Systems, methods and computer program products for extracting port-level information of web services with flow-based network monitoring

1. In a computer system, a method for extracting port-level information of Web services with flow-based network monitoring, the method comprising:

identifying a registry machine;

coupling the registry machine to a traffic meter and flow monitor;

dynamically configuring the traffic meter, including:

exporting a first n bytes of a traffic payload;

exporting a sub-second traffic flow start and end times;

extracting service provider information from traffic flow exports, including:

analyzing the exported n bytes of the traffic payload to extract port-level information at the flow monitor;

extracting a value of an access point element;

mapping a logical service provider address to a physical address;

inserting the service into a Web Service Provider Registry within the flow monitor, thereby populating the Web Service Provider Registry, wherein the Web Service Provider Registry is populated by <IP,port> mappings, thereby indicating presence of a Web service application at <IP,port>; and

classifying an arbitrary network flow in the form of f=<ip 1 :p 1 ->ip 2 :p 2 ,proto> regarding its application, including:

initializing registry identification, in which an application tag of f is set to “unknown application”;

assigning the traffic flow a Web service in response to properties of the traffic flow coinciding with an entry in the Web Service Provider Registry;

assigning return flows an application derived from a standard library of <port, application> mapping;

assigning return flows an application derived from heuristics considering if a port is used multiple times also in other flows;

in response to a <IP,port> pair, {<ip 1 :p 1 >, <ip 2 :p 2 >} existing in the Web Service Provider Registry, setting f as a Web Service Application;

in response to f set to “unknown”, assigning f to a well-known application derived from a standard library of <port, application> mapping;

in response to exactly one port among p 1 and p 2 being present in the standard mapping, tagging f with an associated application;

in response to both ports p 1 and p 2 being described by a standard mapping, tagging f with the application of the port being used more often as service port during other occurrences; and

in response to both of the ports p 1 and p 2 being described by a standard mapping and none of the ports occurring significantly often as a service port during other occurrences, tagging f with the application of the lower port number p=min(p 1 , p 2 ).