Detected Application Traffic

Description

Detected application traffic refers to the collection of packet flows that originate from a specific application and are identified by an application detection filter within the 3GPP policy and charging control (PCC) architecture. This concept is fundamental to application-aware policy control, allowing network operators to apply differentiated QoS, charging, and gating policies based on the type of application generating the traffic. The detection process is typically performed by a Traffic Detection Function (TDF) or an Application Detection and Control (ADC) function, which may reside in the core network or be integrated with a PCEF (Policy and Charging Enforcement Function).

The detection mechanism relies on application detection filters, which are sets of rules that inspect packet headers, payload signatures, or flow characteristics to identify the application. These filters can be statically provisioned by the operator or dynamically provided by the PCRF (Policy and Charging Rules Function) or PCF (Policy Control Function) in 5G. Once traffic is detected, the network can enforce policies such as QoS class identifiers (QCIs), allocation and retention priority (ARP), and charging rules specific to that application. This enables operators to offer premium services, such as zero-rated applications or guaranteed bit rate for voice over IP, and to implement traffic shaping or blocking as needed.

The architecture supporting detected application traffic involves several key components. The PCRF/PCF acts as the policy decision point, providing application detection and control rules to the PCEF/TDF. The PCEF/TDF enforces these rules, performs the actual detection, and reports usage back to the policy function. In 5G, the Session Management Function (SMF) and User Plane Function (UPF) play analogous roles, with the PCF providing policy rules. The detection can be based on deep packet inspection (DPI) or heuristics, and the resulting detected application traffic is identified by an application identifier. This identifier is used in policy rules and charging records to differentiate traffic.

The concept has evolved with releases, but the core definition has remained stable since Rel-11, indicating its foundational nature. It supports network slicing by allowing per-slice application policies and is essential for IoT scenarios where different applications require distinct treatment. The detection can be triggered at various points, such as session establishment or mid-session, and the network can apply policies dynamically. The accuracy of detection depends on the filters and the capabilities of the detection function, which may be limited by encryption. Nonetheless, detected application traffic remains a cornerstone of application-aware policy and charging in 3GPP networks.

Purpose & Motivation

Detected application traffic exists to enable application-aware policy control and charging in mobile networks. Before its introduction, networks could only apply policies based on coarse-grained parameters like IP 5-tuple or QoS class, without distinguishing between different applications. This limited operators' ability to offer differentiated services, such as zero-rating for specific apps or prioritizing latency-sensitive applications. The concept was introduced in 3GPP Rel-11 as part of the PCC enhancements to support application detection and control, addressing the need for finer granularity in traffic management.

The motivation came from the proliferation of over-the-top (OTT) applications and the desire of operators to monetize and manage traffic more effectively. By detecting application traffic, operators can enforce fair usage policies, offer sponsored data plans, and ensure QoS for critical applications. It also helps in mitigating network congestion by identifying and managing bandwidth-heavy applications. The concept aligns with the broader trend of network slicing and service differentiation in 5G, where application awareness is key to delivering tailored services.

Historically, the limitations of previous approaches included the inability to distinguish between applications within the same IP flow and the lack of dynamic policy control. The introduction of application detection filters and the TDF/ADC functions provided a standardized way to detect and control application traffic, enabling interoperability across vendors. This has become increasingly important with the rise of encrypted traffic, where detection may rely on metadata or heuristics, and with the advent of 5G and network slicing, where application-specific policies are essential for meeting diverse service requirements.