Device and related method for application identification

Patent metadata

Field	Value
Publication number	US-9256636-B2
Application number	US-201313836195-A
Country	US
Kind code	B2
Filing date	Mar 15, 2013
Priority date	Mar 15, 2013
Publication date	Feb 9, 2016
Grant date	Feb 9, 2016

Abstract

A function is provided for identifying computer applications running on a network. Information obtained from frames having content associated with computer applications is examined and compared to information stored on the network. The stored information is obtained from a plurality of mechanisms including computer application signatures. An application identification engine of the function compares examined content with the known application information and determines an indication of the likely computer application associated with the examined frames. The determination output may include a level of confidence in the accuracy of the determination. The function includes an application programming interface to allow the introduction into the engine of custom mechanisms for application identification. The different mechanisms may be weighted. The function may be provided in one or more devices of the network including a standalone appliance.

First claim

What is claimed is:

1. A device of a network system including a plurality of network infrastructure devices, the device comprising:
an application identification function, the application identification function including:
a. an application identification library including known signatures information about one or more known signatures in the form of signals arranged in patterns determined to be indicative of characteristics of one or more computer applications;
b. an application identification database including known information other than the signatures information, wherein the known other information is indicative of characteristics of the one or more computer applications; and
c. an application identification engine configured to:
i. examine content of at least a portion of one or more frames received at the device to detect: (a) signals arranged in patterns corresponding to signatures information; and (b) other information related to identification of the one or more computer applications that is not signatures information;
ii. compare the content examined with (a) the known signatures information; and (b) the known other information to match known computer application information from the application identification library and the application identification database with information derived from the examination of the at least a portion of the one or more frames; and
iii. output information representing an indication of a likely computer application running or attempting to run on the network system based on the comparison of the examined signatures information with the known signatures information and the comparison of the other information with the known other information.

2. The device of claim 1 wherein the application identification engine is configured to weight the likely accuracy of the signatures information and the other information in the comparison.

3. The device of claim 2 wherein the signatures information and the other information are not weighted equally.

4. The device of claim 1 wherein the other information is derived from one or more mechanisms including TCP/UDP canonical port value, IP protocol value, heuristics, regular expression, history, computer applications installed on the network system and statistics.

5. The device of claim 1 wherein the information representing an indication of a likely computer application associated with the examined one or more frames includes a confidence level of the indication.

6. The device of claim 1 wherein the application identification engine further includes a scoring analysis engine configured to:
a. establish a mathematical value representing the likely accuracy of the computer application identified by the signatures information comparison and the other information comparison; and
b. generate a single output with an identification of the likely computer application associated with the received at least portion of the one or more frames.

7. The device of claim 6 wherein the scoring analysis engine assesses likely accuracy on a scale of 0 to 100.

8. The device of claim 1 wherein the device is a standalone appliance of the network infrastructure devices.

9. The device of claim 1 wherein the application identification engine further includes an application programming interface configured to enable loading into the application identification engine one or more custom mechanisms with corresponding indicators as one or more mechanisms for determining computer applications to be identified by the application identification engine.

10. The device of claim 1 wherein the application identification engine further includes an interface configured to enable loading into the application identification library one or more signatures of one or more computer applications identified by the application identification engine based on the comparison.

11. A device of a network system including a plurality of network infrastructure devices, the device comprising:
an application identification function, the application identification function including:
a. an application identification library including known signatures information about one or more known signatures in the form of signals arranged in patterns determined to be indicative of characteristics of one or more computer applications;
b. an application identification database including known information other than the signatures information, wherein the known other information is indicative of characteristics of the one or more computer applications;
c. an application programming interface configured to enable inclusion in the application identification database other information indicative of characteristics of the one or more computer applications; and
d. an application identification engine configured to:
i. examine content of at least a portion of one or more frames received at the device to detect: (a) signals arranged in patterns corresponding to signatures information; and (b) other information related to identification of the one or more computer applications that is not signatures information;
ii. compare the content examined with (a) the known signatures information; and (b) the known other information to match known computer application information from the application identification library and the application identification database with information derived from the examination of the at least a portion of the one or more frames; and
iii. output information representing an indication of a likely computer application running or attempting to run on the network system based on the comparison of the examined signatures information with the known signatures information and the comparison of the other information with the known other information.

12. The device of claim 11 wherein the output information includes a level of confidence in the indication.

13. A method for monitoring a network system to identify one or more computer applications running on one or more network devices of a plurality of network infrastructure devices of the network system, the method comprising the steps of:
a. receiving on a device of the plurality of network infrastructure devices one or more packets containing one or more frames, wherein the one or more frames are associated with a computer application running or attempting to run on the network system;
b. examining content of at least a portion of the one or more frames received to detect: (i) signals arranged in patterns corresponding to signatures information; and (ii) other information related to identification of the one or more computer applications that is not signatures information;
c. comparing the examined content with known signatures information in the form of signals arranged in patterns and known other information that is not known signatures information and that is representative of known computer application information;
d. establishing a most likely match of the known computer application information associated with the one or more frames derived from the comparison of the signatures information with the known signatures information and the other information with the known other information; and
e. outputting information representing an indication of a likely computer application running or attempting to run on the network system associated with the examined at least a portion of the one or more frames based on the most likely match.

14. The method of claim 13 wherein the information outputted includes a level of confidence in the indication.

15. The method of claim 13 further comprising the step of weighting the signatures inf

Assignees

• Enterasys Networks Inc
• Extreme Networks Inc

Inventors

• Rash Michael
• Bosa Patrick
• Graham Richard

Classifications

• G06F16/95

  Retrieval from the web · CPC title

• G06F40/30 Primary

  Semantic analysis · CPC title

• G06F16/24 Primary

  Querying · CPC title

• G06F17/30386 Primary

  Physics · mapped topic