Device and related method for scoring applications running on a network

Patent metadata

Field	Value
Publication number	US-9230213-B2
Application number	US-201313836545-A
Country	US
Kind code	B2
Filing date	Mar 15, 2013
Priority date	Mar 15, 2013
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

A function is provided for effectively identifying computer applications running on a network. The function receives information related to frames of packets moving through the network. The information is compared to known information about computer applications. The known information is obtained from a plurality of mechanisms, including the option of obtaining it through custom mechanisms. The comparison information is scored for each of the plurality of mechanisms and those scores are combined to establish a single score indicative of the likely computer application associated with the received frames. One or more mathematical operations can be used to combine the scores. The mechanisms may be weighted for likely accuracy and the score that is established may include with it an indication of the level of confidence in that score. One or more of the plurality of mechanisms may be used to weight others of the types of mechanisms.

First claim

What is claimed is:

1. A device of a network system including a plurality of network infrastructure devices for identifying one or more computer applications running or attempting to run on the network system, the device comprising a scoring analysis engine configured to:
a. receive information related to one or more frames received by one or more of the plurality of network infrastructure devices indicative of one or more computer applications;
b. compare the received information with information of a computer applications identification database, wherein the information of the database includes information about a plurality of computer applications obtained from a plurality of mechanisms;
c. establish a score for each computer application likely to match the received information related to the one or more frames; and
d. designate one of the computer applications as being associated with the one or more frames based on the established score.

2. The device of claim 1 wherein the designation of the one of the computer applications includes an indication of the confidence in the designation.

3. The device of claim 1 wherein the scoring analysis engine assesses likely accuracy on a scale of 0 to 100.

4. The device of claim 1 wherein the device is a standalone appliance of the plurality of network infrastructure devices.

5. The device of claim 1 wherein the device of claim 1 is a policy server or a manager server.

6. The device of claim 1 wherein the scoring analysis engine receives information from an application identification engine that includes an interface configured to enable loading into the computer applications identification database new indicators of computer applications to be identified by the application identification engine.

7. The device of claim 6 wherein the interface is an application programming interface to add information from one or more custom mechanisms with corresponding indicators as one or more of the plurality of mechanisms for determining computer applications to be identified.

8. The device of claim 6 wherein the interface is an interface to add one or more computer application signatures information to the computer applications identification database for a signatures comparison mechanism of the plurality of mechanisms.

9. The device of claim 6 wherein the application identification engine is configured to weight the likely accuracy of the one or more indicators in the comparison.

10. The device of claim 9 wherein the one or more indicators are not weighted equally.

11. The device of claim 1 wherein the received information includes one or more computer application signatures, Transmission Control Protocol/Uniform Datagram Protocol (TCP/UDP) canonical port value, IP protocol (IP) protocol value, heuristics, regular expression, history, statistics and applications installed on the network.

12. The device of claim 11 wherein the score is established by combining scores for each type of received information.

13. The device of claim 12 wherein the combining involves the use of one or more mathematical operations for the received information.

14. The device of claim 13 wherein the scores for each type of received information are not weighted equally in the combining.

15. The device of claim 14 wherein history and installed applications are weighted greater than the other types.

16. The device of claim 11 wherein the received information from either or both of the history and installed applications is used to weight others of the other types of received information.

17. A method for identifying one or more computer applications running or attempting to run on a network system including a plurality of network infrastructure devices including one or more packet forwarding devices, the method comprising the steps of:
a. receiving information of one or more frames forwarded by one or more of the plurality of network infrastructure devices indicative of one or more computer applications;
b. comparing information of one or more frames forwarded by one or more of the one or more packet forwarding devices with information of a computer applications identification database, wherein the information of the database includes information about a plurality of computer applications obtained from a plurality of mechanisms;
c. establishing a score for each computer application likely to match the received information of the one or more frames; and
d. designating one of the computer applications as being associated with the one or more frames based on the established score.

18. The method of claim 17 wherein the step of designating includes providing an indication of the confidence in the designation.

19. The method of claim 17 further comprising the step of assessing likely accuracy on a scale of 0 to 100.

20. The method of claim 17 wherein the scoring is conducted on a standalone appliance of the plurality of network infrastructure devices.

21. The method of claim 17 further comprising the step of weighting the likely accuracy of the one or more indicators in the comparison.

22. The method of claim 21 wherein the one or more indicators are not weighted equally.

23. The method of claim 17 wherein the received information includes one or more computer application signatures, Transmission Control Protocol/Uniform Datagram Protocol (TCP/UDP) canonical port value, IP protocol (IP) protocol value, heuristics, regular expression, history, statistics and applications installed on the network.

24. The method of claim 23 wherein the score is established by combining scores for each type of received information.

25. The method of claim 24 wherein the scores for each type of received information are not weighted equally in the combining.

26. The method of claim 25 wherein history and installed applications are used to weight the other types.

Assignees

• Enterasys Networks Inc
• Extreme Networks Inc

Inventors

• Rash Michael
• Bosa Patrick
• Graham Richard

Classifications

• G06N5/02 Primary

  Knowledge representation; Symbolic representation · CPC title

• H04L43/026

  using flow identification · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title