ENABLING APPLICATION-CENTRIC MOBILE NETWORKS Enabling Application-Centric Mobile Networks Top 10 Checklist for Sourcing DPI www.ipoque.com
CONTENTS THE OPPORTUNITY 3 ENABLING APPLICATION RECOGNITION 3 MOBILE NETWORK USE CASES: REVENUE AND COST-SAVINGS BENEFITS 4 DECISION TIME: MAKE OR BUY DPI? 9 TOP 10 CHECKLIST FOR SOURCING DPI 9 www.ipoque.com 2
THE OPPORTUNITY Demand for embedded application-aware network solutions is coming primarily from mobile operators as new applications and services are hitting the network daily with widely varying traffic patterns and bandwidth needs. Revenue is lagging, traffic is growing, and users are increasingly demanding a consistently high quality of service regardless of where they are or what device they are using. Video as a percentage of total network traffic continues to rise, and the exponential growth in data traffic isn t about to slow anytime soon; operators can t afford to match this growth with spending on new transport. These problems can be addressed by implementing application awareness or recognition, which enables the mobile network to understand the characteristics and the behavior of the applications running over it. With application recognition, mobile operators can not only better manage and monitor the traffic flowing on their networks using techniques such as video optimization and caching, it also allows better monetization of that traffic by supporting new service and pricing models. ENABLING APPLICATION RECOGNITION Enabling accurate application identification requires technology with the intelligence to do more than just a high level view of the data packets traversing the network. Deep packet inspection (DPI) provides that visibility by analyzing up to Layer 7 of the packet, providing finer control and more granular application identification than when classification is based only on header information. This requires maintaining a software library of protocols and applications and understanding patterns and behaviors for every new app and version, otherwise a packet can easily be incorrectly classified. DPI can also extract metadata and application attributes from the network traffic to determine application performance and quality of service for VoIP and video, as well as to protect against network security threats. www.ipoque.com 3
BENEFITS OF APPLICATION RECOGNITION IN MOBILE NETWORKS DEEP PACKET INSPECTION SUMMARY: a key technology to manage mobile networks CONTROL DIFFERENTIATE MONITOR SECURE Policy & QoS User / traffic control Caching & redirection Service / content based charging Application control Network usage Service usage User behavior QoS assurance worm / spam / botnet detection Intrusion detection Parental control Once application classification data is extracted, it can be used for a wide range of use cases, including the following: CONTROL Policy Control and Charging Mobile data usage is soaring across a diverse range of applications and dynamic control over Quality of Service (QoS) and charging is helping mobile operators to monetize their LTE investments. It could be the up-and-coming mobile network operator that wants to set itself apart from the well-established competition with progressive and creative charging models and services or the global player that wants to monetize OTT traffic and use network capacity as efficiently as possible to deliver the best quality of experience to its customers. Network operations and engineering teams can manage bandwidth and QoS with policy control but there is a growing need for the commercial, product management and customer service and billing teams to innovate with new services and charging models. Subscriber behavior details based on actual protocol and application usage can be collected in order to be able to report on and monitor usage and bill by application or bandwidth used. Granular control of service quality and a deep understanding of exactly what applications are being used and how is critical for operators to establish new business models and satisfy customers. Mobile operators such as Aircel in India are getting creative by offering free access to Facebook data packages to attract loyalty of young customers in a fiercely competitive mobile market. Another approach could be to enable partners to sponsor a specific QoS or bandwidth for the dedicated download of content. This can also be tied into a payment channel used for the purchase of the www.ipoque.com 4
