Automatic traffic classification of web applications and services based on dynamic analysis

An information handling system comprising:

• one or more processors;
• a network adapter that connects the information handling system to a computer network;
• a memory coupled to at least one of the processors;
• and
• a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions comprising:
• scanning a plurality of network resources corresponding to a plurality of named network applications, wherein the scanning comprises scanning one or more organization-owned network applications using a dynamic analysis scan and scanning one or more third-party network applications using a web crawler application;
• receiving, as a result of the scan, a first plurality of network resource identifiers accessed by a first named network application corresponding to a first network resource;
• monitoring network traffic between a plurality of users and the plurality of network resources, wherein the monitoring results in a second plurality of network resource identifiers;
• identifying a set of resource identifiers by matching the second plurality of network resource identifiers with one or more of the first plurality of network resource identifiers;
• and
• associating each of the set of resource identifiers with the first named network application.

A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, performs actions comprising:

• scanning a plurality of network resources corresponding to a plurality of named network applications, wherein the scanning comprises scanning one or more organization-owned network applications using a dynamic analysis scan and scanning one or more third-party network applications using a web crawler application;
• receiving, as a result of the scan, a first plurality of network resource identifiers accessed by a first named network application corresponding to a first network resource;
• monitoring network traffic between a plurality of users and the plurality of network resources, wherein the monitoring results in a second plurality of network resource identifiers;
• identifying a set of resource identifiers by matching the second plurality of network resource identifiers with one or more of the first plurality of network resource identifiers;
• and
• associating each of the set of resource identifiers with the first named network application.