time interval consolidates the site name information in the activity records. The activity measurement method thus makes it possible to obtain information relating to an audience from a site in an objective and independent manner. It also makes it possible to collect information relating to a plurality of client entities and not to restrict itself to a panel of client entities.

For example, these activity records are of type Netflow or IPFix. In this case, the information representative of an activity of the client entity is a volume in bytes, a number of packets.

According to a particular characteristic, the step of obtaining an association comprises a step of receiving a response sent by a domain name server following an address resolution request of a site name issued by the domain name server. client entity and a timestamp of said response, said response comprising the destination address to be associated.

A response sent by the domain name server following a request from a client entity, once time stamped, makes it possible to determine the time interval during which the association is effective. This makes it possible to obtain in a simple way this association and relative to a specific client entity. From this response and the associated timestamp, it is possible to determine the information representative of an activity of the plurality of client entities, for example the respective volumes of the traffics of this plurality.

According to another particular characteristic, said response further comprising a period of validity of the association, after which the site name and the destination address are no longer associated, said time interval is obtained from the timestamp of the response and said validity period.

The validity period combined with the time stamp thus makes it possible to obtain an end of association time.

According to another particular characteristic, the association between the site name and the destination address is no longer valid following the receipt of another response sent by the domain name server to a new request from the entity. client, said response comprising another site name and the destination address.

When the same client entity issues a new request to a new site, hosted by the same server, the response then includes the same destination address. It is thus necessary to consider the previous association as invalid starting from the new answer.

According to a second aspect, the invention also proposes a device for measuring the activity of a client entity with at least one site hosted by a server in a communication network, comprising:

means for obtaining an activity record of a flow relating to the client entity, said record comprising a destination address in the communication network, a information representative of an activity between the client entity and the destination address, and a time interval;

means for obtaining an association between the destination address and a site name, said association being implemented during said time interval;

means for processing the activity record, in which the destination address is replaced by said site name.

According to a third aspect, the invention also proposes a system for measuring the activity of a client entity with at least one site hosted by a server in a communication network, comprising at least one device for measuring activity such as as described above and a site name obtaining device arranged to collect a response sent by a domain name server to an address resolution request of a site name issued by said client entity and to time stamp the collected answer.

According to a fourth aspect, the invention further provides a program for a device for measuring activity of a client entity, comprising program code instructions for controlling the execution of the steps of the method as described above, when said program is executed by said device and a recording medium readable by a device on which this program is recorded.

The invention will be better understood with the aid of the following description of a particular embodiment of the method of the invention, with reference to the appended drawings in which: FIG. 1 represents a system for measuring activity in its environment according to a particular embodiment of the invention;

FIG. 2 represents the steps of the activity measurement method according to a particular embodiment of the invention;

FIG. 3 represents a device for measuring activity according to a particular embodiment of the invention.

We place ourselves in the following in a network of communication type Internet.

A system 3 for measuring activity is presented in its environment in FIG. 1. Such a system 3 comprises an activity measuring device 30 and a site name obtaining device 32.

Such a device 32 for obtaining site names is placed in association with a server 34 of domain names. The domain name server 34 maps an address in the network to a site name understandable to a user, subsequently referred to as a "clear" site name.

A website is a set of hyper-linked pages put online at a given address. Web sites are increasingly hosted by professional web hosts, these the last grouping on sets or farms of servers a plurality of websites. Thus, at the same address in the communication network can correspond several websites.

Thus, in FIG. 1, as an illustrative example, a first 42 and a second 44 sites are hosted by a hosting server 40. The first site 42 is known to the client entities under the name Sitel. The second site 44 is known to the client entities under the name Site2.

Two client entities 20, 22 are also shown in FIG.

It will be recalled here that when a client entity 20 wishes to access the first site 42, it sends to the domain name server 34 a domain name resolution request or DNS query, for "Domain Name Ssystem" in order to obtain a correspondence between the name of the first site 42 and an address in the network. Such a DNS request is defined by the documents of the IETF, for "Internet Engineering Task Force", RFC 1034 and RFC 1035, and includes the address in the communication network of the client entity 20, or source address, and a clear site name, for example Sitel. The domain name server 34 then transmits a DNS response. This DNS response includes:

- the source ff address and the Sitel site name, as they appear in the DNS query,

an address in the communication network of the server 40 hosting the required site Sitel, in this case the first site 42,

- a duration of validity of the response, denoted TTL, for "Time-To-Live".

