A device and a related method for dynamic traffic mirroring and policy, and the determination of applications running on a network

Description of equivalent WO 2014151591 A2

0001<img file="WO2014151591A2_D0001.tif" />

0002BACKGROUND OF THE INVENTION f 001 ] The present invention relates to computer-based networks and their components. More particularly, the present invention relates to use, operation and control of the network.

00032. Description of ¾ ¾jfiLAtf

0004|8802| Interconnected computing systems having some sort of commonality form the basis of a network. A network permits communication or signal exchange through packet forwarding among computing systems of a common group In some selectable way. The interconnection of those computing systems, as well as the devices that, regulate and facilitate the exchange among the systems, represent a network. Further., networks may he interconnected together to establish i ternetworks. For purposes of the description of the present invention, the devices and functions that establish the interconnection represent the network Infrastructure, The users, computing devices and the like that use that network, inirasrructure to communicate are referred to herein as attached functions and wil l be further defined. The combination of the attached functions and the network infrastructure will he referred to as a network system.

0005|O0 3| The process by which the various computing systems of a network or

0006internetwork communicate is generally regulated by agreed-upon signal exchange standards and protocols embodied in network interlace cards or circuitry and software, firmware and rnicrocoded algorithms. Such standards and protocols were borne out of the need and desire to provide interoperability among the array of computing systems available from a plurality of suppliers. Two organizations that have been responsible for signal exchange standardization are the Institute of Electrical and Electronic Engineers (IEEE) and the Internet Engineering Task

0007Force (IETF), In particular, the IEEE standards for internetwork operabiiity have bee established, or are in the process of being established, under the purvie of the IEEE 802 committee on Local Area Networks (LANs) and Metropolitan Area Networks (MANs). The IEEE standards include many well defined met ods of wired, fi ber optic and Radio Frequency ( F or wireless) methods of network communications and are well known to those skilled, in the art

0008(^'0O0 J Access to applications, tiles, databases, programs, and other capabilities associated with the entirety of a discrete network is restricted largely based on the identity of the user and/or the network attached functions. For the purpose of the description of the present invention, a "user" is a human being who interfaces via a computing device with the services associated with a network. For further purposes of clarity, a "network attached function" or an "attached function^* may he a user connected to the network through a computing device and a netw ork interface device, an attached device connected to the network, a function using the services of or providing services to the net-work, or an application associated with an attached device . Upon authentication or other form of confirmation of the offered attached function identity; the attached function may access net-work services at the level permitted for that identification. For purposes of the present description, "network services" include, but are not limited to, access. Quality of Service (QoS), bandwidth, priority, computer programs, computer applications, databases, files, and network and server control systems that attached fimctions may use or manipulate for the purpose of conducting the business of the enterprise employing the network as an enterprise asset.

0009(¾0Θ5^'| A network administrator grants particular permissions to particular attached functions by establishing network use policies which are enforced at various points i the network. A network policy is an action (or nonaction) to he undertaken based on the existence or occurrence of a defined condition or event An "evenf for purposes of describing the present invention, is a detectable or discernible occurrence that may be considered to have an impact on network operations or perfonnance. Events may be defined by the network administrator. Some events warrant the undertaking of an action to respond, address or otherwise account for those events. Events that warrant the undertaking of some action may be referred to herei as

0010"triggers " Examples of events that may be trigger events include, but. are not limited to, time outs, link changes up or down, link speed changes, user changes, device changes, device additions, network service changes, access device changes, location changes. Intrusion Detection S stem (IDS) or Firewall events, application access requests, priority change requests, protocol changes, the addition of a wireless access user, policy changes made, bandwidth changes, routing link changes, changes of monitored conditions, local and remote policy changes and network system changes, More generally for purposes of the description of the present invention, a "trigger" is any detected or observed event, activity, occurrence, information or characteristic Identified in a network system by the network admin strator as being of interest for the purpose of making a modification to an assigned set of policies. The types of triggers that define usage restrictions may be of any type of interest to the network administrator.. Network policies are generally directed to administration, management, aid/or control of access to or usage of network services. A network policy may also be a policy abstraction that Is the translation of one or more network policies to a different level of abstraction. For example, multiple network use policies may be bundled into a higher-level abstract network policy for ease of handling and naming; a network policy set. is simply a policy composed of one or more policies.

0011f (MXNif The network policies are typically defined m and regulated through a network policy server device of the network infrastructure controlled by the administrator. The established policies are transmitted to network interlace devices of the network infrastructure, referred to herein as packet forwarding devices, at a point of connection to a attached function. That connection point is referred to herein as a port of the packet forwarding device. As part of the authentication process, a particular set of policies are established by the administrator for that attached function. That is, the port at which that attached function is attached to the packe forwarding device is configured to effect those policies, often by installing other policies or installing or enabling a set of rales for the policy. For example, QoS, bandwidth, and priority levels ma be set at certain values for one identified attached function and at different levels for another attached function.

0012| MKI7} A network session is the establishment of an association between an attached function and one or more network services through the network infr structure. The session includes a series of electronic signal exchanges referred to as packets and one or more packets to the same destination is typically referred to as a flow. It is to be understood that a network- system may be embodied in the combination or interrelation between one or more attached functions and one or more network inirastruciare devices. At the outset of a network session, ofte in relation to the authentication of the attached function seeking to initiate the session, an association is created between the session and one or more network services, constrained by one or more network policies established by the administrator through a network control manager device such as the network policy server and carried out. or enforced by one or more of the packet forwarding devices of the network, infrastructure.

0013| e08^'| Access to network services may be limited by conditions other than attached function user authentication. For example, an attached function seeking usage of a discrete network system through virtual private networking may be isolated from certai network services simply because private network entry is made through a public portal such as the internet. It is also understood that i certain settings offering wireless connectivity, network usage may be limited upon detection of attached function attempts to seek unauthorized access to specified restricted network services. However, these isolated efforts at network user control based on something other than user identification authentication are insufficient for complete network control and security. What is needed is a comprehensive and integrated, system for controlling network usage tor all users and devices at all times and to allow users to access the network services from alternate or unknown devices or device types. Additionally, authorized users may at times use the network in unauthorized ways, so what, is needed is a way to identify, limit and enforce uses of all accesses independently to allow proper uses to continue and limit imatuhorked uses or simply uses that go against administrator set network policies. The limitations to use also need to be structured in ways the network administrators and authoritative personnel can structure, organize, communicate, administer and enforce the access and use of the network. Network policy or a policy driven network is one organizational approach to abstract the control of the network to users, roles and network services. Policy based networking has, however, not been able to provide limits to use based on the applications being used in the network since the method, placement, compute power and granularity of use has not been built into the network fabric before now. The identification of who, where and what applications are running in the network system can then lead to control and allocation of network resources to support the needs as allowed and administered.

0014|88β9| Events and activities do occur that ma be harmful to the network system. For purposes of this description, harm to the network system includes, for example, denying access to the network, denying access to the service, once access to the network is allowed, intentionally tying up network computing resources, intentionally forcing bandwidth availability reduction, nd restricting, d nying or modifying network-related ormafion^, Intrusion Detection Systems ate used to monitor the traffic associated with network sessions in an effort to detect harmful activity. However, CDS functions normally only monitor traffic and analyze the traffic flow for harm, they do not analyze other information nor do they generate or enforce policies. They are designed to observe the packets, the state of the packets, and patterns of usage of the packets entering or within the network infrastructure for harmful behavior. There is some limited capability to respond automatically to a detected intrusion including through intrusion prevention systems. However, these detectio systems are configured to search for specific patterns of signals that represent harmful activity. The benefit of the IDS is dependent on the effectiveness of the library of signatures used to detect harmful transmissions.

0015£00i8^'| IDSs frequently implement a signature language that includes functionality allowing a security analyst to describe harmful activity on. the network. Such signature languages are fairl complex in order to deal with application layer encodings, handle evasion techniques leveraged by attackers, reduce false positives and generally provide a reliable way to describe the characteristics of current netw ork harm efforts. Applications that may be hanufel to the network or at least that can slow down network processes that are not of sufficient importance to the enterprise can be difficult to reliably characterize or "fingerprint" due to efforts to evade such characterizations. Encrypted Bmorreni and Skype are examples of suc

0016applications that w difficult to fingerprin ft would be desirable to have a network function that can fingerprint applications in an effective manner. To the extent any IDS has some form, of application detection functionality, it is limited to evaluating for malicious activity. The network administrator, in order to he more effective in protecting network sen ices and maximizing network efficiency, would prefer to have characterization, of as many applications used on the network as possible, regardless of whether any of the applications are malicious.

0017[0(1111 From e security and usage efficiency perspectives, the network systems industry has had some difficulty keeping pace with the explosion in the number and types of applications used on. networks. This revolution is being powered by new models for application availability embodied by Bring Your Own Device (BYOD) and Cloud Computing environments. The networking model, thai has been in existence along with the infrastructure that maintains availability and applies policy has not kept pace with the rapid increase in. applications, ft is desirable to have a network infrastructure architecture that is configured to keep pace with the ex sion of application usage on the network.

0018S |0O12| For purposes of deseribirsg the present invention, an "a lication" which may also e refexed to herein as a "computer application" to be characterized (including, lor example, by fingerprinting and such other mechanisms as described herein) is any computer code thai communicates over the network interface or uses connnnnieatiomenahling devices of the network as part of it operation. An applicatio is a computer program designed to perform an action. The application can run on any type of computing device Including, but not limited to, a server of a network, a desktop computer, laptop, a tablet. PDA or a smar phone. An application, for purposes of the presen invention, includes system computer programs that rim computing devices, utility computer programs that perform maintenance and upkeep of computing devices and networks of computing devices, programming tools used to create computer programs, as well as high-level functional computer programs that perform tasks and carry out activities initiated by end users on computing devices. As noted, operating systems are also considered to he applications with respect to the present invention as they may be characterised based on infe ences! made using operating system, specifics from their

0019communications. In addition, network infrastructure device themselves use the network for routing protocols and other traffic such as network management which we will also consider to he applications or uses of the network as demonstrated b adding traffic to the network system. Further, "application fingerprinting"' or "a plicati n identification^'' is the act of collecting network traffic and parsing it according to a packet or flow signature set or by statistics, heuristics, history, installed applications base, or other mechanisms, including custom mechanisms, it may include the use of classification, techniques used in layer 2 and layer 3 switches and routers. This characterisation application identification represents all applications and uses comnnmicated on. the network system directly or indirectly. The term "applications running on the network" or variants of that term are used herein to describe those applications that are used, accessed or otherwise engaged through one or more devices of the network infrastructure,

0020!§0.OJ The Open System Interconnection (OS!,* model defines a networking framework to implement protocols in seven layers. Control is passed, from one layer to the next, starting at the application layer In one station, and proceeding to the bottom layer, over the channel to the next station and back up the hierarchy. The seven layers i reverse order are: Application (layer

00217), Presentation (layer 6), Session (layer 5), Transport (layer 4), Network (layer 3), Data Link (layer 2} and Physical (layer 1 ). The present, invention directed to management of signal exchanges through these OSI layers and they may be referred to herein from time to time.

0022|0OI4^'I The Application layer supports computer program a lications and end-user processes. Conimu cation partners are identified, quality of service is identified, user authentication and privacy arc considered, and any constraints on data syntax are identified, Everything at this layer is application-specific. This layer provides application services for file transfers, e-mail and other network software services. Tel.net and FTP are applications that exist entirely in the application level. Tiered application architectures are part of this layer. The Presentation layer provides independence from differences in data representation (e.g., encryption? by translating from, application to network format, and vice versa. The presentation layer works to transform data into the form that the application layer can accept. This layer formats and encrypts data to he sent across a network, providing freedom from compatibility problems. The Session layer establishes, manages and terminates connections between applications. The session layer sets up, coordinates, and terminates conversations, exchanges, and dialogues or 'flo '' between the applications at each end of an exchange between attached functions, between attached functions and network infrastructure devices and be ween network. Infrastructure devices. It deals with session and connection coordination. The Transport layer provides transparent transfer of data between end systems and is responsible for end-to-end error recovery and flow control The Network layer provides switching and routing functionalities, creating logical paths, sometimes referred to as virtual ckcuits, for ransmitti g data from node to node. Routing and forwarding are functions of this layer, as well as addressing, internetworking, error handling, congestion control and packet sequencing. The Data Link layer encodes and decodes data packets into bits. It -furnishes transmissio protocol knowledge and management and handles errors in the physical layer, flow control and frame synchronisation. The Data Link layer s divided into two sab layers: The Media Access Control (MAC) layer and the Logical Link. Control (LLC) layer. The MAC sub layer controls how a computer on the network gains access to the data link and controls permission to transmit on it. The LLC layer controls frame synchronization, flow control and error checking. The Physical layer conveys the bit stream - electrical impulse, light or radio signal - through the network, links (wires, fiber, RF) at the electrical and mechanical level. It provides the hard ware means of sending and receiving data on

0023? a carrier, including semiconductor components, wires, cables, cards and other physical structures.

