Application Identification in Network Flow Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network communication flow monitoring technologies face challenges in determining appropriate network requirements for encrypted flows and distinguishing between various applications using the same transport protocols, leading to insufficient network visibility and security, especially in identifying known and unknown malware.
Innovation Solution
A system that includes a flow record agent on endpoint devices and hypervisors to generate and collect flow records, which include a unique identifier and application hash, allowing for classification of applications as known-good, known-bad, or unknown, and providing enhanced network visibility and security by directly linking applications to network traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If NetFlow records document communication flows using traditional parameters (IP addresses, port numbers, protocol types), then network visibility is provided at a basic level, but the ability to distinguish between different applications using the same transport protocols is insufficient
Solution Approach 1:
The flow record is segmented into multiple distinct fields: traditional NetFlow parameters (source/destination IP addresses, port numbers, protocol type) are separated from new application identification fields (application protocol identifier, application hash). This segmentation allows the system to maintain comprehensive flow information while enabling precise application-level identification without overwhelming the record structure.
Solution Approach 2:
The patent adds a new dimension to flow record analysis by introducing application-layer identification fields beyond the traditional network-layer parameters. Instead of only examining IP addresses and port numbers, the system now incorporates application protocol identifiers and cryptographic hashes of application binaries, creating a multi-dimensional approach to flow characterization that enables precise application distinction.
2Reliability
If encrypted communication flows are monitored using traditional methods, then network traffic can be observed, but determining appropriate network requirements and identifying malware is difficult due to encryption masking
Solution Approach 1:
The system performs preliminary action by capturing and hashing the application binary at the source endpoint before the encrypted communication occurs. The application hash is computed and embedded in the flow record at the outset, allowing reliable application identification and security assessment before the encrypted traffic obscures traditional identification methods.
Solution Approach 2:
The application hash serves as an intermediary that bridges the gap between encrypted traffic and application identification. Instead of attempting to decipher encrypted content, the system uses the cryptographic hash of the application binary as a reliable mediator that uniquely identifies the application responsible for the encrypted flow, enabling security decisions without decrypting the traffic.
3Adaptability or versatility
If multiple applications use the same transport protocols, then network protocol compatibility is maintained, but network visibility into specific application behavior is lost
Solution Approach 1:
The patent applies local quality by adding application-specific identification information to flow records without altering the underlying transport protocol behavior. Each flow record is locally enhanced with application protocol identifiers and application hashes that are specific to that particular application instance, allowing precise differentiation while maintaining the universal compatibility of the transport protocols themselves.
4Productivity
If traditional NetFlow monitoring is used to provide network visibility, then basic flow statistics are available, but detection of known and unknown malware is insufficient
Solution Approach 1:
The system creates a cryptographic copy (hash) of the application binary that serves as a unique fingerprint for identification. Instead of storing or analyzing the entire binary or relying on signature matching, the patent uses a compact application hash that replicates the identifying characteristics of the malware, enabling efficient detection of both known and unknown threats through hash comparison.
Data Source
AI summary
In one embodiment, a method is provided for improving data center and endpoint network visibility and security. The method comprises detecting a communication flow of a plurality of packets over a network, and generating a flow identifier that uniquely identifies the communication flow. After determining an application associated with the communication flow, a flow record is generated. The flow record includes the flow identifier and an indication of the application associated with the communication flow. The indication of the application may be, for example, a hash of the application binary file.