In the
network control plane, a
pattern matching database is constructed and maintained to identify applications or application-level protocols. Additionally, a
pattern matching database is constructed and maintained to predict subsequent flows for
application layer / protocol or data protocols. After flow discrimination in network traffic mirrored from the data plane, in the first stage, the network
traffic flow is scanned, and then, if a
signaling protocol message is detected in the first stage scan, it is scanned in the second stage. In the second stage, based on the
signaling protocol message detected in the first stage scan, one of the application / data protocol pattern databases is selected for scanning purposes. If a match is found from the second stage scan, a mapping is created between the
signaling protocol identifier and the identifier of the predicted application
traffic flow, and it is communicated to the data plane for policy selection and
enforcement. detected signaling protocol message, one of the application / data protocol pattern databases is selected for scanning purposes If a match is found from the second stage scan, a mapping is created between the signaling
protocol identifier and the identifier of the predicted application
traffic flow, and it is communicated to the data plane for policy selection and
enforcement.