SUMMARY OF THE INVENTION

0025flMhlSJ The present invention includes an application identification function, a dynamic traffic mirroring function, a policy based dynamic mirroring function and a network system controller, all directed to improving network manageability, security and efficiency of operation. The application identification function earned out through an application identification engine, enables the determination, or identification of the applications running In the network system through devices; of the network mfmsiructure by snooping the flows of network traffic and making a characterization, of the likely application associated with flows with a minima! amount of data in observed frames of received packets to do so, Signature languages have been leveraged in application fingetprin ing products, but these languages were not in the past developed specifically for the purpose of application fingerprinting. The present invention takes advantage of intrusion detection languages for the purpose of fingerprinting applications with significant extensions to improve the application identification capabilities.

0026The application identification function of the present invention includes several mechanisms., but is not .limited to those described herein, in order to identify computer applications running on. the network through examination of characteristics of information associated with frames of packets received on one or more devices of the network. A first mechanism is the signature-biased parsing of network traffic with a signature language that is ideally adapted to describe what application communications look like based on the packets transmitted by the application. A second mechanism is a heuristics-based processing approach to inter the existence of certain applications that cannot reliably be fingerprinted with signature- based means. Other identification options include, but are not limited to, port values, protocol values, statistics analysis, customized programs dependent on characteristics unique to a program and OS! layer 2 information. Further active and passive actions may be employed as

0027mechanisms for application identification including, for example, the probing of attached network and external devices for installed applications, e.g., by sending requests for information associated with applications running on the network. The very presence of certain devices on the network may also be used to ascertai the presence of certain applications as those devices communicate on the network.

0028O017 In .making an application identification, just as network intrusion detection systems develop strategies for the reduction of false positives when trying to detect malicious network usage, proper application fingerprinting must also leverage similar strategies. Reliable application fingerprinting is best accomplished through this combination of both signature and heuristic processing, bat there is an inherent, conflict between the two techniques when both are applied simultaneously- That is, if a sig ature says that certain network traffic is application X but a heuristic method says that the same traffic is application Y, which should be most trusted? Through the construction of a scoring system of the present invention with all available mechanisms including those described herein receiving a reliability score, this problem is resolved and leverage all techniques to the best advantage. The scoring system may be derived from a network trairuug period tor any specific application tlngerpririting deployment, and through the information gained m the training period, a set of scores is assigned to all signatures and heuristic methods. After the training period is over, then the most reliable application fingerprints are those that attain the highest matching score. That determination is established in the application identification function and transmitted to one or more other devices of the network, including a network control manager.

00290018_.1 The present invention further includes mechanism by which application fingerprinting may be enhanced by the experiences of others. That is, the training arrangement described above is effective when sufficient packet transmission occurs in the network to enable the application charac erization, However, the network may not see all applications or enough data for all applications to effect sufficient training. The present Invention Includes the addition of at least pluggable binary modules so that any user can develop custom fingerprinting techni ues according to a packet inspection Application Programming Interlace (API). This allows the users of the present invention to augment supplied application rlngetprinting functionality with new or custom techniques for fingerprinting applications in ways not included in the supplied version. This enhancement of a vailable fingerprints is analogous to an. open signature language that became an essential component of major intrusion detection systems in the security world and is desirable because some applications are highly specialized and require dedicated algorithms for reliable detection. By providing an open API for third parties to create ehamcterization programs against, the present invention provides users with a unique

0030infrastructure to acquire packet, data that can he processed by the application identification inaction. An example usage of this option is the implementation of the Lxihn Algorithm for the detection of credit card data as it traverses a network.

0031iH> 9] An aspect of the present invention is the forwarding of one or more frames contained in packets or one or more portions of frames in packets of a flow or at the initiation of a session to the application ident ification engine of one or more devices o the net work infrastructure for the purpose of determining the application associated with the flow/session being established. Thai is, the mirroring of the one or more packets or portions of packets to a destination other than the original intended destination. The present inventio includes a dy namic network traffic mirror function that may be used to mirror traffic through a dedicated port, or a selectable portal of a packe forwarding device. The mirroring may be done selectively rather than simply on a regular basis, which would be inefficient. The abilit to dynamically launch/create a traffic (flow) mirror to an IDS and/or to the application identification engine Improves the capability to monitor the flows of the network anywhere while only needing a very li mited set of monitors, I DS sensors or APP ID devices. Frames of flows of traffic from any packet forwarding device can be mirrored without disturbing the normal routing of the messages and maxim izing the usage of network bandwidth and the usage of other devices of the network, including IDSs. The dynamic network traffic mirror function can be included or dynamically added to a packet forwarding device of the network system,

0032I20) Packet frmvardmg devices of the network infrastructure transmi and receive packets through their ports, A ⁴ⁱporf includes a physical component that is a structure to establish a connection between network system devices, including packet forwarding devices, servers and attached functions. However, as is known by those skilled in the art. and as used herein, a port is also an application-specific or process-specific software or software and hardware: construct serving as a communications endpomt in a network system, the endpoini may be a device of the network infrastructure or an attached function, A port is associated with an. IP address of the host, as well, as the type of protocol, used for communication. A port i s identified

0033Ibr each address and protocol by a 16-bit number, commonly known as the port number. The port number, added to a network device's address (such as the device's IP address), completes the destination address for a coanmnication session- It is the combinatio of an IP address and a port .number together thai must be globally unique for all communication sessions in a network system. Different IP addresses or protocols may use the same port number for eonrmunication..

003410 2.1 J As seen above a ^ o t" may have several meanings and this may lead to confusion in Its use. Further, there Is another concept regarding the mirroring of data from a mirror source to a mirror destination. In a simple configuration, the data packets are simply copied to another physical port, on the packet forwarding dev ice. In the classic sense a "port mirror ^* is the copy ing of all the data received (and/or transmitted) being copied to another port on the same switching device. The traffic mirrors defined herein are more comprehensive than merely copying the traffic to another physical port. The mirrors may use a Generic Routing Encapsulation (GRE) or a Virtual Private Network (VPN) as a transport level tunnel to another device anywhere on the enterprise network, or, in tact, anywhere across the Internet, A MAC level or VLAN

0035encapsulation may also be used as a transport mechanism, such as the VLAN connection path, encapsulation described in US Patent No, 6,449,279 incorporated herein by reference, to another device such as the IDS or APP ID engine. To help make clear the operation of the mirrors used herein, the term "poriaP^' is used to identify the connection the mirror source uses. The portal may be as simple as another port on the same device or the traffic may go back out the same physical port on tire device encapsulated or tagged in some way. Tunnels, virtual ports, internal interfaces, VPNs, other protocols, and other transport mechanisms including dedicated lines of any physical layer type may all he set up, used and defined as part of the mirror portal. The term portal therefore refers to that logical link to the mirrored traffic's destination. The portal acts as a connection including as a tunneled connection, and s responsible for delivering the traffic to the other end (the destination end) subject to the limitations of the portal itself Some portals guarantee transport delivery, while others are best effort delivery, still other portals may have encapsulation limitations. Mirror set-up along with destination selection, location, service and performance or dynamic mirroring policies may determine the portal or portal type to use for a specific mirror.

0036(0 22| The dynamic traffic mirroring function of the present invention is not limited to only facilitating the identification of computer applications running o the network. It provides the capability to select options based on a plurality of criteria to mirror any portion or ail of the frames of packets received on the network. The dynamic traffic mirroring function can. do at least one or more of; 1 ) mirror ail or any portion of the Sow, such as the first N packets, the first M fields, the first L Bytes, selected fields and one-way or bidirectional. Bows; 2) define Hows by source address-destination address, Tuple, 5-tupIe, application, etc.; and 3} transport the packets by portals to generalized or specific destinations. It can be controlled by a IDS and/or by a dynamic mirror controller, the network control manager or other network infrastructure devices.

0037The function may be located in a. network device selected io cany ou selectable mirroring fractions based on one or more of mirroring device load, bandwidth, security (or encryption could be added), ability to maintain flow pathways to a. designated location, require encryption for transmission beyond the designated location, locality (of source, receiver or another device of the .network), direction or Hows (e.g., mirror the source of a Sow at one point and the traffic returned from the destination at another point in the network). This set-up flexibility allows for more bandwidth-efikient mirroring, it can be used to take mirror traffic out of the high "cost" paths of the network, it can be used to control mirror traffic to be set at low priority when in.

0038"'search" mode and then set to a higher priority when in "isolate a problem" mode. Moreover, with the dynamic mirroring thnetion, traffic can be controlled by more than one IDS, application identification engine, monitor, logger, etc. to more than one destination and/or to multiple monitoring devices that can be specialised or dedicated to certain tasks without physical network topology location dependence, in effect, this function provides automated dynamic intelligent filtered So mirroring to multiple portals.

0039|IM)23J Mirroring has typically been a manually set up "port mirror" to another port on the switch, The dynamic traffic mirror of the present invention extends the ability to " ow mirror" the first ^-packets or other varying sets of rarnes in a .new flow and other selections of existing flows or data within th flow. This function brings data Sows from anywhere in the network to the IDS or ir other selectable network infrastructure device or function. IDS devices no longer need to be located on the segment they monitor i the network, although they could be, with other flows not normally passing that point being "mirrored" to the device. This makes the IDSs, as well as other types of monitoring devices, of the network more efficient.

0040Mirrors can he controlled to only "mirror" relevant traffic and the mirroring controller can define/change the mirrors based on detected events, t.inre-oi~day, IDS load, etc. It is noted that many IDS signature matches happen early within application layer communications, so the dynamic mirror hmeiion with respect to application identification at least is an. IDS enabler while at die same lime allowing for greater efficiency of flow setup and activity. More broadly, the dynamic mirror function can be used to filter traffic flows and that filtering can be changed automatically on~t.he~.fly. Less investment in monitoring equi me t such as Application

0041Identification or IDS equipment required by customers, is accomplished cheaper and better than has heretofore been possible with more flows monitored and less monitor processing bandwidth being used to handle packets for which examination, of the content of frames of those packets does no don't contribute to enhanced Intrusion detection. The dynamic mirroring function enables transmissio to multiple devices of the network by establishing multiple portals to do so. As a result it is not limited to a specific transmission port and niirroring to more than a single device (dynamically) can occur at one time. Existing port mirrors tend to mirror the traffic to only one other device on a single port.