content. One example would be that if a customer buys a video at a content portal, the better QoS for viewing the video is sponsored by the content owner. Or if the customer pays with the mobile operator s account, higher bandwidth is automatically included in the purchase. Revenue-generating benefits Tap the revenue potential of OTT video usage and monetize this activity with flexible pricing models, including zero-rated plans. Policy-based traffic management optimizes the streaming video experience for paying subscribers. Enable personalized subscriber plans based on application categories, individual applications, or even specific content or websites. Deliver multi-device or family service plans that aggregate bandwidth quotas across multiple devices and/or users. Detect and block unauthorized device tethering in the mobile network, while monetizing and managing authorized tethering plans. Apply user-aware policies to allocate bandwidth intelligently e.g. deliver a higher level of service to power users or enterprise users. Detect VoIP and video traffic and offer QoS metrics to VoIP and video providers to offer premium services or guaranteed QoS. MONITOR Performance Monitoring and Troubleshooting Network operations teams use DPI to determine the cause of service or network quality degradation or bandwidth congestion since DPI can identify specific applications and key performance indicators (KPIs) causing congestion, such as HD video streaming. It is also possible to drill down to a particular subscriber or base station. According to Ericsson s 2013 ConsumerLab study of smart phone users, network performance (19%) was determined to be the main driver of loyalty to mobile operators, followed by value for money (16%). Addressing network performance has twice the impact on customer loyalty compared to measures such as improving customer support. This can have a real impact on costs since subscriber acquisition and retention costs form the single largest OPEX element for most mobile operators. DPI-enabled troubleshooting solutions allow operators to pinpoint subscribers experiencing poor service quality and precisely identify the network failure root cause, linked to radio coverage, network capacity, handovers, subscriber rights and/or handset settings. Real-time monitoring and troubleshooting solutions empower network supervision teams with real-time fault detection to trigger alarms based on customer-centric quality indicators and on KPI trend analysis. This in turn can be used to improve the operator s end-to-end business performance including the network, service quality and subscriber satisfaction. www.ipoque.com 5
Cost Saving benefits Effectively manage mobile network congestion at peak times and locations by prioritizing network traffic based on volume and QoS for each application. Efficient CapEx spending based on analysis of site performance, and network traffic congestion. Improving network performance improves customer satisfaction and loyalty, which can reduce subscriber acquisition and retention costs, which can be over 60% of a mobile operator s OpEx budget. DIFFERENTIATE Analytics Gaining business intelligence from network and subscriber data is a fast growing area as mobile operators recognize they can unlock value by better understanding usage and behavior. This in turn is being used by marketing and product managers to enhance data packages as well as by network planning and optimization departments to plan investment and improve QoE per application. How key groups within mobile operator are effectively using analytics data: Operations & Engineering: optimize mobile network and forecast capacity according to traffic evolution KPI Monitoring/Auditing team: responsible for key performance indicator (KPI) monitoring and use analytics to deliver customize reports based on KPIs for different teams Customer Service: investigate customer complaints, ensure customer satisfaction and identify subscribers at risk of churning Marketing & Commercial: segment subscriber base according to their usage & ARPU Cost saving and Revenue-generating Benefits Achieve granular insight into mobile network usage for better business planning. View and analyze network activity down to application, device, location, and subscriber. Monitor high-value customer QoE and SLAs. Predict customer churn using key quality indicators linked with length of contract duration and launch marketing retention campaigns. Ensure successful marketing campaigns by adapting tariff plans based on subscriber usage, most relevant devices, services and apps per plan. CONTROL DIFFERENTIATE Traffic Steering (QoS and QoE) The integration of DPI allows prompt identification of applications associated with every network flow including carrier services such as VoIP and video, file transfer within complex apps and Over The Top (OTT) services such as You Tube, Netflix, Hulu, Skype, Viber, WhatsApp, Tango, Facebook, Twitter, and LinkedIn. This in turn enables applicationaware and subscriber-aware traffic steering. To mitigate problems with congested LTE networks, network engineering and operations teams must be smarter about their traffic management so that they can provide a greater, more consistent quality of service for their subscribers. www.ipoque.com 6