As long as the TTL validity period has not expired, the client entity 20 stores the response obtained at its DNS query relative to the first Sitel site and does not transmit a new DNS query relative to it.

If later, the client entity 22 wishes to access the second site 44, it will repeat these steps to obtain the address in the communication network of the second site 44 Site2 name. It is emphasized here that the first 42 and second 44 sites being hosted on the same hosting server 40, the client entity 44 will obtain the same destination IP address.

The device 32 for obtaining site names is placed at the end of the traffic to or from the domain name server 34. It is also possible to place an optical coupler on the link destined for the domain name server. and duplicate to the device 32 for obtaining domain names all the traffic, that is to say the set of requests and DNS responses transiting on the link.

For each domain name server response 34, the site name obtaining device 32 is arranged to create a DNS record. This DNS record includes the data present in the DNS response, namely the source EP address, the searched site name, the DP address that hosts the site, and the TTL validity period. The DNS record also includes a timestamp associated with the DNS response by the site name obtaining device 32. The DNS records are then transmitted to the activity meter 30. They can be transmitted along the water or periodically. In the latter case, the device 32 for obtaining site names comprises means for storing the DNS records.

The traffic sent by the client entities 20, 22 is routed via a packet communication network 1. More specifically, the network 1 comprises routers 10, 12 arranged to route a packet to its destination.

A packet belongs to a stream, characterized by a number of characteristics common to several packets. These characteristics, or identification elements, may be present in different layers of the OSI model for Open Systems Interconnection. They may correspond to the contents of the source and / or destination address fields (layer 3), or any other field in the packet header, including port numbers and a protocol type in the case of TCP segments encapsulated in IP datagrams (layer 4).

Techniques are known that allow routers 10, 12 of the communication network to generate stream descriptions or activity records of a stream. The observation of the traffic can be achieved through the implementation of specific functions directly implemented in the routers 10, 12, as the traffic flows. These activity records of a stream are for example of the Netflow type. It can also be IPFix type activity records for "BP Flow Information Export".

When the router 10, 12 receives a packet to be routed containing, for at least some of the identification elements mentioned above, unknown values, it initiates an activity record by adding to the identification elements of the flow various elements allowing to describe the flow such as:

DPkts, containing the number of packets counted for this stream;

- DOctets, containing the volume in level 3 bytes (OSI layer) in the stream packets;

First and Last, respectively corresponding to the start and end times of the flow.

On receipt of each new packet belonging to an already identified stream, the router 10, 12 updates the parameters DPkts, DOctets and Last of the corresponding activity record.

After a predetermined period of inactivity of the stream, or periodically, the router 10, 12 transmits to the activity measuring device 30 the activity records of the stream. It will be noted at the outset that a stream corresponds to a packet exchange between two machines of a packet communication network whose packets have common characteristics, in particular here common characteristics of origin, destination and service.

Subsequently, we consider the particular case where the flow activity record includes: a source IP address, a source port number, a destination IP address, a destination port number, a number of packets , a volume in bytes, a start time and a moment of end. The number of packets and the volume in bytes are information representative of an activity of the client entity.

We will now describe the steps of the activity measurement method in relation with FIG.

It is placed in an initial state, at the end of a step E0, during which the device

The activity measurement received from the routers 10, 12 has a plurality of traffic activity records relating to the traffic of the client entities 20, 22. Thereafter, an activity record is denoted REC. The activity measuring device 30 has also received from the site name obtaining device 32 a plurality of DNS records during this step E0.

In a first step El obtaining an association, the activity measuring device 30 determines from the plurality of DNS records, for a given client entity of source address @src:

an association between a destination address @dst and a site name, and

an interval of time during which this association is implemented, represented by a start of validity period and an end of validity period.

More specifically, the time interval is determined from the timestamp of the associated DNS record by the site name obtaining device 32 and the TTL validity period. The validity start time corresponds to the time stamp and the end of validity time corresponds to the sum of the time stamp and the TTL validity period.

A Q-DNS quintuplifier is determined and includes the following information:

- source IP address @src,

site name "site",

- destination IP address @dst,

- moment of validity start T _s ,

end of validity period T _e .

To process a new DNS record including a source IP address @srcl, a destination IP address @dstl, a time stamp ti, the activity measurement device 30 checks whether there is a Q-DNSi quintuple including these source IP addresses. srcl and destination @dstl and for which the time interval defined by the validity start time T _s ., - and the end of validity time T _e , i comprises the timestamp information ti. If so, the end of validity T ej is modified in the quintupled Q-DNSj found with the time stamp t _i of the new DNS record being processed. Indeed, such a case occurs when a plurality of sites is hosted on the same server. The association between the site name and the destination address of the DNS quintuplet found is no longer valid after the receipt of the new DNS record being processed, which was created from the response issued by the server. domain name to a new request of the client entity. It is thus necessary to modify the end of validity time of. the DNS record found.