0042|8 24J The set-up, teardown and filtering employed In the mirroring activity can he adjusted based on network policies, the detection of particular triggers by the device performing the mirroring or another network infeistructure device. This aspect of the present invention may^¬ be set tip and controlled by the dynamic mirroring policy. Examples for criteria which may generate a mirroring activity include, but are not limited to, frames of packets, the conten of particular fields in a frame, flow counts, the end of a flow, a regularly timed mirroring initiation or any other conditions of interest to the network administrator can be used as conditions for establishing mirroring activities on a device of the network. n addition, events or criteria may be established tor stopping the mirroring inaction. For example, a . mirroring activit may be stopped based cm the data value in a packet field, a network, regional or device specific event, a simple count of packets or other Sow metric, a time out, the end of flow or based on a change in a prioritization condition (i.e.. a condition has occurred wherein mirroring must be performed on a different flow thai has been designated a being of higher priority for mirroring, particularly whe the device carrying out the mirroring has limited capacity in that regard,

0043£00251 As noted, the dynamic traffic mirroring fene ion is not limited to IDS operations or even application-specific network analysis and control. For example, it may be used more generall in network access control. Dynamic traffic mirroring points are established through dynamic mirroring policies of a dynamic traffic policy function. The mirroring policies that may be dynamically established are dependent on a wide range of triggering conditions. Examples of such mirroring policies Include, but are not limited to; 1) mirror the first N packets of any new application flow front a source to the nearest IDS; 2) mirror ail flows from a newly authenticated user for a specified time to an available application engine; 3) determine the IBS to use based on loaddocatlon/prlorlty 4) randoml mirror flows (spot checks) as bandwidth and IDS loads allow; and 5) mirror all new -flows to/from t e internet. router/gateway/firewall for packets. Current mlrronrsg policies, to the extent they exist in a network system, are either ad hoc or simply manually controlled by administrators. These may he limited to the locality of IDS devices and network topology. Flows of traffic trom any packet forwarding device may be mirrored based on policy rules based on ; 1) network loads at various points; 2} time of the day; 3) link outages and other topology bandwidth constraints; 4) server location and status; 5) user numbers; and 6) wireless access point use and number. Further, the dynamic mirroring func ion may be used based on policies based on the conditions noted herein regarding dynamic mirroring ot application Identification,

0044IW2 >\ T his general policy-based mirroring allows network administrators to set network mirror policies tor various network monitors including, for example, application identification appliances, IDSs, network loggers, analyzers, etc. These policies may he set based on device,

0045-user, topology, time-oi-day, network events (e.g., triggers) mirrored to device availability, location and load. Given the brea * of dynamic mirroring capabilities, the capabilities exceed administrator manual set-up capabilities. Rapid dynamic mirrors can better optimize monitor and

0046IDS devices and possibly other network devices and remove their physical location as a primary rhetor in their physical placement In the network topology. This provides the added structure of policy rules tor dynamic network traliic mirroring so that policies may be based on user roles and or device services, for example. As noted, it provides the capability to improve coverage and IDS utiliza io s and it i pnaves the ability to ^monito " the right Sows (iiitercd) flows at the right times, The present invention thus provides an automatic way to deal with network events.

0047For purposes of the present invention, automatic actions mean those actions that are carried out by a device of the network system based on a condition or event detected by a device of the network system that causes the initiation, through one or more devices of the network system, of changes in one or more of one or more policies, one or more rules, and one or more actions without requiring human intervention to initiate the one or more changes when the condition or event has been detected.

0048In the context of application-based dynamic network policy, the presen invention includes the usage of such mloor ttion to apply a policy to an application level how, or set. of flows or to modify ocal or network-wide policies. Th application identification function described herein can be used to extract metadata such as HTTP request mf&tr&ts, SSL common names, isern mes in various protocols, Kerbetos key information and .more as a mechanism to change network policy and use rules on the fly. Thresholds, pattern matches, and other modifiers can he leveraged to have the network enforce policy roles against flows ^'based on these metadata specifies. The application signatures fingerprinting mechanism for application identification can be enhance to include the ability to log application Information including, for example, layer met data, and further can be used tor modification of network policy. The other mechanisms described herein fer application identification may also be used to characterize i formation associated with applications running on the network and that information may he used in establishing policies. Beyond changing policy based on a macro-level application. fi«ger >rinf, the usage of metadata allows network policy to be applied based on much more fine grained application descriptors. In one version of this functionality, the policy enforcement mechanism can parse and leverage application identification Information produced by the application fingerprinting timet ion. In another version, metadata may be transmitted to a network policy engine for the purpose of distributing policy enforcement to appropriate points (including close or at the point of entry) in the network. This enables a finer granularity of enforcement and control of flows than has been previously provided, if that Is of Interest.

0049| 28J Embodiments of policy enforcement options that may be established with greater effectiveness include, hut are not limited to: I ) disable a port; 2) disable MAC address; 3) disable a user; 4} quarantine a user; 5) block a specific application flow; 6) block an IP address; 7) snipe a TCP connection; 8} disable communication for an application; 9} disable communications to an attached function; 10) disable a network, communication, in either or both of a forward path and a reverse path; 1 1} baudwidth-IImit an application by a particular user; 12) bandwidth-limit an application for all users of the network system; i 3) log all application data; and 14) honeypot the application flow, While the first four examples are widely In use, the others require the identification of the application f ow within the user/devices total data flow. This ability to characterize applications effectively may be used to establish new policies based on those applications and the new metadata associated with those applications, which, such ne policies may not be possible but for that information. One view of how this functionality may be -useful in a network security mi efficiency control environment is noted as follows. While all employees may be gives Internet access, Emits may be placed on. time-of-cky access, bandwidth, or complete us of an application. Bandwidth or data limits can be placed en uTnbe, Gambling application may be prohibited. This liner granularity of knowledge based on applications may be characteti ed in this context as applying policy based on applicatio layer metadata that is transmitted on the wire. For exam le, the network administrator may block particular SSL connections based on a particular SSL certificate commo name, or block erberos

0050communications that rely on a particular key. Policy enforcement may be targeted at the application level allowing administrators to target policies best sorted for their business needs, j¾ 29J The ability to identify applications running on any device of, or connected to, the network infrastructure, as well as the ability to dynamically mirror traffic enables the

0051establishment of a. no vel network architecture thai may be configured to be appl ications-centric,

0052The application identification capability provided by the functions described herein allows the application to be Identified, tied to devices and users, located in the network and controlled via organized network policies. With proliferation of mobile devices, especially smaxtphones and tablets, and the countless applications (apps) a ailable for them, there is a strong need for this added level of control Components of the network architecture include; 1) the dynamic mirroring capability described herein that is part of the network system established or that can be established, in one or mo e packet forwarding devices of the network, including one or more network entry devices; 2) frte application identification inaction, which may be carried out in a standalone device or another device of the network infrastructure, including a device having packet forwarding as a primary function; and 3} 4) network, and policy management functions including a monitoring function, thai can take in monitored information, including information from the application identificatio function,, network status and event and administrative policy input, and can issue policy directives, either directly or through another network infrastructure device. This final step is also referred to as a Policy Decision Point (PDF) extended to embrace application level control. The enhanced ability of Policy Enforcement Points ( EPs) of the network combined with typical network deployment paradigms (gateway, access edge, core/distribution, and data center) in order to maximize the ability to identify applications running through the network and the ability to apply network policy controls to them based on that information and decision making enhances network operational efficiency while also m ismmins or enhancing network security_* The architecture can also Include aggregation mi

0053IB reporting functions that collect and analyze application identification and other monitored intbnnatlon. Thai Information may be used to enforce, add and establish network policies as well as mirroring policies.

0054{ 0301 The dynamic mirroring function enables a targeted approach to frame mirroring In order to maximize application identification effectiveness while simultaneously minimizing data that must be mirrored to an identification appliance or to any network infrastructure device configured to carry out the application identification function. This allows the whole solution to scale to extremely large and fast networks. The application identification function, which- as noted, may be a standalone device or embodied in another ne work infrastructure device, collects and analyzes the transferred frames of packet data flows that arc provided by dynamic mirroring and also integrate other information, such as Netflow information and the other application identification mechanisms noted herein. The network policy function evaluates the information gathered and ears apply network policy controls (enforcements) on a per-flow basis at, or close to flow Ingress,

0055|0 31] The details of one or more examples related to the invention are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the invention will he apparent from the description and drawings, and from any appended claims,

BRIEF DESCRIPTION OF THE DRAWINGS

0057|I )32| FKi I is a sinrpiirled diagrammatic block representation of an example network system wit the functions of the present. Invention,

0058[0033_.1 ^*. 2 Is a simplified block representation of a combination network infrastructure devices arranged for application identification,

0059|0034| FIG. 3 is a simplified block representation of an application identification engine of the present invention,

0060[ 0351 P1G$&lt; 4A-4C list scoring results for the identification of a set of applications generated by the scoring machine of the present invention.

0061|0036[ PIG. 5 is a simplified block representation of the dynamic mirroring function of the present invention in a network device.

0062[0037J FIG. 6 is a representation of a packet modification encapsulating a frame or portion of a frame to be mirrored. | ¾3$] FIG. 7 is a simplified block representation of a first network topology arrangement using dynamic mirroring and application identification.

0063|(H 9| FIG. 8 is a simplified block representation of a second network topology arrangement using dynamic mirroring and application identification.

0064|0940J FIG. 9 is a simplified block representation of a third network topology

0065arrangement using dynamic mirroring and application identification.

0066{i%U\} FIG. .10 is a simplified block representation of a fourth network topology arrangement using dynamic mirroring and application identification.

0067|0$42] FIG, 1 ! is a simplified flow diagram of primary steps associated with a method for controlling dynamic traffic mirrors with mirroring policies.

0068j^'0043j FIG. 12 is a simplified flow diagram of primary steps associated with a method for dynamically mirroring network traffic,

0069|(N 4] FIG. 13 is a simplified flow diagram of primary steps associated with, a method for managing operations of a network based on the abil ity to identify computer applications running on the network.

0070j¾045J FIG. 14 Is a simplified flow di gram of primary steps associated with a method f or identifying computer applications running on a network.

0071f 004^1 FIG. 15 is a simplified flow diagram of primary s eps associated with a scoring method for assessing the accuracy of the identification of computer applications running on a network.

DETAILED .DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION

0073{(HU7) The devices and systems of the present invention are individual and connected hardware components including electrical elements, circuitry and functions embodied in those components. The hardware components are generally referred to as computing devices in that they combine physical hardware structures with software that may include firmware and middle ware for the purpose of executing instructions tha produce the actions described herein. It is to be understood that the hardware devices tha are network infrastructure devices defined herein represent computing devices suitable for executing the network factions described herein. Other types of comparing devices may also be part of a network system of the present in vention including such computing devices that perform network functions. Such other types of computing devices include laptops, tablets and mobile devices including sm tphones, for example.. It is to be understood that a computing device described her in may be any type of device having a processor capable of carrying instructions associated with one or more computer applications. The illustrations of the network system devices presented in the drawings are simplified representations and are in no way intended to be limiting as to the appearance of these devices. Further, while the devices may be shown in proximity to one another, it is to be understood that they may be local or remote with respect to one another and that there may be some devices tha are located near one another while others and groups of others may he remotely located.

0074|CMM$J Each of the devices described herein, ma include one or more discrete processor devices. One or more of the network Inf astructure devices described herein are programmed to include one or more of the functions described. The devices may contain or be connected to one or more databases of other devices wherein the one or more databases include information related to the invention. For example, the database may include a library of application

0075.fingerprints, one or more policies to be implemented on one or more of the devices and information, about actions performed by the one or .more devices. The one or more database may be populated and updated with information, by authorized users and attached functions.

0076|00 9| The functions of the invention described herein with respect to the operations of the devices ma be described in the general context of computer-executable instructions, such as program modules, being executed by a computing device. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or Implement particular abstract data types. As noted, the present invention can be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through one or more data transmission media. In a disliibuted computing environment, program function modules and other data may be located in both local and remote device storage media including memory storage devices,

0077|00S | The processor, interactive drives, memor storage devices, databases and peripherals, such as signal exchange components, of a particular device may be interconnected through one or more electrical buses. The one or more buses ma be any of several types of bus structures including, a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include industry Standard Architecture (ISA) bus. Micro Channel A chitecture (MCA) bus. Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus,

0078O0St| Each of the devices of the present invention includes one or more of one or mote different computer readable media. Computer readable media can. be any availabl media that can be accessed by the processor and includes both volatile and non-volatile media, mova le and nonremovable media. By way of example, and no limitation, computer readable media may be computer storage media and/or communication media. Computer storage media include volatile and nort- volatile, removable and non-removable media implemented in any method or technology for storage of intbnnation such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but are not limited to, RA , ROM, BEPR.OK flash memory or other memor technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medi m which can be used, to store the desired information and which can be accessed by the computer system,

00791S2 Each of the devices further includes computer storage media in the form of volatile ami/or non-volatile memory such as Read Only Memory (ROM) and Random Access Memory (RAM). RAM typically contains data and/or program modules that are accessible to ami or operated on by the processor. That is, RAM may include application programs, such as the fenolions of the present invention, and information in the form of data. The devices may also include other removable/non-removable, volatne/non- volatile computer storage and access media. For example, a device may include a hard disk drive or solid state drive to read from and/or write to non-removable, non-volatile magnetic media, a magnetic disk drive to read to and/or write from a remo vable, non -volatile magnetic disk, and m optical disk drive to read to ami/or write from a removable, non- volatile optical disk, such as a CD-ROM or other optical media. Other rem.ovahle non--removable_¾ volatlle uon- volatile computer storage media that can be used m the devices to perform the fune&amp;onai steps associated with the system and method of the present invention include, but are not limited to, magnetic tape cassettes, Hash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like.

