SYSTEM AND METHOD FOR CHARACTERIZING NETWORK TRAFFIC

• US 20160248700A1
• Filed: 02/20/2015
• Published: 08/25/2016
• Est. Priority Date: 02/20/2015
• Status: Active Grant

• Current Assignee: Saisei Networks, Inc.
• Original Assignee: Saisei Networks, Inc.
• Inventors: Harper, John Anthony
• Granted Patent: US 9,832,140 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 47/805 QOS or priority aware

Abstract

A system monitors first traffic and identifies associations between applications that generated or received the traffic and parameters such as domain names, a remote host, and a local host referenced in the traffic. Subsequent traffic is monitored and determined to be generated by or addressed to an application according to such parameters in the subsequent traffic, such as remote host, local host, domain name, or port number. The subsequent traffic is associated with an application without requiring deep packet inspection (DPI). In particular, an application may be associated with a session based on evaluation of a single packet of the session.

Claims

1. A method comprising, by a computer system:

monitoring first traffic from a first local host;

determining from the first traffic a first application at least one of addressed by and that generated the first traffic and a remote host addressed by the first traffic;

monitoring second traffic from one of the first local host and a second local host;

determining that the second traffic is addressed to the remote host;

in response to determining that the second traffic is addressed to the remote host, determining that the second traffic is at least one of addressed to the first application and generated by the first application; and

in response to determining that the second traffic is at least one of addressed by the application and generated by the first application, applying a prioritization logic to subsequent traffic in a session including the second traffic.

2. The method of claim 1, wherein the prioritization rule applies bandwidth limits to received traffic according to an application associated with the received traffic.

3. The method of claim 1, wherein determining that the second traffic is at least one of addressed to the first application and generated by the first application is performed without performing deep packet inspection of the second traffic.

4. The method of claim 3, wherein determining that the second traffic is at least one of addressed to the first application and generated by the first application is performed by evaluating less than ten packets of the second traffic.

5. The method of claim 3, wherein determining that the second traffic is at least one of addressed to the first application and generated by the first application is performed by evaluating only one packet of the second traffic.

6. The method of claim 3, wherein determining from the first traffic the first application at least one of addressed by and that generated the first traffic and the remote host addressed by the first traffic further comprises performing deep packet inspection of the first traffic.

7. The method of claim 3, wherein the second traffic is encrypted and determining that the second traffic is at least one of addressed to the first application and generated by the first application is performed without decrypting the second traffic.

8. The method of claim 1, wherein monitoring the first traffic and monitoring the second traffic comprises monitoring the first traffic and second traffic flowing between an internal network and an external network.

9. A system comprising one or more processors and one or more memory devices coupled to the one or more processors, the one or more memory devices storing executable and operational code effective to cause the one or more processors to:

monitor first traffic from a first local host;

determine from the first traffic a first application at least one of addressed by and that generated the first traffic and a remote host addressed by the first traffic;

monitor second traffic from one of the first local host and a second local host;

determine that the second traffic is addressed to the remote host;

in response to determining that the second traffic is addressed to the remote host, determine that the second traffic is at least one of addressed to the first application and generated by the first application; and

in response to determining that the second traffic is at least one of addressed by the application and generated by the first application, apply a prioritization logic to subsequent traffic in a session including the second traffic.

10. The system of claim 9, wherein the prioritization rule applies bandwidth limits to received traffic according to an application associated with the received traffic.

11. The system of claim 9, wherein the executable and operational data are further effective to determine that the second traffic is at least one of addressed to the first application and generated by the first application without performing deep packet inspection of the second traffic.

12. The system of claim 11, wherein the executable and operational data are further effective to determine that the second traffic is at least one of addressed to the first application and generated by the first application by evaluating less than ten packets of the second traffic.

13. The system of claim 11, wherein the executable and operational data are further effective to determine that the second traffic is at least one of addressed to the first application and generated by the first application by evaluating only one packet of the second traffic.

14. The system of claim 11, wherein the executable and operational data are further effective to determine from the first traffic the first application at least one of addressed by and that generated the first traffic and the remote host addressed by the first traffic further by performing deep packet inspection of the first traffic.

15. The system of claim 11, wherein the second traffic is encrypted and wherein the executable and operational data are further effective to determine that the second traffic is at least one of addressed to the first application and generated by the first application without decrypting the second traffic.

16. The system of claim 11, wherein the executable and operational data are further effective to monitor the first traffic and monitor the second traffic by monitoring the first traffic and second traffic flowing between an internal network and an external network.

17. A system comprising one or more processors and one or more memory devices coupled to the one or more processors, the one or more memory devices storing executable and operational code effective to cause the one or more processors to:

evaluate first traffic to identify for each first session of a portion of first sessions in which the first traffic occurs and, according to the evaluation, identifying a local host associated with the each first session, a remote host associated with the each first session, and an application of a plurality of applications associated with the each first session;

evaluate second traffic subsequent to the first traffic; and

for each session of a plurality of second sessions in the second traffic—

identify a local host and a remote host associated with the each second session;

identify an inferred application of the plurality of applications that is associated with a same local host and a same remote host in one or more of the first sessions as the each second session; and

apply prioritization logic to subsequent traffic in the each second session according to the associating of the inferred application to the each second session.

18. The system of claim 17, wherein the executable and operational code effective to cause the one or more processors to identify the inferred application of the plurality of applications for the each second session by:

if (a) one or more first sessions of the portion of first sessions are associated with a same domain name as the each second session, identifying as the inferred application, the application associated with the one or more first sessions of the portion of first sessions associated with the same domain name as the each second session.

if not (a), then if (b) one or more first sessions of the portion of first sessions are associated with the same remote host and the same local host as the each second session, identifying as the inferred application, the application associated with the one or more first sessions of the portion of first sessions including the same remote host and the same remote host as the each second session; and

if not (b), then if (c) one or more first sessions of the portion of first sessions are associated with the same remote host as the each second session, identifying as the inferred application, the application associated with the one or more first sessions of the portion of first sessions including the same remote host as the each second session.

19. The system of claim 18, wherein the executable and operational code effective to cause the one or more processors to identify the inferred application of the plurality of applications for the each second session by:

if not (c), selecting the inferred application as an application that is mapped to a port associated with the each second session in a mapping database.

20. The system of claim 19, wherein the executable and operational code effective to cause the one or more processors to identify the inferred application of the plurality of applications for the each second session by:

attempting to perform deep packet inspection (DPI) for the each second session; and

if DPI for the each second session is successful, selecting as the inferred application an application determined according to DPI.