Integrate Application Intelligence with a Network Device for Application Transaction Visibility and Control

• US 20140317228A1
• Filed: 04/19/2013
• Published: 10/23/2014
• Est. Priority Date: 04/19/2013
• Status: Abandoned Application

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Dharmasanam, Srinivas
• Application Number:
  US13/866,523
• Publication Number:
  US 20140317228A1
• Time in Patent Office: Days
• US Class Current: 709/217
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

The proposed methodology provides an application state machine in a network device, such as a router which may be used to extract application transactions. The extracted transaction data may be provided to another entity for analysis and troubleshooting.

Claims

1. A method for improving application level intelligence comprising:

establishing an application state machine at a first network device;

constructing a first application data packet;

generating transaction data from the first application data packet relating to a first application at the application state machine; and

transmitting the transaction data related to a first application to a remote entity.

2. The method of claim 1, wherein the transaction information includes identification of a protocol request made by the first application.

3. The method of claim 1, further comprising maintaining the application state machine in an application stack at the first network device.

4. The method of claim 3 wherein the transaction data comprises data related to at least one of:

opening a document, closing a document, and saving a document.

5. The method of claim 3, wherein the first application data packet is generated by a protocol parser stored in the application stack.

6. The method of claim 5, further comprising:

operating the first network device in a passive mode; and

extracting application-specific data from data transmitted through the first network device.

7. The method of claim 5, further comprising:

operating the first network device in an active mode;

extracting application-specific data from data terminated at the first network device; and

optimizing a first data flow in-band based on the extracted application-specific data.

8. The method of claim 1, wherein the first application data packet is constructed according to the rules of an object model providing a common interface for identifying and exporting application transactions over a plurality of application domains.

9. The method of claim 8, wherein the first application data packet comprises at least a source IP address, a destination IP address, and information associated with a network flow to one or more contact ports.

10. A method comprising:

intercepting a first data packet on a first network;

providing the first data packet to one of a plurality of application protocol parsers; and

maintaining a session state for the application based in part on information parsed from the first data packet, wherein the session state is maintained at least in part by a first drive service associated with an application associated with the first data packet.

11. The method of claim 10, further comprising:

decrypting the data packet at a first SSL handler;

providing the decrypted data packet to a first application transaction engine.

12. The method of claim 11, further comprising creating a transaction record based on application transaction data gleaned from the first data packet.

13. The method of claim 12, further comprising:

re-encrypting the decrypted data packet at the first SSL handler; and

transmitting the re-encrypted data packet from the first SSL handler to the first network.

14. The method of claim 13, further comprising:

creating a merged transaction record containing a plurality of transaction records; and

exporting the merged transaction record to an analytics platform.

15. The method of claim 14, further comprising:

buffering the exported transaction record in a buffer comprising a plurality of exported transaction records; and

running predefined queries on the buffered transaction records at periodic time intervals.

16. A network device comprising:

one or more network probes configured to learn application data information over a network;

an application transaction aware interface configured to maintain an application state management module for processing learned application data and providing flow management based on the learned application data; and

an analytics engine configured for real-time processing of application events tracked by the application transaction aware interface.

17. The network device of claim 16, wherein the network device is a WAAS device.

18. The network device of claim 17, further comprising a network analytics platform comprising a data buffer used to store application transaction data.

19. The network device of claim 17, further comprising an application driver in communication with the application transaction aware interface.

20. The network device of claim 18, wherein the analytics engine is part of the network analytics platform.