Application identification
View Patent ↗A method may include receiving a communication from a client device and identifying a port number, a protocol and a destination associated with the communication. The method may also include identifying a first application being executed by the first client device based on the port number, the protocol and the destination associated with the first communication.
1. A method, comprising:
extracting, by one or more network devices, a signature from a first communication that is received from a first one of a plurality of client devices;
identifying, by the one or more network devices and based on the extracted signature, a particular application;
storing, by the one or more network devices and upon identifying the particular application:
additional information associated with the first communication, and
an indication that the additional information is associated with the particular application; and
determining, by the one or more network devices, that a second communication is associated with the particular application based on:
information associated with the second communication,
the stored additional information, and
the indication that the stored additional information is associated with the particular application,
the second communication being subsequent to the first communication.
2. The method of claim 1 , where the additional information, associated with the first communication, identifies at least one of:
a protocol associated with the first communication,
a destination address associated with the first communication, or
a destination port number associated with the first communication.
3. The method of claim 1 , where the additional information, associated with the first communication, identifies at least two of:
a protocol associated with the first communication,
a destination address associated with the first communication, or
a destination port number associated with the first communication.
4. The method of claim 1 , where the additional information, associated with the first communication, identifies a protocol associated with the first communication, and
where determining that the second communication is associated with the particular application includes:
determining that a protocol, associated with the second communication, is a same protocol as the protocol associated with the first communication.
5. The method of claim 1 , where the additional information, associated with the first communication, identifies a destination address associated with the first communication, and
where determining that the second communication is associated with the particular application includes:
determining that a destination address, associated with the second communication, is a same destination address as the destination address associated with the first communication.
6. The method of claim 1 , where the additional information, associated with the first communication, identifies a destination port number associated with the first communication, and
where determining that the second communication is associated with the particular application includes:
determining that a destination port number, associated with the second communication, is a same destination port number as the destination port number associated with the first communication.
7. The method of claim 1 , where the second communication is received from a second one of the plurality of client devices that is different than the first one of the plurality of client devices.
8. The method of claim 1 , where determining that the second communication is associated with the particular application, includes:
determining that the second communication is associated with the particular application, without performing a signature analysis on the second communication.
9. A network device, comprising:
one or more memory devices; and
one or more processors to:
identify, based on a signature extracted from a first communication that is received from a first one of a plurality of client devices, a particular application,
store, in the one or more memory devices and upon identifying the particular application:
additional information associated with the first communication, and
an indication that the additional information is associated with the particular application, and
determine that a second communication is associated with the particular application, based on:
information associated with the second communication,
the stored additional information, and
the indication that the stored additional information is associated with the particular application,
the second communication being subsequent to the first communication.
10. The network device of claim 9 , where the additional information, associated with the first communication, identifies at least one of:
a protocol associated with the first communication,
a destination address associated with the first communication, or
a destination port number associated with the first communication.
11. The network device of claim 9 , where the additional information, associated with the first communication, identifies a protocol associated with the first communication, and
where when determining that the second communication is associated with the particular application, the one or more processors are to:
determine that a protocol, associated with the second communication, is a same protocol as the protocol associated with the first communication.
12. The network device of claim 9 , where the additional information, associated with the first communication, identifies a destination address associated with the first communication, and
where when determining that the second communication is associated with the particular application, the one or more processors are to:
determine that a destination address, associated with the second communication, is a same destination address as the destination address associated with the first communication.
13. The network device of claim 9 , where the additional information, associated with the first communication, identifies a destination port number associated with the first communication, and
where when determining that the second communication is associated with the particular application, the one or more processors are to:
determine that a destination port number, associated with the second communication, is a same destination port number as the destination port number associated with the first communication.
14. The network device of claim 9 , where the one or more processors are further to:
apply at least one access rule or policy for the second communication based on the particular application.
15. A non-transitory computer-readable medium comprising:
a plurality of instructions which, when executed by at least one processor of a device, cause the at least one processor to:
identify, based on a signature extracted from a first communication that is received from a first one of a plurality of client devices, a particular application,
store, in one or more memory devices, associated with the device, and upon identifying the particular application:
additional information associated with the first communication,
and
an indication that the additional information is associated with the particular application, and
determine that a second communication is associated with the particular application, based on:
information associated with the second communication,
the stored additional information, and
the indication that the stored additional information is associated with the particular application,
the second communication being subsequent to the first communication.
16. The non-transitory computer-readable medium of claim 15 , where the additional information, associated with the first communication, identifies at least one of:
a protocol associated with the first communication,
a destination address associated with the first communication, or
a destination port number associated with the first communication.
17. The non-transitory computer-readable medium of claim 15 , further comprising:
one or more instructions to determine, when the additional information, associated with the first communication, identifies a protocol associated with the first communication, that a protocol, associated with the second communication, is a same protocol as the protocol associated with the first communication,
one or more instructions to determine, when the additional information, associated with the first communication, identifies a destination address associated with the first communication, that a destination address, associated with the second communication, is a same destination address as the destination address associated with the first communication, and
one or more instructions to determine, when the additional information, associated with the first communication, identifies a destination port number associated with the first communication, that a destination port number, associated with the second communication, is a same destination port number as the destination port number associated with the first communication.
18. The non-transitory computer readable memory device of claim 15 , where the second communication is received from a second one of the plurality of client devices that is different than the first one of the plurality of client devices.
19. The non-transitory computer-readable medium of claim 15 , where one or more instructions, of the plurality of instructions, to determine that the second communication is associated with the particular application include:
one or more instructions to determine that the second communication is associated with the particular application without performing a signature analysis on the second communication.
20. The non-transitory computer-readable medium of claim 15 , further comprising:
one or more instructions to apply at least one access rule or policy for the second communication based on the particular application.