Network engineering teams are seeking ways to balance data traffic between mobile networks and Wi-Fi access in a way that s transparent to users and reduces mobile network congestion. The key to success is not simply offloading traffic from the cellular network onto Wi-Fi, but to steer traffic in a managed way between the two technologies to always deliver the best customer experience. Cost saving and Revenue-generating Benefits Manage network usage more effectively to maintain QoS under varying traffic loads. Track usage patterns in detail, identifying subscribers, devices, locations, and times associated with high bandwidth consumption. Then can apply volume-based shaping to manage traffic peaks and optimize bandwidth availability. Redirect service-related traffic in a selective, intelligent way to better manage bandwidth and application performance. CONTROL DIFFERENTIATE Mobile Video optimization This involves better management of video content, including identifying video traffic and routing certain services through content delivery networks as a way to reduce network loads, or doing media caching in which frequently accessed applications and content are stored closer to the subscriber. Network engineering and operations, as well as commercial teams, are all looking for ways to optimize video and manage OTT content such as YouTube and Facebook traffic. Application-aware video optimization systems can include video analytics solutions that can ensure a good viewing experience by preventing stalls and buffering delays. Revenue-generating and Cost-saving benefits Allows operators to optimize video content to control the delivery and enhance quality of service (QoS) and quality of experience (QoE). Reduce bandwidth consumption by 30-50% on expensive RAN and backhaul capacity, and thereby avoid or delay network expansion and capex outlay. Lower operational expenses by reducing wasted bandwidth while providing the same perceived quality of experience. Ensure a consistently great video experience by preventing stalls and buffering delays that affect customer satisfaction and loyalty. Create new revenue opportunities through mobile data service packages designed especially for high-volume video consumers. Gain insight on consumer behavior through detailed information of video usage. MONITOR CONTROL WiFi Off-load Network operations teams have previously focused on traffic and congestion management to deal with new data-centric and mobile video applications, but mobile data offload has the potential to solve the problem of lower priority (low revenue) traffic clogging up the network. If used strategically it can lead to a better delivery of quality services to the user. Mobile data offload solutions typically treat all traffic flows equally without distinguishing the application involved or the device used. However, in LTE www.ipoque.com 7
deployments, carriers will need to selectively steer traffic flows based on the application used e.g. in order to ensure QoS on latency-sensitive VoIP and video services. In order to implement differentiated flow steering, mobile data offload solution vendors need a reliable application detection technology relying on DPI. Mobile Internet offload, if done correctly, can enable new and better end-user services, such as better indoor coverage with femtocells, enhanced performance for rich media services over WiFi, or the ability to support larger monthly data quotas at lower prices using offload gateways. Operators still would like to maintain some control on what applications they would want to use the WiFi networks for (e.g., Apple FaceTime) and which ones should use the cellular networks (e.g., voice). In the case of video, some mobile network operators manage video as an application, creating policy that moves (non-premium) video to WiFi. Many operators with a premium video service will often make an attempt to keep premium content on cellular to guarantee service while using existing subscriber management and billing systems. In addition, operators would like this decision to be dynamic, based on network load conditions, location of the consumer, time of day, etc. The policy based control mechanism is on a per device basis that is application aware. The control criteria can be based on numerous parameters, such as applications, billing plans, traffic priority, device types, device locations, network types, different home or roaming policies, and real-time network traffic conditions. Cost-saving Benefits WiFi and small cells can reduce by up to two-thirds the per-bit cost of carrying mobile traffic, compared to macro cellular networks. Offload data traffic in high usage areas, reducing the need for additional capacity in cellular networks. SECURE DIFFERENTIATE Mobile Network Security Security is a growing concern among network operations and engineering teams given the vast number of devices, apps and content on the network. DPI can enable a wide variety of malware detection techniques, content security, parental controls, anti-virus and intrusion detection/prevention. Rogue applications can prove problematic as they can create vulnerabilities within the network or pose as malware exploiting vulnerabilities in the guise of a legitimate application. Software applications particularly video are generating significant increases in mobile network traffic. They are also becoming the preferred vehicle for delivering malware to subscribers, either by exploiting unpatched vulnerabilities in the application itself or being carried into the network through applications downloaded from the Web. Infrastructure vendors are also working to correct the security vulnerabilities in their own RAN, switching, router, and transmission equipment, as well as introduce new security features, based on DPI, into their portfolios. www.ipoque.com 8