0080[IM)53| The drives and their associated computer storage media described above provide storage of computer readable instructions, data structures, program modules and other data tor the processor. A ser may enter commands and infonnatkm into the processor through input devices such as keyboards and pointing devices, such s a mouse, a trackball, a touch pad or a touch screen. Other input devices may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are connected to the processor through the system bus, or other bus structures, such as parallel port or a universal, serial bus (USB), bu is not limited thereto. A -monitor or other type of display device is also connected to the processor through the system bus or other bus arrangement.

0081#S4] The processor is configured and arranged to perform the functions and steps described herein embodied in computer instructions stored ami accessed in any one or more of the manners described . The functions and steps, may be implemented, individually or hi combination, as a computer progra product tangibl as computer-readable signals on a computer-readable medium, such as any one or more of the computer-readable media described. Such computer program product, may include compaier-readafele signals tangibly embodied on the computer-readable medium, where such signals define instructions, for example, as part of one or more programs that as a result of being executed by the processor, instruct the processor io perform one or more of die functions or acts described herein, and/or various examples, variations and combinations thereof. Such instructions ma be written in any of a plurality of programming languages, for example, Java, Visual Basic, C, or O-h XML, HTML and the like, or an of a variety of combinations thereof. Furthermore ail such programming may be integrated io eventual delivery of information and computed results via web pages delivered over the internet, intranets, 3G, 4G or evolving networks to computing devices including those in the mobile environment, for example, Smariphones or iPhone iPad and the like or any variet of combinations thereof.

0082fOOSSj All the data aggregated and stored in the database or databases may be .managed under an RDBMS for example Oracle, MySQL, Access, PostgreSQL and the like or any of a variety of combinations thereof. The RDBMS may interface with any web based or program driven applications written in any compatible programming languages including PHP, HTML, XML, Java, A J AX and the like or any of a variety of combinations thereof The computer- readable medium on which such instructions are stored may reside on one or more of the components described above and may he distributed across one or more such components. M)56| The present invention includes individual devices and combinations of such de vices and other devices as weii as related methods to improve die security and operation of a network system. Referring to FIG L a network system 100 incorporating the functions of the present inventio operates and provides network services to attached functions according to policies established on and tr nsmitted to devices of a network infrastructure 101 through which- the attached functions access and use services of the network system 100. Network system 100 includes the network infrastructure 101 and one or more attached functions connected to or connectable to the network infrastructure 10 L The network infrastructure 101 includes multiple switching devices, regional and central routing devices, authentication servers (such as authentication server 115), policy servers (soeh as policy server 103, which may also include a network management control function 125), network control management devices (separate from or including the network management fimction 1.25, applications servers (such as application server 1 ( ?), data centers containing information associated with network operations (such as data center 172), firewalls (such as firewall 118), IDSs, access points, MANs, WANs, VPNs, and internet connectivity interconnected to one another and connectable to the attached functions by way of connection points (e.g., I02a~e). The network infrastructure 101 includes such devices having packe forwarding functionality as their primary functionalit for the purpose of accessing and using network services. The network management control fimction .125 is shown as a single function in FIG 1 however, it Is to be understood that it. represents network polic control, dynamic mirror control, dynamic mirror policy control and all other control functions described herein. I t may he embodied in a single device of the ne twork infxastrnctnre 101 or it may be embodied in multiple devices, wherei different devices may contain one or more of the specific controllers described herein.

0083005?| An attached function Is external to inf astructure 101 and forms part of network system 100. Examples of attached functions 104a-.104e are represented in PKX 1, and may be any of the types of attached functions previously identified. Network infrastructure packet forwarding entry devices i0Sa-b, 140 and 150 of infrastructure 101 provide the means by which. the external attached functions connect or attach to the infrastructure 101. The firewall 118 may be deployed between any attached function, particularly including an internet function, and a network entry device. Although shown as a single firewall in FIG 1, other firewalls may be deployed. A network entry device can inc-Iude and/or be associated with a wireless access point (AP) 150. For ireless connection o a» attached function to the infrastracture 101, the wireless access point 150 can be an individual, device externa! or internal to the network entry device 105b. Wifeless APs amy or may no be associated with a wireless controller (not shown) and these devices may alter the logical arrangement of access for attached func ions but do not substantially change the network topologies. In at least one way, appearing as die logical entry point for all wireless AP traffic, the wireless controllers may help aggregate AP traffic to a more consolidated point for momioring and other activities, including mirroring,

00840S8| One or more devices of the network infmstrueinre 101, Including one or more standalone appliances, if desired, include an application identlika km .function.200 of die present Invention, The application identification function 200 is configured to characterize and identify the application associated with a flow. Further, one or more devices of the network infrastructure 101 include a dynamic traffic mirroring function 300. The dynamic traffic mirroring function 300 is configured to selectively mirror traffic of a flow to another device of the network infrastructure 1 1 including, but not limited to, a device including the application identification function 200, For the purpose of illustrating the present inventi on, some of the devices include the application identification function 200 and some include the dynamic tratik mirroring function 300. Some may include both and some may include neither, One or more cenira!ked network ½¾nicture devices may include either or both of the iin.Kt.lons 200 and 300. Further, there may he a combination of network entry and centralized forwarding devices having the application identification function 200 and/or the mirroring function 3(H) of the present invention. It Is also to be noted that one or mote external attached functions may include one or both of functions 200 and 300 provided that such external attached function is under effective control of the network management control function 125, Moreover, as noted, the application identification function 200 may be m a standalone application identification appliance 80 of the network infrastructure 10F which appliance 1 SO may include the mirroring function 300. The appliance ISO shown in FIG 1 includes a plurality of dashed lines thai represent the option to connect to one or more devices of the network infrastructure 101 including, bu not limited to, the entry devices 105a- 1 OSe and the central switching device 106,

0085tS9] One or more central forwarding devices, represented by central switching device 106, enable the interconnection of a plurality of network entr devices, such as devices 10Sa-b, as well mm to net ork services, such the central policy server 103, the application server 107 and the authentication server 115. I Is to be und rstood that a central forwarding device, or an entry forwarding device, is not limited only o switches as that term is traditionally understood. Instead the forwarding device .may be any device capable of .forwarding signals through the network infrastructure pursuant to forwarding protocols. The central switching device 106 enables the interconnection of the network infrastructure 101 to attached external functions that include VPNs (represented by VP gateway device 1 ! 3} and WANs (represented by Internet cloud 130} as well as Internet Protocol (IF} telephones (represented by telephone 112), as well as to attached internal functions, such as printers, computing devices and the like represented as attached network functions 160a- 160c. It is to be understood that the IP telephone 140 may also perform as a network entry device for the purpose of connecting an attached, function, such as a laptop computes; to the network infrastructure 101.

0086|1>060| In packet forwarding devices such as the routers and switches of the network, packets are received and forwarded as normal pari of the working of these devices. Packets may be forwarded according to the OSI Data Link layer {layer 2) specifications such as the EEE 802.1D and. subsequent IEBB 802. IQ standards. Other switching or routing devices may perform packet forwarding according to other known routing standards, such as IETF IPv4 and IPv6. These devices may support different electrical, RF aid optical Interfaces, and have different numbers of each interface, and also operate these interfaces at different speeds. These devices are suitable tor configuration to carry out one or more of the functions described herein, including the dynamic traffic mirror function and the application identification function. As a matter of course in the classification of the packets for the packet fonvarding capability, the switching device may know the exact classification of the packet. For purposes of providing application identi.f1ca.lion functionality, this capability can be built into the switching device to report the classified traffic to a central or distributed form of the appl ication engine forming part of a packet fonvarding device or devices and/or other devices o .be network infrastructure 101 complete with scoring in.tbrmation regarding the application identification classification. This capabilit is available and available particularly with respect to layer 2 protocols. Packets that are layer 2 classified by the packet forwarding device may or may not be forwarded to the application identification engine for processing. Different packet forwarding devices of the network Infrastructure 101 may or may no support the layer 2 applicatio identification classification and reporting inaction and thus may be treated differently by the application identification control Secti n.

0087j ff Signals are exchanged among the devices of the network ntirastructtire usin existing communication protocols. For purposes of gathering information regarding applications u si ng the network services and the status of network devices, the present invention includes the use of the industry standards, NetFlow and Internet Protocol Flow Information Export (IPFIX), for the purpose of translatin md considering flow information. Net Flow was establi shed by Cisco Systems for the purpose of collecting IP traffic information. NetFlow provides an established designation of seven elements of a packet that define the characteristics of a flow, including ingress interface, source IP address, destination IP address, IP protocol,, source port for l.mli rm Datagram Protocol (U.DP) or Transmission Control Protocol (TCP), destination port for UDP or TCP and IP type of service. That information Is useful for detemdning flow

0088eharacterisiies, but it does not contain all values that may be of interest and It does permit customization of flow<img file="WO2014151591A2_D0002.tif" /> information to be collected. IPFIX is an IETF protocol that solves some NetFlow limitations. It was created based on the need for a common, universal standard of export for Internet Protocol flow information .from switches, routers, probes, and other devices that are used by network management systems to monitor, manage and facilitate network usage and services, lire IPFIX RFC defines how IP flow information is to be rbnnatled and transferred from an exporter to a collector, The IPFIX standards requirements were outlined, in the original H C: 39 ?, The basic specifications for IPFIX were published in 200% as FCs 5101, 5102 and 5103, In brief under IPFIX, data packet information is collected at a network device and sent to a collector of the network, klrast uemre. One device can sen collected data to many collectors and a collector can collect data from many devices of the network,

0089>62| IPFI considers a flow to be any number of packets observed in a specific tirnesiot and sharing a number of properties, e.g., "same source, same destination, same protocol", essentially a ¾.nv'\ Using IPFIX, network devices such as switches can infor a central network administrator abou the network as a whole and in Indi vidual locations. IPFI X is a push protocols i.e., each device periodically sends IPFIX messages to configured collectors, such as network management devices without any .re uest by the collectors. The actual makeup of data in IPFIX messages Is to a great extent up to the device sending the data. IPFIX introduces the makeup of these messaps to the receiver with the help of special Templates. The sender is also free to use user-defined, data t pes in Its messages, so the protocol Is freely extensible and can adapt to different scenarios, In one preferred embodiment, an application identification engine described herein embodying the application dent fication function 200 of the -present invention uses the encodings and extensions allowed through IPFiX as the protocol, to communicate with the various other devices attempting to perform specific portions of the application identification process. IPFL generally uses the Stream Control Transmission

0090Protocol as its Transport layer protocol, hut also allows the use of the TCP and the OOP.

0091An application identification appliance ISO including the application identification function 200 Is represented in FKi 2 in a simplified way in relation to other devices of the network infiastructure 101 with which it communicates. The appliance 180 exchanges information and command signals with the network system control manager 12$, which may he associated with the central policy server 103 and which may he embodied in one or more devices of the network infrastructure 101. An example of the control manager 125 is the

0092NetSight H⁾ management system available from Enterasys Networks of Salem, New Hampshire.

