Deep packet inspection application classification systems and methods
Deep Packet Inspection (DPI) application classification systems and methods are presented to enrich and improve application classification. Specifically, the systems and methods utilize domain and hostname information to enrich the DPI application classification. The systems and methods can include obtaining a packet; determining a hostname associated with the packet; utilizing a main rule to extract a domain from the hostname; and analyzing the domain and the hostname with a plurality of secondary rules based on the domain to deduce an application therefrom.
1. A non-transitory computer-readable medium having instructions stored thereon for programming a processor to perform the steps of:
obtaining a packet;
determining a hostname associated with the packet;
utilizing a main rule to extract a domain from the hostname;
identifying one or more secondary rules associated with the extracted domain; and
identifying an application in response to a match between one of the identified one or more secondary rules and a portion of the hostname including steps of
identifying a first application in response to a match between a first one of the one or more secondary rules matching a first portion of the hostname; and
identifying a second application in response to no match between the first one of the one or more secondary rules and the hostname and a match between a second one of the one or more secondary rules matching a second portion of the hostname.
2. The non-transitory computer-readable medium of claim 1 , wherein the instructions are further programmed to cause the processor to perform the steps of
periodically or based on new applications, updating the main rule and the plurality of secondary rules.
3. The non-transitory computer-readable medium of claim 1 , wherein the main rule includes a regular expression to obtain the domain, and the plurality of secondary rules include zero or more rules that are matched based on the domain and each of the zero or more rules includes a pattern that is matched in the hostname to a corresponding application based on such a match.
4. The non-transitory computer-readable medium of claim 1 , wherein the main rule identifies the domain, and wherein the plurality of secondary rules are used with the hostname to yield the application from matching expressions in the hostname.
5. The non-transitory computer-readable medium of claim 1 , wherein the hostname is determined through one or more protocols associated with the packet, and wherein the one or more protocols include any of Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), Secure Sockets Layer (SSL), and Quick User Datagram Protocol (UDP) Internet Connections (QUIC).
6. The non-transitory computer-readable medium of claim 1 , wherein the domain is a Content Delivery Network (CDN) and the plurality of secondary rules are matched to the CDN to yield the application from matching expressions in the hostname.
7. The non-transitory computer-readable medium of claim 1 , wherein the hostname is unavailable as being missing due to a protocol of the packet or encrypted, and the hostname is determined based on an Internet Protocol (IP) address of a sender of the packet.
8. A method comprising the steps of:
obtaining a packet;
determining a hostname associated with the packet;
utilizing a main rule to extract a domain from the hostname;
identifying one or more secondary rules associated with the extracted domain; and
identifying an application in response to a match between one of the identified one or more secondary rules and a portion of the hostname including steps of
identifying a first application in response to a match between a first one of the one or more secondary rules and a first portion of the hostname; and
identifying a second application in response to no match between the first one of the one or more secondary rules and the hostname and a match between a second one of the one or more secondary rules matching a second portion of the hostname.
9. The method of claim 8 , further comprising
periodically or based on new applications, updating the main rule and the plurality of secondary rules.
10. The method of claim 8 , wherein the main rule includes a regular expression to obtain the domain, and the plurality of secondary rules include zero or more rules that are matched based on the domain and each of the zero or more rules includes a pattern that is matched in the hostname to a corresponding application based on such a match.
11. The method of claim 8 , wherein the main rule identifies the domain, and wherein the plurality of secondary rules are used with the hostname to yield the application from matching expressions in the hostname.
12. The method of claim 8 , wherein the hostname is determined through one or more protocols associated with the packet, and wherein the one or more protocols include any of Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), Secure Sockets Layer (SSL), and Quick User Datagram Protocol (UDP) Internet Connections (QUIC).
13. The method of claim 8 , wherein the domain is a Content Delivery Network (CDN) and the plurality of secondary rules are matched to the CDN to yield the application from matching expressions in the hostname.
14. The method of claim 8 , wherein the hostname is unavailable as being missing due to a protocol of the packet or encrypted, and the hostname is determined based on an Internet Protocol (IP) address of a sender of the packet.
15. A server comprising:
one or more processors; and
memory storing instructions that, when executed, cause the one or more processors to
obtain a packet;
determine a hostname associated with the packet;
utilize a main rule to extract a domain from the hostname;
identify one or more secondary rules associated with the extracted domain; and
identify an application in response to a match between one of the identified one or more secondary rules and a portion of the hostname, wherein the instructions are configured to identify the application by
identification of a first application in response to a match between a first one of the one or more secondary rules and a first portion of the hostname; and
identification of a second application in response to no match between the first one of the one or more secondary rules and the hostname and a match between a second one of the one or more secondary rules matching a second portion of the hostname.
16. The server of claim 15 , wherein the instructions that, when executed, further cause the one or more processors to
periodically or based on new applications, update the main rule and the plurality of secondary rules.
17. The server of claim 15 , wherein the main rule includes a regular expression to obtain the domain, and the plurality of secondary rules include zero or more rules that are matched based on the domain and each of the zero or more rules includes a pattern that is matched in the hostname to a corresponding application based on such a match.