System and method for network traffic management

1. A self learning system for managing a network, comprising:

a logic server for extracting a signature from a first traffic flow of a plurality of traffic flows on the network based on layer-3/layer-4 information of the first traffic flow;

a signature repository operatively coupled to the logic server for storing the signature and an identification of a layer-7 application associated with the signature; and

a high speed monitor operatively coupled to the logic server and the signature repository for identifying a second traffic flow of the plurality of traffic flows being associated with the layer-7 application by correlating the second traffic flow to the signature, wherein the high speed monitor is operatively coupled to the network for monitoring the network and forwarding at least a portion of the plurality of traffic flows to the logic server;

wherein the network comprises a peer-to-peer network;

wherein the layer-3/layer-4 information is obtained based on a time correlation metric (TCM) of the first traffic flow; and

wherein the TCM is associated with a superpeer of the peer-to-peer network.

2. The system of claim 1 , wherein the logic server comprises:

a pattern classifier for determining a classification from the plurality of traffic flows based on a layer-3/layer-4 header information of the plurality of traffic flows;

a policy generator operatively coupled to the pattern classifier for generating a traffic flow forwarding policy associated with the classification; and

a signature extractor operatively coupled to the high speed monitor for extracting the signature from the first traffic flow based on at least a portion of the first traffic flow,

wherein the high speed monitor forwards at least the portion of the first traffic flow to the signature extractor based on the traffic flow forwarding policy.

3. The system of claim 2 , wherein the high speed monitor comprises:

a policy repository operatively coupled to the policy generator for storing the traffic flow forwarding policy;

the signature repository storing a plurality of signatures;

a layer-7 monitor for identifying the first traffic flow being uncorrelated with any of the plurality of signatures; and

a low level monitor for extracting the layer-3/layer-4 header information from the first traffic flow and providing the layer-3/layer-4 header information to the logic server, whereby the classification is determined, the traffic flow forwarding policy policy is generated, at least the portion of the first traffic flow is forwarded, and the signature is extracted and added to the plurality of signatures.

4. The system of claim 1 , wherein the TCM comprises temporal correlation of a plurality of incoming connections and outgoing connections on a peering link associated with the superpeer, wherein the TCM differentiate the superpeer from a peer in the peer-to-peer network.

5. The system of claim 4 ,

wherein the network comprises a service provider network having one or more peering link, and

wherein the high speed monitor is operatively coupled to the peering link for reducing false negatives in the TCM associated with the superpeer.

6. A method of managing a network, comprising:

extracting a signature from a first traffic flow of a plurality of traffic flows on the network based on layer-3/layer-4 information of the first traffic flow;

storing the signature and an identification of a layer-7 application associated with the signature in a signature repository;

identifying a second traffic flow of the plurality of traffic flows being associated with the layer-7 application by correlating the second traffic flow to the signature; and

managing the network based on layer-7 application identification of the plurality of traffic flows;

wherein the network comprises a peer-to-peer network;

wherein the layer-3/layer-4 information is obtained based on a time correlation metric (TCM) of the first traffic flow; and

wherein the TCM is associated with a superpeer of the peer-to-peer network.

7. The method of claim 6 , further comprising:

determining a classification from the plurality of traffic flows based on a layer-3/layer-4 header information of the plurality of traffic flows;

generating a traffic flow forwarding policy associated with the classification;

obtaining at least a portion of the first traffic flow from the plurality of traffic flows based on the traffic flow forwarding policy; and

extracting the signature from at least the portion of the first traffic flow.

8. The method of claim 7 , further comprising:

providing a plurality of signatures in a signature repository;

identifying the first traffic flow being uncorrelated with any of the plurality of signatures;

extracting the layer-3/layer-4 header information from the first traffic flow for determining the classification; and

storing the signature in the signature repository.

9. The method of claim 6 , wherein the TCM comprises temporal correlation of a plurality of incoming connections and outgoing connections on a peering link associated with the superpeer, wherein the TCM differentiate the superpeer from a peer in the peer-to-peer network.

10. The method of claim 9 ,

wherein the network comprises a service provider network having one or more peering link, and

wherein the high speed monitor is operatively coupled to the peering link for reducing false negatives in the TCM associated with the superpeer.

11. A computer readable medium, embodying instructions executable by the computer to perform method steps for managing a network, the instructions comprising functionality to:

extract a signature from a first traffic flow of a plurality of traffic flows on the network based on layer-3/layer-4 information of the first traffic flow;

store the signature and an identification of a layer-7 application associated with the signature in a signature repository;

identify a second traffic flow of the plurality of traffic flows being associated with the layer-7 application by correlating the second traffic flow to the signature; and

manage the network based on layer-7 application identification of the plurality of traffic flows;

wherein the network comprises a peer-to-peer network;

wherein the layer-3/layer-4 information is obtained based on a time correlation metric (TCM) of the first traffic flow; and

wherein the TCM is associated with a superpeer of the peer-to-peer network.

12. The computer readable medium of claim 11 , the instructions further comprising functionality to: determine a classification from the plurality of traffic flows based on a layer-3/layer-4 header information of the plurality of traffic flows; generate a traffic flow forwarding policy associated with the classification; obtain at least a portion of the first traffic flow from the plurality of traffic flows based on the traffic flow forwarding policy; and extract the signature from at least the portion of the first traffic flow.

13. The computer readable medium of claim 11 , the instructions further comprising functionality to: provide a plurality of signatures in a signature repository; identify the first traffic flow being uncorrelated with any of the plurality of signatures; extract the layer-3/layer-4 header information from the first traffic flow for determining the classification; and store the signature in the signature repository.