0093The contr l manager 125 may include or at least control a dynamic mirroring engine used to mirror traffic by a network packet forwarding device as described more fully herein. Such a mirroring engine may exist In another device of the network infrastructure 1 1 , including the device that does the mirroring

0094£0864} The appliance ISO includes a management engine 184 and an application identification engine 186 that e forins the application identification function 200. The appliance 1.80 receives packets from other devices of the network infrastructure 101, such as network entry devices !05a~c&lt; Those packets are mirrored to the application identification engine 186 on a regular basis or in a selectable way through dynamic traffic mirroring as described herein. The packets transmitted to the application identification engine 186 are assessed through a plurality of mechanisms for characteristics representative of the application associated with the packets transmitted. Further, the assessed characteristics are scored, including the option of weighting the dirTerent mechanism equally or differently in the scoring, and a composite is resolved as a specific application assessment. That assessment of the chamcter.t¾ation of the packet or Sow of packets Is transmitted as information to the management engine 184 through IPFIX- The managemen engine 184 may optionally be configured to make a fioi l dstenmnation of the characterization of the application associated with the packet or flo of packets and txmsm.it the final determination to the network system control manager 125, The appliance 180 may be further configured with additional statistical gathering, control inputs and commomcatkms connections to the control manager 125 through the management engine 1S4. The krfbmiation gathered, examined and used m the application identification as well as the output to the control manager 125 may be logged at the appliance .180 and/or elsewhere. The logged information is used to form a histor " of the applications and other in omiafion. The history may farther be used as a input into the process of network application identification described herein. More broadly, the information may be stored as a source of determining whether a particular application has already been installed on a device of the network

0095infrastructure iOL

0096f0O6S] The policy server .103 or another network management device of the network infrastructure 101 may include an application identification configuration engine 1?4 coupled to the management engine 184 of the appliance I SO . The configuration engine 174 exchanges .information and instruction messages with t he appliance 180 for t he -purposes of cheeking the status of the appliance 1.80, to modify the content of an applications signatures library 185 of the appliance I B0, to add custom application identification components and to configure the identification engine 186. Messages are exchanged in any way suitable for device management including through, but not limited to MIBs and SN F. Thai form of mfo.rm.atkm and/or instruction exchange can be used for other aciions described herein. Outputs of the identification engine 1.86 associated with the characteristics of mirrored frames of packets associated with one or more flows are forwarded to the management engine 1 4 by any suitable protocol for the network exchange of information. Frames mirrored from the network devices to the

0097identification engine 186 may also be mirrored directly to the management engine 184 for transmission to the control manager 125 or network logging or to other functions and devices, The mi rrored frames may also be mirrored to one or more other devices of the network infrastructure 101 ,

0098The application identification engine 18 is further represented in FIG 3. The application identification engine 186 includes a mirrored frames interface 188, a network management interface 190, a results output interface 1 2, a set of different analysis mechanisms or functions 194a-1 4h and a scoring analysis engine 1 8, The engine 1 6 receives information and instructions from the configuration engine 174, conducts scoring anal ses based on provided

00992? information md guidelines and outputs scoring results through port 1 2 to the control manager .125 for further an l ses, decision making, policy changes md the like. Examples of the plurality of analysis mechanisms used in making a deternilnation about the likely application associated with particular frames examined Include, but are not limited to: a) a comparison 1 4a of one or more signatures (pattern matching) associated with computer applications; b) port values 194b; e) protocol values 1 4c; d) statistics 194d; e) heuristics I 4e f) history 194f; g) installed applications 394g; and h) custom analysis .194h that are adnnnistr ior or user dependent. The engine 186 receives instructions and information at the first entry port 188 and mirrored packets at the second entry interface .190. The mirrored frames are further sent or shared with each of the analysis functions i 4a-!94h for application identification. Effective application identification typically requires the usage of multiple techniques for parsing and analyzing network

0100communications. While shown as a completely parallel and distinct set of operations, the operations may be serialized; they may happen as specialised functions partiall or completely In specialised hardware or other devices of the network infrastructure !Of and/or performed at separate times, and/or as separate functions in separate devices. These detection and analysis techniques range from simple port comparisons all the way through complex pattern matching algorithms, regular expressions, and statistics-hased determinations including packet and How information from other functions and devices, The following table describes some available application identification mechanisms used herein aid examples of each: etecti a Te jsiqse Psagerprimahle Apps. iNftft-xf a erpriiitahk'

0101Apjps.

0102TCMJDP c aaaA UDP/S3 =^∞* DNS DNS, HTTP. SSi-l Applications OR aoa- port values SMTP., etc. stedard ports, and apps. that dynamically select port vatas (P2P,>

0103IP Protocol vatoe IF prot 41 ~~ GilE GRE turuKjis, OS^'PF, Arty applkasio» that iPIP (these aren't apps leverages IPv4 or IPvo reall --just rsore

0104isa ni iug thaa IPv4 or

0105IPv6)

0106Patte n MatcMag BTTP 20 , User-Agstit: HTTP, HTTPS, SSH. Piu rypted Bittorrsnt,

01072 <img file="WO2014151591A2_D0003.tif" />

0108etc.

0109The application identification engine 186 implements all of the above techniques including statistics-baaed fmgerpr iiag so that "problem" protocols such as encrypted Bktorrent and Skype can be identified (fingerprinted).

0110| O6?| It is useful to construct groups of application signatures for the purposes of organization and clarity, especially for outputtkg results in a useful man er to network administrators and to serve as input to policy driven network control. Many applications share a common purpose or usage partem, and this helps to provide guidance for the generation of application groupings. For example, Facebook and Twitter are both social networking applications even though the underlying technologies and platforms powering both are quite different. Hence, It is useful to place Facebook and Twitter into the "social networks" application group along with other similar applications such as Google^'s G service. The table below outlines a set of application groupings. Others may be employed depeadent on network management interests;

0111<img file="WO2014151591A2_D0004.tif" /> include indexing crawlers)

0112S ftware Updtoes lim\ OS/app «¾ikii queying ά Aaii-vitus u date, Meroxoii updates.

0113cmtr&amp;Used soft are u date service U sx patc es

0114Web A fsikaiiofis Genera! ket for web appiicatioas that Google Ma s, ¾ SSL certificate do sot war sass inclusion within one of cisttsnon nsmes tor arbi&amp;arv sites the os &amp;r grou s

0115Ϊ »temet Inff ¾m¾e¾if e Core husmei protocols DNS. SM^'i^'P

0116Ms scei i aneoesOtsto m A plication does a wntrum kcJustOR CusiosK ojje-otYfistfOfked ap licati n it in one of she existing groups 0068] The following table represents a template of HTTP .1PF.1X i r an ^appliow-spec- document This template may he the oasis for characterizing an application Sow to be used m identifying it wherein metadata are to be collected and generated via !Pf IX.

0117<img file="WO2014151591A2_D0005.tif" />

0118[FiagsfdowFlogs, 32m) l xig d64J <img file="WO2014151591A2_D0006.tif" />

0119iEwerpme JD

0120A significant amount of information is included within raw Sow records about IP addresses, protocols, and transport layer port numbers. Given that there are over 10,000 assigned applications unique port values (which are 6-biis wide in the TCP and UDP headers), there is alway s the possibility that that value can be deri ved by inferring the usage of an application on a network just by looking at mapping port values to the associated I AN A assi n d application, That may be one of the analysis functions of the engine 184, For example, on could just take a single flow record, take a look at the source o destination port, determine whether the port is likely a server port or a randomly assigned source port, and then lookup the corresponding application in the IANA list. However, this by itself would mean that it would be possible to use Nmap to fool the .fingerprint function into reporting that every scanned p rt is an application thai is in us .. Hence, it may be desirable to see whether any data<img file="WO2014151591A2_D0007.tif" /> actually be exchanged, and maybe even to try io rule out potential scarmmg activity, Having data exchanged is more clear em for TCP services, but UDP servers are under no obligation to return anything to inbound attached function traffic, Also, although IAN A has defined port numbers for 10,000+ applicatlons, no all applications are of equal importance. As a result, it is an option to be selective in the fingerprinting process. Reasonabl approaches include: 1) fingerprinting applications based on port values fo specific enterprise applications and/or 2) fuigerprintlng those applications that reside in certain servers. In any case, there is vaiue in running

0121•fingerprinting code that parses through application layer data and so the appliance 180 is configured to enable both a port-based and a DP!-based application fingerprint be produced for each, How,

0122C ??0f The following features are examples of the types of features that m y be analyzed in the pattern matching mechanism for application identification:

0123Feature Rationale Example

0124IP protocol test Rssmci application layer inspection; "tep"

0125based an IP protocol value to follow

0126coR exaioHal application usages of

0127the trans ort layer

0128Transport layer port test Applications usually txmx&amp; e&amp;e

0129over canonical port values

0130Application layer siring Many a plication can be detected ⁿsm/2xf

0131matches wi h some degree of reliability

0132simply by looking or a simpl string

0133within network traffic

0134Pattern offset Some applications tran mi "15^**

0135identifiable information at e in

0136offsets within payfead date - the

0137offset applies to a search pattern

0138Patter depth Some applications fc-aasmit "100"

0139Identifiable omsatioa ti is

0140certain depths oi^'psylosd data - the

0141depth applies to a search attern

0142<img file="WO2014151591A2_D0008.tif" />

0143si nature p B7.l ] Examples of application signature messages against AOL !M traffic are;

014414:12:1 1 [I] s92.168.80.:tO§:53605 192.168.4,1 12:5190 a/a |APP:AOLJ (s y== 3 i)S,dp-S 1 S_!pi >iofol-te ) 14:12: 1 ! |!) 192,168.6,49:5190 192.168,76.105:53602 n lATOAOUlCQU (sr=519O,dp-S3S02>

014514:12: 1 1 f II 192.168.76.105:53602 192.168.6.49:5190 tva lA?P:AOi./rCQi| (sp-53602 p-5190)

014614:12: 1 1 |lj 192.168,4.1 12 5190 192.1 S.S6.109:53605 a/a [AFP:AOL.] (sp-5190_&lt;dp-536 ⁾5 pmtocd-tep} 14:12: 1 lj 1 2.168.6.49: 190 192.168,76.105:53602 a/a £APP:AGL fCQIJ (sp-"51 0_;d| ^«53602)

0147100721 Outputs of the respective analysis mechani sms !94a~194f are shared with the scor.bg analysis engine 198. This engine 198 may be located in the appliance 180, the control manager 125 or other devices of the network, infrastructure, it is used to collect the information output provided by the different analysis mechanisms and to combine it with other information retrieved, derived or configured to assist in detennining the application which the analyzed flow is based upon as used on the network system. Use history of applications previousl used on the network as well as those applications know to be installed on the network may also be added to the analysis as two additional mechanisms, mcluding as tiebreakers or added weighting, particularly when the other mechanisms deliver less than certain results, but not limited thereto.

0148|0O?3^'| FIGS. 4A-4C illustrate the results of using a plurality of mechanisms in the scoring to assess the likely application associated with a flow that has been mirrored to the application identification function 200, in which scores can range .from 0 (no knowledg of the application based on the mechanism used) to 100 (complete certainty of the application based on the mechanism used), it can he seen at certain applications are or¾ amenable than others to certain analysis mechanisms. For example, social and search applications can be detected with a high degree of confidence using signature analysis while peer-to-peer applications are difficult to detect using the signature approach but are detectable using the heuristics mechanism. The API mechanism shown in FIGS, 4A-4C represents the inclusion of any analysis technique created for use hx association with the identification function 200 including, but not limited to, user created c ustom techniques of the network infrastructure 01 of the present mveatkm. The API is the interface through w tieh users may add one or more analysis mechanisms to the scoring engine 1 8 dependent on their particular experiences in a specific network application.

01490 74} An example of the dynamic traffic mirroring function 300 of the present invention, which may he used in conjunction with the application identification function 200 or independent of that function, is represented in FIG. 5, which is a simplified representation of a packet forsvardiug device 400 configured to mirror frames of packets received on the device 400, which may be part of the network infrastructure 101 a d may he a network entry (edge) device of a central (core) packet forwarding device of the type previously described but not limited thereto. The device 400 includes the dynamic traffic mirroring function 300. The device 400 includes one or more ports 402 for receiving and transmitting packets. The device 400 is connected in a wired or wireless way to a traffic source 404 and a traffic destination 406, It is further connected in a wired or wireless way to a mirrored traffic destination 408. The device 400 includes a control engine 410 configured to, among other things, establish and/or manage one or more virtual portals 412 associated with the transmission of mirrored, frames of a flow set up between the traffic source 404 and the traffic destination 400. It is to he noted that while they are refe r d to as the traffic source and the traffic destination* it is to be understood thai each may be configured to transmit and receive traffic for example, i a flow between the two. The source and destination will have little or no knowledge of the traffic between them being mirrored (copied) to another device.