If not, that is, there is no Q-DNS quintuple, including these source IP addresses @srcl and destination @dstl and for which the time interval is defined by the start of validity time T _s , j and the end of validity time T _e , i comprises the time stamping information t |, the activity measuring device 30 processes the new DNS record in the manner previously described.

At the end of this first step El, that is to say once the plurality of DNS records processed, a plurality of Q-DNS quintuplets providing for a given source IP address, one or more associations between a site name and a destination IP address, this association being implemented during a given time interval.

We then consider the particular case of the processing of the activity records relating to the client entity 20.

It is also possible to process all the activity records independently of the client entity.

In a second step E2, the activity measuring device 30 determines whether the activity REC record being processed includes as a destination port number one of the values belonging to the set of values comprising 80 and 8080. If this is not the case, the device 30 performs this second step E2 again with a new activity record.

It is recalled here that certain port values are pre-reserved for services known by 1ΊΑΝΑ, for "Internet Assigned Numbers Authority". These values are between 0 and 1023 (in decimal) and the value 80 corresponds to an "http" type application, for "HyperText Transfer Protocol". Furthermore, the values between 1024 and 49151 are listed by ΓΙΑΝΑ as belonging to given services and the value 8080 corresponds to an application of the type "http Alternate".

In a third step E3, the activity measuring device 30 determines from the REC record of the activity of the stream, the source IP address, the destination IP address and a time slot IT, defined by the start times. First and last end.

In a fourth step E4, the activity measuring device 30 determines from the plurality of quintuplets a Q-DNS quintuple for these source and destination IP addresses, which quintuplet is valid at this time interval IT. Thus, the activity measuring device 30 obtains the site name by reading in the determined quintuplet.

In a fifth step E5 of processing the activity record, the activity measuring device 30 updates the activity activity record REC by replacing the IP address. destination by the name of the site obtained to obtain a RECJP record of activity of the treated stream.

Thus, at the end of this fifth step E5, a REC_P record of processed stream activity comprises a source IP address, a site name, a data volume expressed in a number of packets and a number of bytes, a start time, end time.

The method then returns to the second step E2 to process a new activity record of a stream.

Thus, at the end of these different steps of the method, it is possible to determine for a given website, total volumetry information, sorted volumetric information, a consultation time, etc.

This leverages the collection of DNS responses by the site name obtaining device 32 to obtain consolidated stream activity records. Without the analysis of the DNS responses transmitted by the server 34 of domain names and time stamped, it is not possible to discriminate the respective traffic to sites hosted by a common server and thus to obtain volumetric information per site to from raw activity records.

The implementation is also very simple since it requires only the registration of DNS responses and the collection of stream activity records. It does not require redirection to analysis tools and provides information for all client entities and not a panel. Consequently, an audience measurement determined from these activity measures is also representative of all the client entities and not of a panel.

Examples are given for illustrative purposes in the Appendix. Table 1 illustrates in a condensed manner activity records of an untreated stream. Table 2 illustrates DNS records collected by the site name obtaining device 32. Table 3 illustrates the activity records from Table 2 when processed. It is noted that the destination addresses 1P 18.128.1.18 and 38.01.18.28, present in table 1, were replaced respectively by "www.orange.fr" and "www.google.fr" in table 3 using information from table 2.

The method has been described with implementation of the first step E1 by the activity measuring device 32. It is also possible that this first step of processing the DNS records is implemented by the site name obtaining device 32, the latter then transmitting to the Q-DNS quintuplet activity measuring device 30.

It is also possible that the flow activity records are transmitted to a collection device, this collection device implementing the second selection step E2 activity records for transmitting to activity measurement device 32 only those relating to "http" type traffic.

An activity measuring device 30 will now be described with reference to FIG.

Such a device 30 for measuring the activity of a client entity with at least one site hosted by a server in a communication network comprises:

a module 100 for obtaining an activity record of a stream relating to the client entity, said record comprising a destination address in the communication network, information representative of an activity between the client entity and the destination address, and a time slot;

a module 102 for receiving data from the device 32 for obtaining site names;

a module 104 for determining an association between the destination address and a site name, said association being implemented during said time interval for a client entity;

a module 106 for processing the activity record, in which the destination address in an activity record is replaced by the said site name;

the storage means 108 of the DNS records.

