Patent Document ID: 8626912
Application ID: 13831626
Patent Flag: 1

Claim One:
1. A method for monitoring communication over a network with a network device that is operative to perform actions, comprising: passively monitoring a plurality of packets on the network and determining at least one other network device on the network and at least one network protocol based on at least data included in the monitored packets, wherein the monitored packets include at least a portion of data associated with layers four through seven (L4-L7 data) of the Open Systems Interconnection (OSI) model; determining a plurality of transactions by reassembling at least a portion of the plurality of monitored packets based on the at least one determined network protocol; determining at least one application based on testing the L4-L7 data that is included in each transaction, wherein at least a portion of the L4-L7 data is scanned to identify at least one pattern of at least one application transaction that is associated with the at least one application, and wherein each pattern is at least one of previously provided or determined from payload data for at least one network packet; and generating at least one application profile that includes at least an identity of the application and associating the application profile with the at least one other network device.