Protection and Revenue-generating Benefits Detect and mitigate network threats quickly, before they impact QoS. Monitor network traffic in a granular way to pinpoint potential malware, viruses and other threats. It alerts threat mitigation systems proactively and blocks suspect traffic, quarantining devices or subscribers exhibiting prohibited behavior. Enable new services for subscribers including parental controls, device monitoring and management and loss and theft protection. Combine a mobile security app, which prevents malicious apps from being installed, with network-based malware detection and subscriber alerts to offer complete protection to subscribers. Generate new and recurring revenues by offering value-added, mobile security services to subscribers for a monthly fee or bundled to up-sell other services. DECISION TIME: MAKE OR BUY DPI As mobile operators increasingly seek to improve the user experience by making their networks application-aware and adaptive, there is a corresponding opportunity for equipment and solution suppliers to provide offerings that enable them; this, in turn, is driving demand for embedded DPI. Even after establishing the need for adding application recognition using a DPI solution, vendors face a key make or buy decision: develop DPI in-house vs. integrating third party DPI. A key factor in the decision is the cost of using internal engineering costs compared to sourcing DPI software licenses. The latter is becoming popular as vendors increasingly choose to focus on enhancing their core technology and relying on best of breed partners to add feature benefits, thereby speeding up time to market. A key consideration with DPI is that developing the software is one thing but it s the ongoing updates required to ensure accuracy and latest detection of new apps and versions of apps as well as encrypted apps that add up in terms of maintenance and resource costs and complexity. Licensing fees are a small fraction of necessary R&D and include signature plug-ins and maintenance. TOP 10 CHECKLIST FOR SOURCING DPI: High Detection Rate Performance and Efficiency Accuracy Identifying Encrypted Apps Ease of integration Metadata Extraction Frequency of updates Global application visibility Flexibility In-house engineers and developers www.ipoque.com 9
1. High Detection Rate This involves supporting a wide range of protocols and applications to ensure that as much of the network traffic as possible is detected. Reliable DPI software should be able to detect over 95% of traffic in mobile networks. This is achieved through maintaining a software library of the latest and newest applications and protocols along with frequent updates of versions and new apps to ensure ongoing reliable detection. Before selecting a partner, in-house engineers will typically carry out performance tests based on real traffic data to determine application detection rates. 2. Performance and Efficiency DPI software is made to inspect packets at high wire speeds and a critical factor is the throughput and resources required. Keeping the amount of resources that integrated DPI and application classification technology requires low is critical. The fewer cores (on a multi-core processor) and the less on-board memory an engine needs, the better. Multithreading provides almost linear scalability on multi-core systems. In addition, highlyoptimized flow tracking is required for handling millions of concurrent mobile subscribers. 3. Accuracy It is critical for certain use cases such as policy control and charging that applications are not identified incorrectly, known as false positives. In addition, traffic management and policy control requires a very low false negative rate i.e. low classification rate of applications. Advanced DPI techniques can reliably detect network protocols, even if they use advanced obfuscation and encryption techniques. Applications can also be grouped into service types e.g. video, P2P, VoIP, IM, making it easier to analyze and enable intelligent traffic decisions rather than individual protocols. 4. Identifying Encrypted Apps It has become harder to identify applications with as many as one in four protocols and applications now being encrypted e.g. Skype, WhatsApp, BitTorrent, Facebook, Twitter, Dropbox, Gmail, Office365, Instagram etc. In addition, some protocols e.g. Skype and other P2P apps, can adapt to circumvent firewalls and DPI detection when for example traffic for a specific protocol is limited or blocked. Advanced DPI uses a variety of detection techniques including finite state machine, byte pattern matching and behavioral analysis to accurately identify applications. 5. Ease of integration This is a key selection criteria since DPI software needs to be integrated into a vendor s existing hardware or software environment, e.g. does the software run in any Unix (e.g. Linux, BSD, Mac OS, Solaris etc.) and Windows environment, and include both C and Java APIs. In addition, it s important that thorough documentation is provided including fully documented APIs and code samples. Typically, DPI software is sold as an SDK, with integration requiring just a couple of API calls. In addition, some providers offer network traffic test tools, which double-checks the validity of an integration and provides a deeper understanding for use cases. www.ipoque.com 10
