Application identification

• US 8,321,595 B2
• Filed: 04/22/2011
• Issued: 11/27/2012
• Est. Priority Date: 03/07/2007
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Narayanaswamy, Krishna, Yang, Siying
• Primary Examiner(s): Chan, Wing
• Assistant Examiner(s): Yohannes, Tesfay
• Application Number:
  US13/092,532
• Publication Number:
  US 20110202672A1
• Time in Patent Office: 585 Days
• Field of Search: 709/250, 370/310, 370/328
• US Class Current: 709/250
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method may include receiving a communication from a client device and identifying a port number, a protocol and a destination associated with the communication. The method may also include identifying a first application being executed by the first client device based on the port number, the protocol and the destination associated with the first communication.

Claims

1. A method, comprising:

extracting, by one or more network devices, a signature from a first communication that is received from a first one of a plurality of client devices;

identifying, by the one or more network devices and based on the extracted signature, a particular application;

storing, by the one or more network devices and upon identifying the particular application;

additional information associated with the first communication, and

an indication that the additional information is associated with the particular application; and

determining, by the one or more network devices, that a second communication is associated with the particular application based on;

information associated with the second communication,

the stored additional information, and

the indication that the stored additional information is associated with the particular application,

the second communication being subsequent to the first communication.

2. The method of claim 1, where the additional information, associated with the first communication, identifies at least one of:

a protocol associated with the first communication,

a destination address associated with the first communication, or

a destination port number associated with the first communication.

3. The method of claim 1, where the additional information, associated with the first communication, identifies at least two of:

a protocol associated with the first communication,

a destination address associated with the first communication, or

a destination port number associated with the first communication.

4. The method of claim 1, where the additional information, associated with the first communication, identifies a protocol associated with the first communication, and

where determining that the second communication is associated with the particular application includes:

determining that a protocol, associated with the second communication, is a same protocol as the protocol associated with the first communication.

5. The method of claim 1, where the additional information, associated with the first communication, identifies a destination address associated with the first communication, and

where determining that the second communication is associated with the particular application includes:

determining that a destination address, associated with the second communication, is a same destination address as the destination address associated with the first communication.

6. The method of claim 1, where the additional information, associated with the first communication, identifies a destination port number associated with the first communication, and

where determining that the second communication is associated with the particular application includes:

determining that a destination port number, associated with the second communication, is a same destination port number as the destination port number associated with the first communication.

7. The method of claim 1, where the second communication is received from a second one of the plurality of client devices that is different than the first one of the plurality of client devices.

8. The method of claim 1, where determining that the second communication is associated with the particular application, includes:

determining that the second communication is associated with the particular application, without performing a signature analysis on the second communication.

9. A network device, comprising:

one or more memory devices; and

one or more processors to;

identify, based on a signature extracted from a first communication that is received from a first one of a plurality of client devices, a particular application,

store, in the one or more memory devices and upon identifying the particular application;

additional information associated with the first communication, and

an indication that the additional information is associated with the particular application, and

determine that a second communication is associated with the particular application, based on;

information associated with the second communication,

the stored additional information, and

the indication that the stored additional information is associated with the particular application,

the second communication being subsequent to the first communication.

10. The network device of claim 9, where the additional information, associated with the first communication, identifies at least one of:

a protocol associated with the first communication,

a destination address associated with the first communication, or

a destination port number associated with the first communication.

11. The network device of claim 9, where the additional information, associated with the first communication, identifies a protocol associated with the first communication, and

where when determining that the second communication is associated with the particular application, the one or more processors are to:

determine that a protocol, associated with the second communication, is a same protocol as the protocol associated with the first communication.

12. The network device of claim 9, where the additional information, associated with the first communication, identifies a destination address associated with the first communication, and

where when determining that the second communication is associated with the particular application, the one or more processors are to:

determine that a destination address, associated with the second communication, is a same destination address as the destination address associated with the first communication.

13. The network device of claim 9, where the additional information, associated with the first communication, identifies a destination port number associated with the first communication, and

where when determining that the second communication is associated with the particular application, the one or more processors are to:

determine that a destination port number, associated with the second communication, is a same destination port number as the destination port number associated with the first communication.

14. The network device of claim 9, where the one or more processors are further to:

apply at least one access rule or policy for the second communication based on the particular application.

15. A non-transitory computer-readable medium comprising:

a plurality of instructions which, when executed by at least one processor of a device, cause the at least one processor to;

identify, based on a signature extracted from a first communication that is received from a first one of a plurality of client devices, a particular application,

store, in one or more memory devices, associated with the device, and upon identifying the particular application;

additional information associated with the first communication,

and

an indication that the additional information is associated with the particular application, and

determine that a second communication is associated with the particular application, based on;

information associated with the second communication,

the stored additional information, and

the indication that the stored additional information is associated with the particular application,

the second communication being subsequent to the first communication.

16. The non-transitory computer-readable medium of claim 15, where the additional information, associated with the first communication, identifies at least one of:

a protocol associated with the first communication,

a destination address associated with the first communication, or

a destination port number associated with the first communication.

17. The non-transitory computer-readable medium of claim 15, further comprising:

one or more instructions to determine, when the additional information, associated with the first communication, identifies a protocol associated with the first communication, that a protocol, associated with the second communication, is a same protocol as the protocol associated with the first communication,

one or more instructions to determine, when the additional information, associated with the first communication, identifies a destination address associated with the first communication, that a destination address, associated with the second communication, is a same destination address as the destination address associated with the first communication, and

one or more instructions to determine, when the additional information, associated with the first communication, identifies a destination port number associated with the first communication, that a destination port number, associated with the second communication, is a same destination port number as the destination port number associated with the first communication.

18. The non-transitory computer readable memory device of claim 15, where the second communication is received from a second one of the plurality of client devices that is different than the first one of the plurality of client devices.

19. The non-transitory computer-readable medium of claim 15, where one or more instructions, of the plurality of instructions, to determine that the second communication is associated with the particular application include:

one or more instructions to determine that the second communication is associated with the particular application without performing a signature analysis on the second communication.

20. The non-transitory computer-readable medium of claim 15, further comprising:

one or more instructions to apply at least one access rule or policy for the second communication based on the particular application.