Methods and systems for time-based application domain classification and mapping
A method includes detecting at a device on a network an application having an anchor domain, marking the application with a traffic source having an entry point domain that accessed the application and a time of detection and designating network flows from the traffic source within a predetermined time from the time of detection as belonging to the application.
1. A method comprising:
detecting, by a configurable device on a network, an application on the network having an anchor domain;
marking, by the configurable device, any traffic source that accesses the application via the anchor domain, and identifying a corresponding time of application access by each marked traffic source;
monitoring, by the configurable device, for each marked traffic source, network flows from that traffic source; and
designating, by the configurable device, for each marked traffic source, those network flows from that traffic source that occur within a predetermined time period from the identified corresponding time of application access by that traffic source as belonging to the application.
2. The method of claim 1 , further comprising modeling, by a multi-tenant controller, application sessions of the application.
3. The method of claim 1 , further comprising predicting, by a multi-tenant controller, bandwidth requirements of the application.
4. The method of claim 1 , further comprising performing, by a multi-tenant controller, anomalous session identification, quarantine, and restriction.
5. The method of claim 1 , further comprising analyzing, by a multi-tenant controller, traffic flow information with respect to the application.
6. The method of claim 5 , wherein the analyzing of traffic flow information with respect to the application is performed on a per session basis.
7. The method of claim 1 , wherein the network flows are encrypted.
8. The method of claim 1 , wherein the network comprises connectivity selected from a group including hybrid, physical, and logical.
9. The method of claim 1 , wherein a policy string defines a business policy that applies to the network flows.
10. The method of claim 9 , wherein the policy string comprises a policy string format.
11. A networked branch device configured to:
detect an application having an anchor domain on a network;
mark, via a processor having a memory storing instructions for performing actions, any traffic source that accesses the application via the anchor domain of the application, and identify a corresponding time of application access by that marked traffic source;
monitor network flows from each marked traffic source;
designate those network flows from the any marked traffic source that occur within a predetermined time period from the identified corresponding time of application access by the marked traffic source as belonging to the application.
12. The networked branch device of claim 11 , further configured to model application sessions.
13. The networked branch device of claim 11 , further configured to predict bandwidth requirements.
14. The networked branch device of claim 11 , further configured to perform anomalous session identification, quarantine, and restriction.
15. The networked branch device of claim 11 , further configured to perform application analysis.
16. The networked branch device of claim 15 , wherein the application analysis is performed on a per session basis.
17. The networked branch device of claim 11 , wherein the network flows are encrypted.
18. The networked branch device of claim 11 , wherein the network comprises connectivity selected from a group including hybrid, physical, and logical.
19. The networked branch device of claim 11 , wherein a policy string defines a business policy for application to the network flows.
20. The networked branch device of claim 19 , wherein the policy string comprises a policy string format.