Patent ID: 6141686
Filing Date: 2000-10-31
Classification: H04L

Abstract:
A client-side application-classifier comprising:an upper interface to a higher-level network-socket library, the higher-level network-socket library for providing high-level network functions to high-level user applications by generating a socket for connecting to a remote machine on a network;a lower interface to a network-transport layer, the network-transport layer for formatting data for transmission over the network;an interceptor, coupled between the upper and lower interfaces, for intercepting network events;an examiner, coupled to the interceptor, for examining the network event intercepted and collecting statistical information about the network event, the statistical information including:an application name of one of the high-level user applications that caused the network event;a timestamp for the network event;a byte count when the network event is a transfer of data over the network;Internet addresses and ports when the network event is a connection or a data transfer; anda process identifier of a running instance of the high-level user application;a consolidator, coupled to the examiner, for consolidating the statistical information into application-classifier tables, the application-classifier tables including current tables for currently-running instances of applications, and historical tables that include closed applications; anda reporter, coupled to the consolidator, for sending the statistical information from the application-classifier tables to a remote policy server on the network, the statistical information including the application name,whereby the statistical information for network events is collected by the client-side application-classifier.