015007S| One or more of the virtual portals 412 may be static in configuratio and one or more may be dynamic in configuration, A static configuration means that the mirrored traffic is always transferred to the same mirrored traffic destination 408. On the other hand, a dynamic configuration means that the mirrored frames are transferred to the mirrored traffic destination

0151408 through one or more selectable configurations. The destination may just be a service name

0152(Any DS, for example) and the physical destination may change based on sendee discovery, availability, status, or priority and loading, perhaps learned via service announcements. Any of the physical ports (402) of the device 400 may be used for the transmission of the mirrored frames as .required or needed by the virtual portal. It is to be noted that, the mirrored traffic destination 408 ma be any device of the network system 100, including the device 400. If the mirrored traffic destination 408 is located within the device 400, the mirrored frames may be transferred by way of one of the one or more virtual portals 412 to one of the one or more other portals 412 or the virtual portal may be represented simply with a shared memory or other frame or data passing technique.

0153\m \ While the function of the portals 412 has generally been described herein with respect, to the transfer of frames, portions of frames or portions of more than one flow for the purpose of application ideatiScation, the use of portals of the type described Is not limited to that specific use. it is also possible to transfer to other devices or to other functions, whether m the same or another device, related information, such as information about the Sow or flows but not limited thereto. Once a porta! is established to another fimcik , such as the application identifieatkm engine ! 86, for example, the portal might be used to transport related or other information for reason of security or simple ease of use, to that destination, which may be a known destination and which may be logical or physical Further, the portal may have been established for a particular destination and that same destination may be used by other mirrors or the same mirrors tor other frames or different flows. It is possible to provide information, status and flow statics, end-of- flow information, etc. which, while not part of the selected frames or filtered parts of the flow of packets, on a network, may aid, modify or enhance the function operating at the destination of the portal in performing Its task. This information could, in one embodiment, be sent in an 1PF1X or IFF IX extended format but other formats and protocols are possible.

0154|00?7| Although FIG. 5 depicts a particular frame mirroring configuration for the device 400, one ordinarily skilled in the art will recognize and appreciate that other eemfigumtions are possible to enable the mirroring of frames for a plurality of traffic sources, traffic destinations and mirrored frames destinations. Moreover, the device 400 may have more or fewer ports than as shown (including only a single port) and more or fewer virtual portals than as shown.

01551 078_.1 The device 400 includes a mirror source point 414 and the control engine 410 includes a mirror sending mec an sm 4.16, either or both, of which may be implemented as software, hardware, or any combination thereof. In one embodiment, the mirror source point 414 is associated with one of the one or more portal 412. The mirror source point 414 may be configured to copy all or a portion of network traffic, such as on !rarne by per frame basts, tj asinitted and/or received on a given port 402 or portal 12. The mirror source in 414 is confi gured to replic te, duplicate or otherwise copy ixafiie of the traffic source 404. is another aspect, the mirror source point 414 identifies the point or location of a devic of the network ktfrastructure 101 or of an attached function network such as a port, queue, storage or memory location, from which the mirroring of frames originates, initiates, or otherwise starts,

0156Additionall , the mirror source point 414 may implement encryption of the traffic from the source 406 before initiating fram mirroring, alternately this service and others may he performed by th portal. For example, the mirror source point 414 may include one or more mechanisms to Biter, encrypt, encapsulate, blank, scramble, or shave a frame of mirrored traffic. fO0?9J The mirror function 300 in general relies upon the packet forwarding function of the device 400 for service generally known to he performed by that device. Classification and packet forwarding function 420 may be relied upon to classify frames for forwarding as needed to other ports (402) of the device 400. This same forwarding function 420 can he used to classify copy and deliver frames to the mirror function. When a mirror Is established and f ames needed to be sent by one or more of the portals 412 via one or more of the pons of switching device 400 to mirror destination 408, the frames are typically handed to classification and packet forwarding function 420 to be classified and forwarded according to typical switching and routing rules to the destination as defined by the mirror portal established for thai particular mirroring activity. Device 400 then transmits the xaine(s) from the proper po (s) 402.

0157OSH] The mirrored traffic destination 408 may be any function or device of the network in structu 1 1, including the device 400, arranged to receive and either transfer or analyze the mirrored f ames, including a device having the application identification function 200 described herein. The destination 408 may include a function configurable to receive mirrored and acknowledge network traffic. The mirror destination point 408 may also optionally be part of the network syste 100 but as part of a network inirastr cture different from the network infrastructure 101. The mirrored traffic destination 408 may include a mechanism to decrypt, de- encapsulate, or unscramble a received mirrored frame or frames. Further, the destination also contains the necessary protocol elements to provide flow control, frame acknowledgement and such matters as required by packet based transport as selected or used by the portals 412.

0158fCH!Sl J As noted, the mirror source point 4.14 may e? configured to copy some or all of the traffic associated with the traffic source 404, A portion of any frame may he configured to he any granularity of the frame of the network Iridic. For example, one or more Holds of otic or more protocol layers of the frame may be configured o be mirrored, in another example, only the data payload ofone of the protocol layers of the frame may be mirrored. One ordinarily skilled in the art will reco nize and appreciate that ail or an portion of network traffic, such as all or any available portion, of a frame, a packet, or an other protocol data unit at one or more network protocol layers may be mirrored in practicing the operations of the present m ea i described herein. Although the present invention is generally discussed In relation to packets (frames as they appears on the network physical links) of network traffic, one ordinarily skilled in the art will recognize and appreciate that a frame is a bundle or unit of data, that may be In binar form, organised In a specific way for tra smiss o . Moreover, one ordinarily skilled in the art will recognize aid appreciate that any unit or bundle of data associated wi th any of the protocol layers may be used in practicing the operations of the present inventio as described herein,

0159|10i2j As noted, frames mirrored from the device 400 may be encapsulated. Any type and/or form of protocol and any mechanism for encapsulation may be used. The mirrored frames, whether encrypted or not, may be encapsulated using a tunneling protocol, such as a secure tonnoling protocol For example, the umneliug protocol used by the present invention may Include any version and/or implementation of my of the following tunneling protocols: a Point- To-Po. t Tunneling protocol (PPTP), Polnt-To-Po n Protocol over Ethernet (PPPoB), Point-To- Point Protocol over ATM (PPPoA), a Layer 2 Tunneling Protocol (L2TP), a Generic Routing Encapsulation (ORE), Internet Protocol Security (IPsec), IP in CP Tunneling, and Multi-Protocol Label Switching (MPLS), One ordinarily skilled in the art will recognize and appreciate that any bridgeable or roata le protocol may he used in practicing the operations of the present invention described herein,

0160| S3] In one em o iment, mirrored dat of an original frame m a packet becomes the data pay!oad for a modified packet that includes the original frame that is to be mirrored. The frame to be mirrored may be enca sula ed such as with a tunnel configuration. Furthermore, the con tent of the mirrored, frame may be encrypted.

0161| 0S4] In other embodiments of the Invention, the network traffic is tunneled to the mirror traffic destination 408 via a higher level protocol, such as ByperText Transfer Protocol Secure (HTTPS) or the Secure Socket Layer (SSL) protocol For example, the mirrored network traffic may be encrypted and encapsulated via a secure web session using SSL, and/or HTTP between the mirror source point 414 and the destination 408.

0162[O085| In one embodiment, a Medium Access Control (MAC) Layer 2 tunneling may be used. A MAC-uvMAC tunae!ing techniques encapsulates a MAC frame wit another MAC header, or a second MAC header, FIG, 6 shows a simplified iUustraiive example of an original frame 600 of a packet of network traffic to he minwed modified in accordance with the technique of this particular tunneling method. Specifically, the frame 600 Ls encapsulated in a MAC~in~MAC tunneling protocol . A second IEEE 802.3 MAC header 602 is appended to the .frame 600 to form a modified frame 604 that is mirrored. In some embodiments, all or a portion of the frame 600 encapsulated with the second MAC header 602 may be encrypted. For example, data portion 606 of the frame 600 may be encrypted.

0163Additional ly, the encapsulation of mirrored network tra c may be used with virtual leased line technologies and/or the Multiple Protocol Label Switching Standards, such as the Fseudo Wire Emulation Version 3 standard (PWE3). Furthermore, any type and/or form of custom or proprietary encapsulation protocol, or any type and/or form of custom or proprietary encrypting and encapsulating protocol may used with the present invention. One ordinarily skilled in the ait will recognize and appreciate the various types and/or forms of encapsulating or tunneling protocols that may fee used for providing data privacy of at least a portion of mirrored network traffic during communications between the mirror source point and the mirror destination point.. The mirrored traffic may he de-encapsulated and/or de-crypfed at the destination 408 for further processing.

0164O08?1 la some embodiments of the present invention, the device 400 or other devices including the dynamic traffic mirroring function 200 may support the ability to mirror network traffic remotely over a network by utilizing the IEEE 802. IQ Y LAN tag/field of the frame in virtual LAN environment ( LAN), YLAN environments are based on logical connectivity overlay of the physical network, and as known to those ordinarily skilled in the art, may include any type of YLAN, such as a port- based VLA^' , MAC-bas d YEAR a protocol-based V^'LAN, or an ATM YLAN. in a V^'LAN environment, remotely mirrored network traffic may have a specific IEEE 802. IQ YLAN tag used by device 400 to help direct the mirrored network traffic to a specified location and to isolate it from other traffic. Utilizing the YLAN tag, the frame relay logic of Hie dev ce 400 typically -used for forwarding Ikmes is enhanced Network t affic mirrored in a VLA environment may traverse or pass through .many network system devices before reaching the mirror destination pomi 40%. Regardless of the particular mechanism tor transferring mirrored traffic, the dynamic mirroring function 200 is arranged to configure one or more of the portals 412 to mirror one or more packets, including portions of packets, based on selected criteria. The configuration has several dynamic aspects to it and there are a plurality of criteria used in maki ng a detemiination as part of dynamic trhr.rori.ng policy of what, where and when to mirror. A first, cri terion involves selecting one or more recei ved frames for mirroring, which may be a flo that is defined and selected. A second criterion involves selecting one or more portions of the frames for mirroring, which may include the entirety, of the frame, selected fields or excluded fields selected portions of a frame based on byte count, of each of the frames of the selected one or more of the received frames to he mirrored, A third criterion involves selecting which of the one or more portals through which to mirror the frames. A fourth criterion involves selecting where to mirror the frames which may determine the portal or may

0165dynamically establish a new portal A fifth criterion involves selecting when to stop the mirroring of the selected frames. A second dynamic aspect of the present invention includes a configuration of th control engine 410 to change the conilguration of the selections and/or the selected criteria for the mirror function, even during the active mirroring of frames, based upon the detection of a triggering event or condition. Examples of such triggering events or conditions have been, described above and are Incorporated herein hut the invention is not limited to those so listed..

0166|CKH88j The portals 412 may be configured by any means known to those skilled in the art, such as through the use of SNMK. to provide the parameters needed to determine or discover the portal destination, path to it and the transport criteria needed, As an example, a mirror may have been established by the policy-based mirroring function to mirror ail traffic from a new attached function that has joined the network system 100. After a period of time based on one or more of policies, on the output of an IDS, the output of the appliance 180 or another network infrastructure device including the application identification function 200, and Network Access and Control (NAG) functions, the particular attached function might have the criteria for mirroring changed to reflect only mirroring, for example, the first 30 frames of a . new flo to only the least loaded application identification function 200 of the network infrastructure 101. This might reflect an. attached .function now having a Misted, known, authenticated user, u ated applications and virus detection status, and generally displaying good network behavior.

0167|W8 ) i is also to be noted that the control engine 10 configured to change the mirroring dynamically may he located in one or more other devices of the network inftastructee

0168101. Further, die control mechanism of tire traffic mirror function may be automatically changed during the mirroring of traffic based on input of information to the control engine 410 tha initiates a mirroring change based on network policy, mirroring policies or both. The first selection criterion may be based, on a field or selected fields in the packet. The selected field or fields may be one or more of: a) add ess fields; h) protocol fields; c) length or byte count fields; and d) fields used in determining the value, meaning, placement or inclusion of other fields in the packet. The second selection criterion may also be a selection of the fields in the packet to he mirrored, byte count of a first selected portion of the packet to be mirrored and/or offset, of a first selected portion of the packet to be mirrored. Further, the third selection criterion, may be: a) count setting of the frames meeting the first selection cri terion; b) created using Information contained in the packets mirrored or to be mirrored; e) created using information contained in packets not mirrored to the selected portal where mirroring occurs, The application layer of the packet or series of pac kets may also be used as either or bot of the first and second criteria.

