System and method for classifying and managing applications over compressed or encrypted traffic

Patent metadata

Field	Value
Publication number	US-2016248652-A1
Application number	US-201615142302-A
Country	US
Kind code	A1
Filing date	Apr 29, 2016
Priority date	Nov 24, 2013
Publication date	Aug 25, 2016
Grant date	—

Abstract

System and methods for identifying and managing applications over compressed or encrypted traffic in a network are described. The first and second embodiments, which provides a method for managing applications over compressed or encrypted traffic respectively, comprise identifying applications on the traffic, saving the application classification per connection, and propagating the application classification to the network. A method for providing application identification over compressed or encrypted traffic is also disclosed, which includes an application recognition module configured to, among other functions, determine an application classifier for compressed or encrypted traffic without applying an application classification process, and utilize the application classification for previous packets originating from the connection for the current packets from the same connection.

First claim

What is claimed is:

1 . A method of identifying applications over one or more compressed interfaces in a network, wherein the network comprises at least one data compression device, the method comprising the steps of:
receiving uncompressed traffic including application data from an end user device, wherein the end user device comprises a connection to a subnetwork; determining an application classifier based on the application data; saving the application classifier for the connection; and, classifying any consecutive packets from the connection with the same application classifier.

2 . The method of claim 1 , further comprising the step of propagating the application classifier to the compressed interfaces in the network.

3 . The method of claim 2 , wherein the propagating step comprises using the flow table that is stored on the data compression device.

4 . The method of claim 2 , wherein the propagating step comprises sending information for previously stored in the connection from a previous device.

5 . The method of claim 1 , wherein the step of determining an application classifier based on the application data comprises utilizing a cloud-based application classification service.

6 . The method of claim 1 , further comprising the steps of:
detecting new L7 information from the connection; and, sending a new application trigger for the connection.

7 . The method of claim 6 , further comprising the steps of:
determining an altered application classifier for application data; saving the altered application classifier for the connection; and, classifying any consecutive packets from the connection with the same altered application classifier.

8 . The method of claim 1 , wherein the method is executed by a router in the network.

9 . The method of claim 1 , wherein the method is executed by a switch or an access device in the network.

10 . A method of managing applications over compressed traffic in a network, wherein the network comprises at least one communication channel, the method comprising the steps of:
detecting compressed traffic originating from a connection; acquiring the application classifier for the compressed traffic without applying a classification process to the compressed traffic; executing an application management process on the compressed traffic; and, returning an application management process output to the network.

11 . The method of claim 10 , wherein the step of detecting compressed traffic originating from a connection comprises the step of receiving a notification indicating that compressed traffic is present in the communication channel.

12 . The method of claim 10 , wherein the step of detecting compressed traffic originating from a connection comprises the step of monitoring the communication channel until compressed traffic is detected.

13 . The method of claim 10 , wherein the acquiring the application classifier step comprises accessing a stored application identifier from the connection.

14 . The method of claim 13 , wherein accessing a stored application identifier from the connection comprises accessing a previous application identifier.

15 . The method of claim 10 , wherein the application management process function comprises a reporting function.

16 . The method of claim 10 , wherein the application management process comprises a quality of service function.

17 . The method of claim 10 , wherein the method is executed by an application recognition module.

18 . A method of identifying applications over encrypted interfaces in a network, wherein the network comprises at least one data encryption device, the method comprising the steps of:
receiving unencrypted traffic including application data from an end user device, wherein the end user device comprises a connection to a subnetwork; determining an application classifier based on the application data; saving the application classifier for the connection; classifying any consecutive packets from the connection with the same application classifier; and, propagating the application classifier to the encrypted interface in the network.

19 . The method of claim 18 , wherein the propagating step comprises sending information for previously stored in the connection from a previous device.

20 . The method of claim 18 , further comprising the steps of:
sending a new application trigger for the connection in response to new L7 information; determining an altered application classifier for application data; and, classifying any consecutive packets from the connection with the same altered application classifier.

Assignees

• Cisco Tech Inc

Inventors

• Ben-Dvora Nir
• Zayats Michael
• Haim Chanoh
• Rao Ranjana

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L47/2441

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title