6. Metadata Extraction DPI software offers the option to extract metadata on applications for performance KPIs e.g. voice and video over LTE or details on application attributes for network security reasons. This can include: Subtype detection of application clients such as audio, video, or file transfer User based metadata extraction e.g. email sender/receiver, callee, caller etc. Application QoS/QoE including VoLTE KPIs e.g. call origin, call time, bit rate, jitter, etc. 7. Frequency of updates The evolution of network traffic means that protocols and signatures are constantly changing, and an application identification system must keep up. Good DPI is achieved by having a team of experts who study application protocols and analyze their patterns and behaviors. Signature updates should be issued on a frequent basis to ensure a high level of accurate application identification. Even small changes to protocols and applications can lead to problems with classification and since details for most application changes are not publicly announced, this requires constant attention. As a result of ongoing performance and reliability testing, regular improvements can be made to the software to ensure all applications are detected. 8. Global application visibility A key factor in choosing to source DPI is that the software is often deployed globally and regularly enhanced with the newest applications based on continuous feedback from multiple customers and regions. This results in a much better detection rate than in-house DPI. This is especially important considering the level of performance, accuracy and reliability that a mobile network supporting millions of subscribers would require. 9. Flexibility Network infrastructure vendors as well as mobile operators want to ensure they choose a DPI partner that offers flexibility in terms of adding new application or protocols but also in terms of being able to gain direct access to engineers, influence roadmap for new features etc. This flexibility can also include being able to add custom-defined protocols to extend the detection. This allows customers to adapt the solution to individual use cases and reporting needs, by offering the flexibility to add unique applications to the existing signature database. This also means protocol and application detection can be customized within days as new business demands arise. 10. In-house engineers and developers Last but not least, it is worth double-checking that the DPI software company you are considering actually develops their own software in-house rather than sub-contracting it to another software house. This ensures high level of quality assurance and a tighter connection between the developers and product management and sales and support teams. This also means that your technical engineering staff can speak directly to engineers and developers who work on the DPI software, this is real nice-to-have for technical teams who work on integrating DPI software into their solutions. www.ipoque.com 11
ABOUT IPOQUE ipoque, a Rohde&Schwarz company, provides application-aware traffic management and analysis solutions, using DPI technology, to help operators and equipment vendors to better understand traffic patterns, monetize new data services and improve the quality of experience for their subscribers. ipoque delivers accurate and reliable DPI software through our OEM solutions, enabling consistent application recognition for bandwidth and congestion control, prioritized quality of service delivery and detailed network visibility. Network equipment providers use ipoque s deep packet inspection technology in their network security, optimization and network management products to analyze the data traffic of hundreds of millions of Internet users. ipoque s PACE DPI software has been optimized for fast performance, efficient memory usage and classification reliability. Applications to Layer 7 (e.g. Skype, Facebook, YouTube, etc.) are accurately identified as well as detection of audio, video and key performance indicators for deeper insight. ipoque supports thousands of network protocols and applications and frequent signature updates ensure ongoing reliable detection. Based on performance tests on real traffic data, ipoque can accurately identify over 95% of network traffic. Keeping the amount of resources that integrated DPI and application classification technology requires low is critical. The fewer cores (on a multi-core processor) and the less onboard memory an engine requires, the better. ipoque has the industry s most efficient memory footprint, which combined with high performance helps contain costs for network equipment vendors and their customer. www.ipoque.com ipoque GmbH, Neumarkt 29-33, 04109 Leipzig, Germany Phone: +49 341 59403 0 Fax: +49 341 59403 019 www.ipoque.com ipoque GmbH 2014 12