0169The control engine 4.10 is configured to include one or more inputs used in the analysis of what and when to mirror traffic from the traffic source 404. Input options include, but are not limited to: a) network events; b) application^} detected; c) user authentication; d) type of device for the traffic source 404 or the traffic destination 406: e) device status (virus level): f) device ownership status 1 BYOD criteria); g) network policies; and other triggering conditions as noted herein.

0170Each of the one or more portal s 412 may be established through the device 400 in one or more ways as described herein. For example, the portal 412 may be a tunnel to another device of the network system 100 including, for example a TCP IP tunnel, it may also lie based on packet encapsulation. That data encapsulation may be a data link sub-layer encapsulation. Further, it may be based on the traffic destination 406,

0171The abilit to detect and Identify applications running on devices of the network

0172Infrastructure 101 enables new type of application based network control However, it comes at a cost of increased complexity and expense to deploy the application identification function

0173200 in the network infrastructure 101. Normall , the application identification function 200 including the engine 186 would need to be deployed throughout the network infrastmcture 101 to

0174Insure a reaso ble detection of a sufficient portion of the traffic Hows important to the organisation to permit reasonable control. The dynamic traffic mirroring function of the present invention dramatically eases the pain, expense and complexity of engine 186 deployment allowing such application identificatio engines to be placed almost at will by the network administrator, with the mirrors bringing to it the necessary traffic f m any device of Interest in the network infrastructure 101. The dynamic mirrors are most logically located in the switches and other devices that are primarily packet forwarding dev ces, such as switches and routers, as the incremental additional cost is relatively minor and heavily leverages the already existing capabilities these devices have; namely, to classify all Incoming traffic, copy tr ffic as needed, rapidly modify frames and .frame headers, lister and forward frames, and to support

0175encapsulations, tumieiing and routing technologies. Moreover, their positions in various network topologies make them almost ideal for the task.

0176Examples of network topology organisational, options are shown In FIGS. 7-10,

0177Components of the network that are numbered the same as in FIG 1 remain the same for purposes of describing the different topology options. FIG 7 shows a first network topology 700 in which transmissions from attached functions to the network infrastructure 101 enter through edge network devices and all Internet traffic is .forced through firewall 1.18, whic may be one or more firewalls scaled as desired based on the size of the network. The firewall 11 S performs its gate keeping function and packets that are permitted to pass are transferred to the network entry device 105, which represents one or more network entry packet forwarding devices, such as switches. The network entry device 105 mirrors frames of the packets or portions of one or mom received frames to the application identification appliance ISO, The appliance 180 carries out lis analysis with the application identification function 200 as described herei and passes that information, to the policy server 103 or another network control device including the network control manager 125. The policy server 103 either has established one or more network policies, which may include one or more mirroring policies and/or rules for implem nting mirroring policies, on the network entry device 105 or firewall 118 for the purpose of allo wing, blocking or restricting the transfer of frames from the network entry device 105 to the core switching device

0178106 and/or access to resources of the network system. Dependen upon the analysis of the frames mirrored to the appliance 180, the polic serv er 103 or the manager 125 ma dynamically adjust one or more network policies or enforc ment rules of firewall 1 IS or the network entry device 105, the core switching device .106 and or any other devices of the network.

0179[0092] in a small business model network represented in FIG, ?, network entry device 105 may represent most or all the network switching devices of the topology ?00. In small topologies, the management policy control and application identification function 200 ma all be located in a single server. For the small business office, internet connected to the corporate backbone, the network control ami application identification function may, in fact, be located at the corporate headquarters. High priority mirroring may take place immediately for new flows while local logging and nightly transfer and analysis may optimise network cost at some delay in terms of polic control and enforcement. As traffic grows, or a more responsive control is needed, local application identification engine conk! be installed as a standalone appliance, such s in appliance 180, or as a function of a packet forwarding device, perhaps sharing the load with the corporate-based primary application identificatio function 200, with the dynamic mirrors providing the traffic to the appropriate device based on mirror policy. While the point deployment of the mirrors would lead to no duplicate flows, if .more- than one switching device were installed in the network, some traffic in the other device, assuming no local mirror, would not be reviewed by the application identification function^) 200. A point deployment works well where the imffie in the network is typically focused through a single, or a limited set of packet forwarding devices, Internet gatewa and data, center entry points are good examples of places where mirror deployment would see little duplicate traffic and a very large portion of the traffic flows through a single or very limited number of packet forwarding devices.

0180jWftJf The simplest topology case to understand is the firewall or gateway access, such as a VPN, topology. In this topology, specific traffic is focused through a single point or very limi ted set of points when including load sharing and redundancy. These single points may be easily mirrored and there is almost no duplication of flows to be concerned, with. In addition, it is a likely a high-concern or high-risk location, hut with limited or known bandwidth

0181fakeme ts. A more complex topology is the edge access device topology. Those network devices typically connected to one or two devices (attached functions) located in every office of ait enterprise, as a example, Low density user devices are tied to the core of the network using iota of ports, different locations and. typically, multiple edge devices. While a single port may t Ji represent much traffic bandwidth, he aggregate of all ports can become substantial. Mirrors can be created on a per port or per entry device basis hit any enforcement usually requires a mechanism to track addressing back to the physical port of entry de vices as an added step when compared to the gateway topology. The increased bandwidth of high P¾ffie spikes may also force a less holistic approach to mirroring; that is. you cannot an lyze everything during high traffic periods. A new policy may be needed for load shedding and establishing priorities for excessive traffic in the mirrors or at the destination devices, such as application engines.

0182Sampling Hows, shedding trusted users, limiting the time period of examining all flows front a device or user are some such techniques to use dynamic mirroring to limit load to application identification, IDS and other monitoring engines.

0183fO094J FIG, 8 shows another network topology 800 and may represent a typical medium uizz enterprise with both core and edge switching. Transmissions from the majority of the attached functions of the netw ork infrastructure enter through the edge switching devices 105a and 105b, The network entry devices 105a and 105h do not include the dynamic traffic mirroring function 300 or they do not utilise that function to mirror frames to the appliance 1 SO. Instead, the network entry devices 105a and i05b forward frames in packets to the core device 106. The topolog location of the core device 106 means the vast majority of all flow in the network passes through that particular packe forwarding device. Any application identification functions 200 directly attached to the core device do not significantly increase traffic the network when mirrored to a dedicated port on the core device. The appliance ISO carries out its analysis with the application identification function 200 as described herein and passes that information to the policy server 1 3 or another network control device including the network control manager 125, The policy server 103 either has established one or more policies, including one or more mirroring policies and/or one or more rules f r implementing mirroring policies, on the network core device 1 6 tor the purpose of allowing, blocking or restricting the transfer of frames from t¼ network, core device 106 to other devices of the network including attached network functions. Dependent upon the analysis of the frames .mirrored to the appliance 180, the policy server 1 3 or the manager 125 may dynamically adjust one or .more policies, including mirroring policies, of the network entry device 105, the core switching device 106 and/or any other devices of the network,

0184fiK!9SJ The network topology 5100 of FIG 9 includes network core focused application ideni flcmion and ses the outp t of appliance 180 to assist m policy decisions for seewaig the network. Rapid policy deployment of control m the core device 106 may be followed by discovery of the flow source and subse uent edge deployment at either or both of network entry devices 105a and 105 b, lor example, of more targeted control Where some, but limited, mirroring capability may exist at the network edge and/or large numbers of users exist, core detection may be followed by limited mirroring w h added detection at the edge. This may lead to duplication of flows and an increased requirement to de-duplicate at the appliance 180 or one or more other devices of the network kvfrastruct re 1.01 thai include the application identification function 200,

0185I 6} FIG, 10 shows another network topology 1000 suitable for use with a dam center wherein one or more servers 175 of the data center are a core asset to the enterprise. Within the enterprise, traffic from the network entry device lOSa/lOSb, which represent network entry packet forwarding devices, such as switches, passes eventually to a data center switch 1002 or equivalent packet forwarding device(s). The data center switch 1002 or equivalent forwarding device(s) forwards frames to and from a server or set of servers that represent a data center 1 04 through the network core packet forwarding device 106, which may be a switch or a router and may be one or more devices in practice. The network entry devices 105a and 105b do no include the dynamic traffic mirroring function 300 or they do not utilize that function to mirror frames to the appliance ISO. Instead, the network entry device i05a i 5b forwards the frames to through the core switch and on to data center switch 1002. frames are mirrored. If applicable, by mirror function 300a or 300b to application identification engines of appliances 180 and 181 , The appliances I SO and 181 carry out their analysis with the application identification functions 200 as described herein and p ss that information to the policy server 103 or another network control device including the network control manager 125. The policy server 103 either has established one or more policies, including for mirroring, on the network devices for the purpose of allowing, blocking or restrict ng the transfer of packets as re uired. Generally, enforcement is attempted first at the lo wer bandwidth, edge devices closer to the entry poi t of potential ly harcnfn! behavior when possible, but in any device of the network infrastructure 10! as needed to support, the network. Dependent upon the analysis of the frames mirrored to the appliance 180 and/or I S! and possibly others as needed, the policy server 103 or the manager 125 may dynamically adjust one or more policies, rules. Access Control Lists (ACLs) or parameters of the network entry device 105a/105b, the core switching device 106 and/or n other devices of the network.

0186|0897] The architecture 1000 of PIG. 10 is focused on iffidersmndfng the applications and usage of the data center 1.75 devices. Based on traffic mirroring at the data center switches 1002. the appliances 180 and 181 would receive little duplicate traffic. However, data center switching c be some of the highest volume of traffic in the network and multiple mirrors, links, application identification engines and servers may be seeded io support the topology. One of the more important aspects of the architecture is the ability and flexibility to support and scale to each of the topologies as shown with a .few pieces of basic technology and to- perform this in a cost effective manner. A pervasive mirroring topolog supports mirroring at all the packet forwarding devices of the network system. While providing unlimited access to the packet flows, duplication of the frames at the mirrors of each switch would require more intelligent control of them, perhaps mirrors that understand topology or de -duplication of the flows at the monitors and engines receiving the mirrored frames. Additional intelligent mirror control and new policies may be added to help ease the duplication effect using both approaches.

0187|&lt;K*98j The network architecture supporting the various -topologies described herein are examples of configurations that may be created where know ledge of applications and topologies associated w ith flows exist, as well as the abilit to mirror some or all of such flows to obtain application Identification and usage information. It is also advantageous to have the ability to conduct mi.cro.ring activities dynamically, including when to mirror, how much to mirror, which devices to use tor mirroring and when to stop mirroring. Moreover, it is also advantageous to configure such topologies including the ability to modify dynamically network policies associated with the operation of the network as a result of events, conditions, status, etc., detected based on application information but not limited thereto.

0188&lt;HJ®9j The application identification end-to-end network architecture of the present invention expands the control network administrators have on existing networks. Application identification and usage data, by user, by device and network location can no be used to provide an added level of network control. However, application identification engines come at a cost, perhaps more than the cost of IDS engines currently in use. The ability to embed the application identification technology into all switch devices would be prohibitively expensive.

