Identification and control of applications and media sessions

Patent metadata

Field	Value
Publication number	US-10944799-B2
Application number	US-201616072303-A
Country	US
Kind code	B2
Filing date	Aug 30, 2016
Priority date	Jan 30, 2016
Publication date	Mar 9, 2021
Grant date	Mar 9, 2021

Abstract

According to an example, an application initiating a communication session may be identified via a mapping of the application information with a pattern of interest included in a DNS server response corresponding to the application. Information regarding the communication session may be obtained and a determination may be made as to whether the communication session includes media data. If the communication session includes media data, control of the application and the communication session may be enabled via an interface.

First claim

What is claimed is:

1. A computing apparatus comprising:
a processor;
a memory on which is stored instructions that are to cause the processor to:
receive a response from a Domain Name System (DNS) server to a DNS request for service sent from an application, wherein the application uses encrypted data;
obtain a pattern of interest from the response;
identify the application from a mapping of a pre-populated identity of the application and the obtained pattern of interest;
identify a media session initiated by the identified application, wherein identifying the media session includes the processor to:
process messages from one or more sessions established by the application, and
determine from the processing of the messages from the one or more sessions that the media session includes transmission of audio data, video data, or both; and

enable control of the application and the media session;
prioritize the application based at least in part on identification of the application and identification of the media session.

2. The computing apparatus of claim 1 , wherein the pattern of interest comprises an IP address and a port number associated with a server providing the requested service.

3. The computing apparatus of claim 1 , the memory further comprising instructions that cause the processor to:
prepopulate a database with names of applications using the network, the names of the applications comprising a name of the application that sent the DNS request; and
store to the database, the mapping of the pre-populated identity of the application and the pattern of interest.

4. The computing apparatus of claim 3 , wherein to store, to the database, the mapping, the instructions are to cause the processor to:
map the name of the application that sent the DNS request to the pattern of interest.

5. The computing apparatus of claim 1 , wherein identifying the media session includes the processor to:
process the messages from the one or more sessions established by the application via a media classification algorithm.

6. The computing apparatus of claim 5 , wherein to identify a media session, the instructions are further to cause the processor to:
identify the media session from an output of the processing of the messages by the media classification algorithm.

7. The computing apparatus of claim 5 , wherein to enable control of the application and the media session, the instructions are further to cause the processor to:
obtain metadata of the media session; and
enable associating of the media session with the application via the metadata.

8. The computing apparatus of claim 7 , wherein the metadata of the media session comprises 5-tuple information including a source IP address, a source port, a destination IP address, a destination port and a transport layer protocol.

9. The computing apparatus of claim 1 , wherein the identified application further provides for transmission of text in addition to transmission of audio data, video data, or both in the media session.

10. The computing apparatus of claim 9 , wherein the identified application is an instant messaging application that permits one or more of audio calling and video calling.

11. A method, comprising:
identifying, by a processor, an application initiating a communication session on a network, wherein identifying is based on a mapping of information about the application along with a pattern of interest included in a Domain Name System (DNS) server response for the application, wherein the application uses encrypted data;
obtaining, by the processor, information regarding the communication session;
determining, by the processor, that the communication session comprises a media session based on the obtained information, wherein determining that the communication session is a media session includes the processor to:
process messages from one or more sessions including the communication session established by the application, and
determine from the processing of the messages from the one or more sessions that the media session includes transmission of audio data, video data, or both; and

enabling, by the processor, control of the application and the communication session via an interface;
prioritizing the application based at least in part on identification of the application and identification of the media session.

12. The method of claim 11 , wherein identifying the application further comprises:
pre-populating, by the processor, a database with a repository of names of a plurality of applications that utilize network resources, the plurality of applications including the application; and
mapping a pattern of interest from a DNS server response to a name of the application in the repository.

13. The method of claim 12 , further comprising:
receiving, by the processor, names of additional applications not included in the plurality of applications; and
storing, by the processor, to the database, the names of the additional applications.

14. The method of claim 11 , wherein obtaining the information regarding the communication session comprises:
obtaining, by the processor, 5-tuple details of the media session.

15. The method of claim 14 , wherein enabling control of the application and the communication session further comprises:
providing, by the processor, the 5-tuple details to the interface.

16. A non-transitory computer readable storage medium comprising machine readable instructions that when executed by a processor, cause the processor to:
access a database comprising a mapping of a pre-populated identity of an application to a corresponding pattern of interest obtained from a Domain Name System (DNS) server response associated with the application, wherein the application uses encrypted data;
identify the application from the mapping;
subsequently identify a media session initiated by the application, wherein identifying the media session includes:
processing messages from one or more sessions established by the application, and
determining from the processing of the messages from the one or more sessions that the media session includes transmission of audio data, video data, or both; and

enable implementation of network policies that control the application and the media session,
prioritize the application based at least in part on identification of the application and identification of the media session.

17. The medium of claim 16 further comprising instructions that cause the processor to:
receive the response from the DNS server to a DNS request for service sent by the application;
parse the response from the DNS server; and
obtain the pattern of interest from parsing the response.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Thippesh Navaneetha Krishna Gowda
• Yadav Brijesh
• Joshi Venkatesh
• Agarwal Gopal

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L61/4541

  Directories for service discovery · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• H04L67/14

  Session management (for real-time applications in data packet communications networks H04L65/1066) · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title