In a particular embodiment, the module 100 for obtaining a record receives the activity records from the routers 10, 12 of the communication network.

In a particular embodiment, the receiving module 102 is arranged to receive from the site name obtaining device 32 a response record to a request sent by a client entity and associated timestamp information. Still, in this particular embodiment, the module 104 for determining an association is arranged to determine from the information received an association for this client entity between a destination address and a site name implemented during a time interval. time. The device 32 for obtaining site names is, for its part, arranged to collect a response sent by a domain name server to an address resolution request of a site name issued by a client entity and for timestamp the answer. The modules 102 and 104 form a module for obtaining an association.

In another particular embodiment, the receiving module 102 is arranged to receive an association for a client entity between a destination address and a site name for a time slot. In this case, the module 102 forms a module for obtaining an association. This association is transmitted from the device 32 for obtaining site names. In this case, the latter comprises a module 104 'for determining an association, represented in dashed lines in FIG. 1, arranged to determine from the response and its time stamp a association for that client entity between a destination address and a site name implemented during a time interval.

Furthermore, in order to determine the association, the module 104 for determining an association in the particular embodiment, or the corresponding module 104 'of the device 32 for obtaining site names in the other particular embodiment are furthermore arranged to take into account a validity period present in the response to determine the association. They are also arranged to modify the end time of the time slot of an association, on receipt of another response sent following a request from the same client entity, this other response comprising another site name and the same destination address.

The modules 100, 102, 104, 106 are arranged to implement the previously described method. These are preferably software modules comprising software instructions for executing the steps of the previously described method implemented by the activity measuring device 30. The invention therefore also relates to:

a program for an activity measuring device, comprising program code instructions for controlling the execution of the steps of the previously described method, when said program is executed by said device;

a recording medium readable by an activity measuring device on which the program is recorded for an activity measuring device.

The software modules can be stored in or transmitted by a data carrier. This may be a hardware storage medium, for example a CD-ROM, a magnetic diskette or a hard disk, or a transmission medium such as an electrical signal, optical or radio, or a telecommunications network.

The invention also relates to a system 3 for measuring the activity of a stream, comprising at least one device 30 for measuring the activity of a stream as described above and at least one device 32 for obtaining site names. , arranged to collect a response sent by a domain name server to an address resolution request of a site name issued by a client entity and to timestamp this response.

Claims

A method of measuring the activity of a client entity (20, 22) at at least one site (42, 44) hosted by a server (40) in a communication network, said method comprising the following steps implemented by a device (30) for measuring activity:

a step (E0) for obtaining an activity record of a stream relating to the client entity, said record comprising a destination address in the communication network, information representative of an activity between the client entity and the destination address, and a time interval;

a step (E1) for obtaining for said client entity an association between the destination address and a site name, said association being implemented during said time interval;

a step (E5) for processing the activity record, in which the destination address is replaced by said site name.

The method of claim 1, wherein the step of obtaining an association comprises:

a step (E0) of receiving a response sent by a server (34) of domain names following an address resolution request of a site name issued by the client entity and a time stamp of said response, said response comprising the destination address to be associated.

The method of claim 2, wherein said response further comprises a period of validity of the association, after which the site name and the destination address are no longer associated, said time interval is obtained from the timestamp of the response and the said period of validity.

The method of claim 2, wherein the association between the site name and the destination address is no longer valid following receipt of another response sent by the domain name server to a new request. of the client entity, said response comprising another site name and the destination address.

A device (30) for measuring the activity of a client entity (20, 22) at at least one site (42, 44) hosted by a server (40) in a communication network, comprising:

means (100) for obtaining an activity record of a flow relating to the client entity, said record comprising a destination address in the communication network, information representative of an activity between the client entity and the destination address, and a time interval; means (102) for obtaining an association between the destination address and a site name, said association being implemented during said time interval;

means (104) for processing the activity record, in which the destination address is replaced by said site name.

6. System (3) for measuring the activity of a client entity (20, 22) at at least one site (42, 44) hosted by a server (40) in a communication network, comprising at least one an activity measuring device (30) according to claim 5 and a site name obtaining device (32) arranged to collect a response sent by a domain name server (34) to a resolution request of address of a site name issued by said client entity and to time stamp the collected response.

A program for a client entity's activity measurement device (30), comprising program code instructions for controlling the execution of the method steps according to claim 1, when said program is executed by said device .

8. Recording medium readable by a device on which the program according to claim 7 is recorded.