System and method for classifying and managing applications over compressed or encrypted traffic

Abstract

System and methods for identifying and managing applications over compressed or encrypted traffic in a network are described. The first and second embodiments, which provides a method for managing applications over compressed or encrypted traffic respectively, comprise identifying applications on the traffic, saving the application classification per connection, and propagating the application classification to the network. A method for providing application identification over compressed or encrypted traffic is also disclosed, which includes an application recognition module configured to, among other functions, determine an application classifier for compressed or encrypted traffic without applying an application classification process, and utilize the application classification for previous packets originating from the connection for the current packets from the same connection.

What is claimed is: 
     
         1 . A method of identifying applications over one or more compressed interfaces in a network, wherein the network comprises at least one data compression device, the method comprising the steps of:
 receiving uncompressed traffic including application data from an end user device, wherein the end user device comprises a connection to a subnetwork;   determining an application classifier based on the application data;   saving the application classifier for the connection; and, classifying any consecutive packets from the connection with the same application classifier.   
     
     
         2 . The method of  claim 1 , further comprising the step of propagating the application classifier to the compressed interfaces in the network. 
     
     
         3 . The method of  claim 2 , wherein the propagating step comprises using the flow table that is stored on the data compression device. 
     
     
         4 . The method of  claim 2 , wherein the propagating step comprises sending information for previously stored in the connection from a previous device. 
     
     
         5 . The method of  claim 1 , wherein the step of determining an application classifier based on the application data comprises utilizing a cloud-based application classification service. 
     
     
         6 . The method of  claim 1 , further comprising the steps of:
 detecting new L7 information from the connection; and,   sending a new application trigger for the connection.   
     
     
         7 . The method of  claim 6 , further comprising the steps of:
 determining an altered application classifier for application data;   saving the altered application classifier for the connection; and, classifying any consecutive packets from the connection with the same altered application classifier.   
     
     
         8 . The method of  claim 1 , wherein the method is executed by a router in the network. 
     
     
         9 . The method of  claim 1 , wherein the method is executed by a switch or an access device in the network. 
     
     
         10 . A method of managing applications over compressed traffic in a network, wherein the network comprises at least one communication channel, the method comprising the steps of:
 detecting compressed traffic originating from a connection;   acquiring the application classifier for the compressed traffic without applying a classification process to the compressed traffic;   executing an application management process on the compressed traffic; and,   returning an application management process output to the network.   
     
     
         11 . The method of  claim 10 , wherein the step of detecting compressed traffic originating from a connection comprises the step of receiving a notification indicating that compressed traffic is present in the communication channel. 
     
     
         12 . The method of  claim 10 , wherein the step of detecting compressed traffic originating from a connection comprises the step of monitoring the communication channel until compressed traffic is detected. 
     
     
         13 . The method of  claim 10 , wherein the acquiring the application classifier step comprises accessing a stored application identifier from the connection. 
     
     
         14 . The method of  claim 13 , wherein accessing a stored application identifier from the connection comprises accessing a previous application identifier. 
     
     
         15 . The method of  claim 10 , wherein the application management process function comprises a reporting function. 
     
     
         16 . The method of  claim 10 , wherein the application management process comprises a quality of service function. 
     
     
         17 . The method of  claim 10 , wherein the method is executed by an application recognition module. 
     
     
         18 . A method of identifying applications over encrypted interfaces in a network, wherein the network comprises at least one data encryption device, the method comprising the steps of:
 receiving unencrypted traffic including application data from an end user device, wherein the end user device comprises a connection to a subnetwork;   determining an application classifier based on the application data;   saving the application classifier for the connection;   classifying any consecutive packets from the connection with the same application classifier; and,   propagating the application classifier to the encrypted interface in the network.   
     
     
         19 . The method of  claim 18 , wherein the propagating step comprises sending information for previously stored in the connection from a previous device. 
     
     
         20 . The method of  claim 18 , further comprising the steps of:
 sending a new application trigger for the connection in response to new L7 information;   determining an altered application classifier for application data; and, classifying any consecutive packets from the connection with the same altered application classifier.