0189Dynamic mirror technology can be used to bring the packets io the device fmvhtg the application identification engine while also providing an elegant transition step which ma , n fact, be the glue for the virtual placement, of all types of monitors, IDS, application identification, data loggers, and even server technology well into the future, The portals described herein allow the mirrors to transport whole or filtered How data from anywhere, to anywhere in the network, efficiently and securely, The architecture implemented inactions allow the ability to start small with a single application Identification function 200 added to a network management server, examine flows from throughout the network (via mirroring) and upgrade policy control based on real application identification data and usage, then grow to pervasive deployment where virtually all new flows could be identified and controlled via policy. This ability to scale across small to very large topologies Is an aspect of the control architecture. Scaling may be accomplished by determining a comprehensive or specific level of network activity that could be handled by a single application Identification engine and mirroring frames to that engine. Additional application identification engines can then be added as needed, each time the level of network activity exceeds the capacity of the installed applicatio identification engines, it can be seen that this can be done for a wide range of network sizes. As new application, identification engines are added to a network system the dynamic mirrors could locate the least loaded engine and new Hows would automatically be sent to the least loaded engine. 1^' his allows near seamless upgrades as needs grow or traffic increases. This eliminates the limitations of piecemeal and/or manual control of network operations even when application information has been acquired. This arciutecture enables substantially complete application visibility and control. Previous technologies were cobbled together in order to achieve partial application visibility and control In pieces, such as manual Access Control List (ACLs) but that is not enough to maximize network efficiency and provide real security. This architecture provides: a) effective, inexpensive mimning at the network ingress point for new Hows, which aids in determining the source of an identified application; b) cost efficiency, locating expensive application

0190identification engines strategically, including at the core rather than introducing them to all or a .limited set of the network packet forwarding devices. The ability to filter (by packets, fields, bytes, etc, as described herein) including through dynamic traffic mirroring is useful in minimizin network traffic and application identification engine overload. The network operation is enhanced through this architecture because it enables effective dynamic network policy, Including policy enforcement at an. ingress point based on knowledge of a source of undesirable activity on the network,

0191.1.001 A simple exam ple of the applicabilit y of t he architecture and its associated dynamic -mirroring policy as well as traffic mirroring to more centralized services and application identification will help illustrate the value of the present invention, In this example,, a new user authenticates to the network at the network entry device 105 using a computing device as the attached function. The user^'s identification is known based on content in a database associated with, the authentication server 1.1.5. However, in the course of authentication, it is determined either through the authentication server 1 15 or the policy server 103 that the user device is an unknown one. A defined dynamic mirror policy has been established i the network entry device 105 tor all unknown attached function devices. Based on the defined dynamic mirror policy and knowledge that the device Is rsnknowu, all flows associated with the user are automatically mirrored to an IDS for a specified period of time and all new flows established by that attached device arc mirrored for the first 20 frames to the appliance 1 SO. The mirroring to the IDS would he hatted, assuming no condition exists to warrant further monitoring in that regard, after a set time period and that particular IDS could be used to monitor the traffic from another device, the assumption being that if no undesirable event has occurred within one hour, the attached device can be more trusted -from a security perspective. At me same time, all new flows would continue to be monitored and analyzed, by the appliance 180. The appliance ISO would identify applications running on the attached device. That information would be collected and the user^'s application usage tendencies could be characterized and logged over a period of time. That information and the actions of the network entry device with respect to mirroring activities may be aggregated such as in a mirror policy engine of the manager 125. Mirroring to the appliance ISO could be adjusted as desired, including reducing the number of flows mirrored or sel ecting certain flows or types of fl ws to be mirrored. In. situation wherein there exists a mirroring or traffic overload at the network entry device, another network device (In the flow path for the attached device) may be used to dynamically establish a mirror for a flow or all flows tha could no be accomplished in the network entry device for that attached function. As noted, the appliance ISO would learn and log the applications delected as being used by the user on the attached device and further network policies could he applied dynamically or statically based on the discovered applications in use-. fh.10.1 ] As represented in FIG. 11 , a method 1100 of controlling dynamic traffic mirrors of the network system includes, after standard initial setup of one or more devices of the network infrastracture 101. through network administration input as is typically done in the held of the present invention, step 1110 of providing in the one or more of the network inhastmeture devices 101 one or more mirror policies, in step 1 120, the network system 1 0 is continuously monitored for events, topology and status of the network system. Dependent on the information gathered in the monitoring, the method 1 100 farther includes step 11.30 of installing, enabling, selecting or changing automatic-ally one or more traffic mirrors in one or more of the devices of the network inirastrueture I Oh The one or m re of the one or more .mirror policies provided, installed, enabled, selected or changed implement one or more network policies of the network system 100 ami .r one or more rules based on one or more network policies. The method 11 0 further includes as part of step 1100 or in additian to step 11 0 before or after that step, step 1140 of establish ng one or more criteria tor the providing, installing, enabling, selecting or changing of the one or more mirror policies based on the one or more network policies of the network system 100 ana or the one or more rules based on one or more network policies. The method 1 100 optionally provides under step 1130 the step of selecting one or more of the one or more network inihistrucrnre devices from which to mirror the network traffic based on one or more of the one or more criteria.

0192i02) The method 1 100 includes the optional step of selecting a destination for the mirrored. traffic based on one or more of the one or more criteria. The destination may be one or more of: a) one or more of the lural ty of network infrastructure devices 101; b) one or more network, services; c) a function of the network system 10 ; and d) a portal 412. The method further includes the step of selecting a portion of the network traffic to mirror. The selected portio may be any one of: a) a flow of packets; b) a set of packets within a flow; and c) a portion of one or more frames of one or more packets within a flow. Another optional step of the method 1100 is determining when to stop the mirroring of the network traffic. The stopping may he based on one or more of: a) one or more of the one or m re criteria noted above; b) one or more mirror policies or one or more network policies; and c) one or more priorities of one or more other network traffic flows. The method 1.100 also includes the optional step of securing the network traffic to be -mirrored prior to mirroring. That securing may be accomplished b one or more of: a) providing a tunnel; b) encrypting the content of the network irai e; and c)

01934S providing an encrypted tntmel. Examples of mirror policies thai may be established include, but arc not limited to: a) allowing a source of the mirrored network traffic to choose the destination of that mirrored network traffic; b) mirroring selectable network traffic based on an attached function or user generating the network traffic to be mirrored or content of the network traffic to be monitored. The mirror policies established may be based on one or more of; a) a role of an authenticated user of the network system 100; b) a device rising the network system 100; c) a type of a device using the network system. 1.00; d) local packet classification; e) time of day; f) other events which may be monitored; and network policies. The method 1100 further optionally includes the step of storing the one or more mirror policies in the one or more devices of the network infrastructure devices 101. Those stored one or more mirror policies may foe changed.

0194As represented in FIG 12, a method 1200 is provided tor mirroring one or more frames of one or more packets of a flow established in a network system signal exchange. After standard initial setup of one or more devices of the network inirastrncture 101 through netw ork administration input, as i s typically done in the field of the present invention, a first step 1210 of the method 1200 is to establish a first criterion for selecting one or more received frames for mirror.bg. A second step 1220 is to establish a second criterion for selecting one or more portions of the frames for miirormg. A third step 1230 is to establish a third criterion for selectin one or more portals through which to minor the frames. A fourth step 1240 is to establish a fourth criterion for establishing a destination for the mirrored .frames. A fifth step

01951250 is to establish a fil h criterion for the establishmen of a mirror in a device of the network infrastructure. The established criteria are used in step 1260 to create one or more portals 412 in one or more of the plurality of devices of the network infrastructure 1 1 meeting the criteria for establishing a mirror to mirror the selected frames. The met od 1200 then includes step 1270 of carrying out the mirroring of the selected frames through the created one or more portals 412.

0196An optional step of the method 1200 is to change one or .more of the criteria. The method 1200 further includes the optional step of establishing a sixth criterion for stopping the mirroring. The method 1200 includes an optional further step of modifying automatically the mirrorin of the selected frames during mirroring,

0197( 04j The mimiring instructions associated one or more of the cri teria may be generated, changed, modified or otherwise adjusted based on one or more of. a) network, events; b) applications detec ed c) user authentication; d) type of the device; c) status of the device; I) ownership of an attached funct on attached to the device; and g) triggers. The method 1200 includes the option as part of step 1260 the step ofestab.Ush.bg an encapsulation for the frames io be mirrored via the one or mors portals 12. Portal selection may be carried out under the method 1200 based on one or more of: a) source address, destination address or both of the received frames; b) one or more fields in the frames to e mirrored; c) erformanc d) network or other security;; and e) location of the mirror, destination of the mirroring or hoik

0198I^' JOSj As represented in ¥1(1 I 3, a method 1300 is provided for the management of operations of the network system 100. The metkxi 1300 Includes, after standard initial setup of one or more devices of the network im¾struci«re 1 1 through network adm straiion input as is typically done in the field of he present invention, step 1310 of establishing on one or more packet forwarding devices of the network ininistruotirre 101 one or more network policies or roles implementing one or more network policies for forwarding frames of received packets based on computer applications running or attempting to run on the network system 100. Under step 1320. the network system 100 Is monitored continuously for computer applications running on the network system 100 tor those that may trigger one or more changes in the operations of one or more devices of the network infrastructure 101. It further includes step 1330 of changing one or more of the one or more of the enforcement policies or rules o one or more devices of the network infrastructure 101 based on the detection of one or more computer applications running on one or more of the plurality of devices of the network infrastructure iOL It is contemplated that the network manager Is able to identify the applications running on the net work system 100 based on one or more frames associated with the operation of the network system 100, such as by using the application identification function 200 described herein. The one or more network policies and/or rules include at least one of a set of ingress rules, egress rules, and mirroring rules. Step 1330 includes as an option for changing to change the mirroring of selectable frames of the received packets to the applicatio identification appliance I SO of the network intrasir eture 101. Further, the one or more policies to change may he one or more of, but not limited to: a) block a specific application flow; b) block art IP address; c) snipe a TCP connection; d) disable communication for an application; e) disable communications to an attached function; f) disable a network communication, in either or both of a forward path and a reverse path g) bandwidth-limit an application by a particular user; h) bandwidth-Hmlt an application for all users of the network system 100; i.) log all application data; and j) honeypot the application flow,

0199j(l!iH>J As represented m FIG. 14, a method 1400 is provided for monitoring the network system 100 to identify one or more computer applications mnning on one or more network devices. The method 1400 includes a first step 1410 of receiving on a device of the network infrastructure 10! one or more packets containing one or more frames, wherein the one or more frames are associated with a computer application. Next, in step 1 20, the content of the frames is examined for one or more signatures associated with the computer application and for other inibnnalion obtained from one or more mechanisms. In step 1430. the examined content is compared with computer application information of the one or more signatures and the other information. In step 1440, a most likely match is established lor the computer application associated with the one or more frames derived from die comparison, in step 1450, the match informadon is outputted representing an indication of a likely computer application associated with the examined frames based on the comparison. The information about the likely match may include a level of con fidence In the indication. Optionally under the method 1400, the information from the mechanisms may be weighted, The method 1400 further includes the optional steps of; a) scoring the comparison to assess the likely accuracy of the correlation between t e computer application identified by the one or more signatures comparison and the other information; and b) generating a single output with an identification of the likely computer application associated with the received one or more .frames. The method 1 00 may also include the step of adding one or more other mechanisms, including custom mechanisms, as pari of the comparison. The other mechanisms may be provided through an application programming interface, The step 1450 of outputting the mformation may he carried out by transmitting the entification of the likely computer application to a network control manager.

0200fOtO?) As represented in FIG. 15, a method 1500 is provided for identiiyh g one or more computer applications running or attempting to run on the network system 100- The method

02011500 includes step 1510 of first receiving information of one or more frames forwarded by one or more devices of the network infrastructure 101 , wherein the information is indicati ve of one or more computer applications. Step 1520 involves comparing information of one or more .frames forwarded with herniati n of a computer applications identification database. The information of the database is obiamed through multiple mechanism hi step 1530, the infonriatioa is used to establish a score for each computet application tha .may match the received mformation of the one or more frames. Finally, under step 1540, one or more computer applications are designated as being associated with the one or mote frames based on the established score. The designation information provided optionally includes an indication of the confidence in the designation. An optional step of the method 1500 Is to weight the likely accuracy of the one or more indi cators in the comparison. The indicators ma not be weighted equally. The mechanisms used to establish the computer applications Information includes, hut is not limited to: a) computer application, signatures; h) TCPAJDP canonical port value; e) IP protocol value; d) heuristics; e) regular expression; f) history; g) applications installed on the network; and h) statistics. The method 1500 optionally includes the step of establishing the score by co b ning scores for each type of received infonnatlom The history and installed applications mechanisms_* for example, may be used to weight the reliability of the mformation obtained from the other mechanisms,

0202| 1t 8| A number of examples to help illustrate the In vention have been described.

0203Nevertheless, it will he understood that various modifications may be made without departing from the spirit and scope of the invention. Accordingly, other embodiments are within the scope of the claims appended hereto,