Device and related method for application identification

A device of a network system including a plurality of network infrastructure devices, the device comprising:

• an application identification function, the application identification function including:
• a. an application identification library including information about one or more signatures determined to be indicative of characteristics of one or more computer applications;
• b. an application identification database including information other than signatures information, wherein the other information is indicative of characteristics of the one or more computer applications and wherein the other information is obtained from one or more mechanisms for determining characteristics of the one or more computer applications;
• c. an application programming interface configured to enable inclusion in the database a custom mechanism for establishing other information indicative of characteristics of one or more computer applications;
• and
• d. an application identification engine configured to:
• i. examine content of one or more frames received at the device for the one or more signatures and the other information;
• ii. compare the content examined with:
• (a) the one or more signatures;
• and (b) the other information to match known computer application information from those two sources with the information derived from the examination of the one or more frames;
• and
• iii. output information representing an indication of a likely computer application associated with the examined frames based on the comparison.

A method for monitoring a network system to identify one or more computer applications running on one or more network devices of a plurality of network infrastructure devices of the network system, the method comprising the steps of;

• a. receiving on a device of the plurality of network infrastructure devices one or more packets containing one or more frames, wherein the one or more frames are associated with a computer application;
• b. examining content of the one or more frames received for one or more signatures associated with the computer application and for other information obtained from one or more mechanisms, wherein the information is indicative of characteristics of the computer application;
• c. comparing the examined content with computer application information of the one or more signatures and the other information;
• d. establishing a most likely match of the computer application information associated with the one or more frames derived from the comparison;
• and
• e. outputting information representing an indication of a likely computer application associated with the examined frames based on the comparison.