APPLICATION IDENTIFICATION

• US 20110202672A1
• Filed: 04/22/2011
• Published: 08/18/2011
• Est. Priority Date: 03/07/2007
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: YANG, Siying, NARAYANASWAMY, Krishna
• Granted Patent: US 8,321,595 B2
• Time in Patent Office: Days
• US Class Current: 709/230
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method may include receiving a communication from a client device and identifying a port number, a protocol and a destination associated with the communication. The method may also include identifying a first application being executed by the first client device based on the port number, the protocol and the destination associated with the first communication.

Claims

1-26. -26. (canceled)

27. A method, comprising:

extracting, by one or more network devices, a signature from a communication that is received from a client device;

identifying, by the one or more network devices and based on the extracted signature, a particular application;

storing, by the one or more network devices and upon identifying the particular application;

additional information, associated with the communication, and

an indication that the additional information is associated with the particular application;

determining, by the one or more network devices, that a subsequent communication is associated with the particular application, where the determining is based on;

information associated with the subsequent communication,

the stored additional information, and

the indication that the stored additional information is associated with the particular application.

28. The method of claim 27, where the additional information, associated with the communication, includes at least one of:

a protocol associated with the communication,

a destination address associated with the communication, or

a destination port number associated with the communication.

29. The method of claim 28, where the additional information, associated with the communication, includes at least two of:

the protocol associated with the communication,

the destination address associated with the communication, or

the destination port number associated with the communication.

30. The method of claim 27, where the additional information, associated with the communication, includes a protocol associated with the communication, and

where determining that the subsequent communication is associated with the particular application includes:

determining that a protocol, associated with the subsequent communication, is a same protocol as the protocol associated with the communication.

31. The method of claim 27, where the additional information, associated with the communication, includes a destination address associated with the communication, and

where determining that the subsequent communication is associated with the particular application includes:

determining that a destination address, associated with the subsequent communication, is a same destination address as the destination address associated with the communication.

32. The method of claim 27, where the additional information, associated with the communication, includes a destination port number associated with the communication, and

where determining that the subsequent communication is associated with the particular application includes:

determining that a destination port number, associated with the subsequent communication, is a same destination port number as the destination port number associated with the communication.

33. The method of claim 27, where the subsequent communication is received from another client device.

34. The method of claim 27, where determining that the subsequent communication is associated with the particular application, includes:

determining that the subsequent communication is associated with the particular application, without performing a signature analysis on the subsequent communication.

35. A network device, comprising:

one or more memory devices; and

one or more processors to;

identify, based on a signature extracted from a communication that is received from a client device, a particular application,

storing, in the one or more memory devices and upon identifying the particular application;

additional information, associated with the communication, and

an indication that the additional information is associated with the particular application, and

determine that a subsequent communication is associated with the particular application, based on;

information associated with the subsequent communication,

the stored additional information, and

the indication that the stored additional information is associated with the particular application.

36. The network device of claim 35, where the additional information, associated with the communication, includes at least one of:

a protocol associated with the communication,

a destination address associated with the communication, or

a destination port number associated with the communication.

37. The network device of claim 35, where the additional information, associated with the communication, includes a protocol associated with the communication, and

where when determining that the subsequent communication is associated with the particular application, the one or more processors are to:

determine that a protocol, associated with the subsequent communication, is a same protocol as the protocol associated with the communication.

38. The network device of claim 35, where the additional information, associated with the communication, includes a destination address associated with the communication, and

where when determining that the subsequent communication is associated with the particular application, the one or more processors are to:

determine that a destination address, associated with the subsequent communication, is a same destination address as the destination address associated with the communication.

39. The network device of claim 35, where the additional information, associated with the communication, includes a destination port number associated with the communication, and

where when determining that the subsequent communication is associated with the particular application, the one or more processors are to:

determine that a destination port number, associated with the subsequent communication, is a same destination port number as the destination port number associated with the communication.

40. The network device of claim 35, where the one or more processors are further to:

apply at least one access rule or policy for the subsequent communication based on the particular application.

41. A non-transitory computer-readable memory device having stored thereon sequences of instructions which, when executed by one or more processors of a device, cause the one or more processors to:

identify, based on a signature extracted from a communication that is received from a client device, a particular application,

storing, in one or more memory devices, associated with the device, and upon identifying the particular application;

additional information, associated with the communication, and

an indication that the additional information is associated with the particular application, and

determine that a subsequent communication is associated with the particular application, based on;

information associated with the subsequent communication,

the stored additional information, and

the indication that the stored additional information is associated with the particular application.

42. The non-transitory computer readable memory device of claim 41, where the additional information, associated with the communication, includes at least one of:

a protocol associated with the communication,

a destination address associated with the communication, or

a destination port number associated with the communication.

43. The non-transitory computer readable memory device of claim 41, where:

when the additional information, associated with the communication, includes a protocol associated with the communication, the instructions include instructions that cause the one or more processors to determine that a protocol, associated with the subsequent communication, is a same protocol as the protocol associated with the communication,

when the additional information, associated with the communication, includes a destination address associated with the communication, the instructions include instructions that cause the one or more processors to determine that a destination address, associated with the subsequent communication, is a same destination address as the destination address associated with the communication, and

when the additional information, associated with the communication, includes a destination port number associated with the communication, the instructions include instructions that cause the one or more processors to determine that a destination port number, associated with the subsequent communication, is a same destination port number as the destination port number associated with the communication.

44. The non-transitory computer readable memory device of claim 41, where the subsequent communication is received from another client device.

45. The non-transitory computer readable memory device of claim 41, where the instructions that cause the one or more processors to determine that the subsequent communication is associated with the particular application, include instructions that cause the one or more processors to:

determine that the subsequent communication is associated with the particular application, without performing a signature analysis on the subsequent communication.

46. The non-transitory computer readable memory device of claim 41, where the instructions further cause the one or more processors to:

apply at least one access rule or policy for the subsequent communication based on the particular application.