Application Detection Filter

Description

The Application Detection Filter (ADF) is a core component of the Policy and Charging Control (PCC) architecture in 3GPP networks. It is a logic that inspects packet flows to detect traffic generated by a specific application. This detection is based on extended inspection of packets, including header information (e.g., IP addresses, port numbers, protocol type), payload information (e.g., deep packet inspection of signatures), and the dynamics of packet flows (e.g., packet sizes, inter-arrival times, and flow duration). The ADF is entirely internal to the Traffic Detection Function (TDF) or a Policy and Charging Enforcement Function (PCEF) enhanced with Application Detection and Control (ADC). The 3GPP specifications do not standardize the internal logic of the ADF; instead, they define the interfaces and procedures for provisioning application detection filters and reporting detected applications.

In the PCC architecture, the ADF operates within the TDF or PCEF to identify application traffic. The PCRF (Policy and Charging Rules Function) or, in 5G, the PCF (Policy Control Function) provides the TDF/PCEF with application detection filters, each associated with an application identifier. When the ADF detects packets matching a filter, it reports the application start or stop event to the PCRF/PCF, which can then apply specific policy and charging rules for that application. This enables operators to offer differentiated services, such as zero-rating for specific applications, guaranteed bit rates for VoLTE, or blocking of certain traffic. The ADF is crucial for enforcing application-based policies without requiring the core network to understand every application protocol.

The ADF works by examining the packet flow at various layers. It may use shallow inspection (e.g., IP 5-tuple) for simple detection or deep packet inspection (DPI) for more complex applications that use dynamic ports or encryption. The detection logic can also consider flow dynamics, such as the pattern of packet sizes and timings, to identify applications like video streaming or gaming. The ADF is provisioned with filters that are typically derived from application signatures or heuristics. These filters are not standardized by 3GPP; they are vendor-specific and can be updated dynamically. The TDF/PCEF reports the detection events to the policy controller, which then enforces the appropriate actions.

In 5G, the ADF functionality is integrated into the User Plane Function (UPF) as part of the packet inspection capabilities. The UPF can be enhanced with a TDF-like function to detect applications and report to the SMF/PCF. The 3GPP specifications (e.g., TS 23.501, TS 23.503) define the procedures for application detection and control in 5G, but the internal logic remains out of scope. The ADF is essential for network slicing, where different slices may have different application detection requirements, and for edge computing, where local breakout requires application awareness.

The ADF is a key enabler for policy and charging control, allowing operators to monetize application usage and enforce service-level agreements. It also supports regulatory requirements, such as lawful interception and parental controls. As networks evolve towards 5G and beyond, the ADF continues to adapt to new application types, including encrypted traffic and IoT protocols, by leveraging advanced machine learning techniques. However, the fundamental principle remains: the ADF is a black box that detects applications based on packet inspection, and its internal workings are not standardized, giving vendors flexibility to innovate.

Purpose & Motivation

The Application Detection Filter exists to solve the problem of identifying application traffic in mobile networks without requiring the core network to have built-in knowledge of every application. Before its introduction, policy control was limited to basic parameters like IP 5-tuple, which could not distinguish between different applications using the same ports (e.g., HTTP and streaming). The ADF enables application-aware policy and charging, allowing operators to offer differentiated services, enforce fair usage policies, and monetize over-the-top (OTT) applications. It was introduced in 3GPP Release 11 as part of the PCC enhancements for application detection and control (ADC). The ADF addresses the limitations of static policy rules by providing dynamic detection based on deep packet inspection and flow behavior. It also supports the growing need for traffic management in congested networks, where prioritizing or throttling specific applications can improve user experience. The ADF is a foundational technology for network slicing and 5G service-based architecture, where application awareness is critical for end-to-end QoS and policy enforcement.