# US 2017/0288987 A1 · Application signature generation and distribution

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0288987 A1
- Document ID: US20170288987A1
- Status: Published application
- Kind: A1
- Application number: 15/083,693
- Filed: 2016-03-29
- Published: 2017-10-05
- Earliest claimed: 2016-03-29
- Assignees: Juniper Networks, Inc.
- Applicants: Juniper Networks, Inc.
- Inventors: Thyagarajan S. PASUPATHY; Venkata Rama Raju MANTHENA; Rajeev CHAUBEY
- Web page: https://patentgrep.com/patent/US20170288987A1

## CPC

- H04L 43/028: by filtering
- G06F 16/951: Indexing; Web crawling techniques
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3247: {involving digital signatures}
- H04L 43/00: Arrangements for monitoring or testing data switching networks
- H04L 43/026: using flow identification
- H04L 43/16: Threshold monitoring
- H04L 47/10: Flow control; Congestion control
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A network device may receive network traffic for an application. The network device may identify an application layer protocol being used for the network traffic. The network device may obtain contextual information, from the network traffic, to obtain an item of contextual information, and the item of contextual information may be selected based on the application layer protocol. The network device may determine that the item of contextual information matches a stored item of contextual information. The network device may determine that a threshold has been met with regard to the stored item of contextual information. The network device may generate an application signature for the application based on the item of contextual information. The network device may send the application signature to another device to permit the other device to identify the application based on the application signature.

## Claims

### Claim 1

A network device, comprising:
one or more processors to:
receive network traffic for an application;
identify an application layer protocol being used for the network traffic;
obtain contextual information, from the network traffic, to obtain an item of contextual information,
the item of contextual information being selected based on the application layer protocol;
determine that the item of contextual information matches a stored item of contextual information;
determine that a threshold has been met with regard to the stored item of contextual information;
generate an application signature for the application based on the item of contextual information; and
send the application signature to another device to permit the other device to identify the application based on the application signature.

### Claim 2 (depends on 1)

The network device of claim 1,
where the one or more processors are further to:
determine, before sending the application signature to the other device, whether the application signature is public; and
where the one or more processors, when sending the application signature to the other device, are to:
selectively send the application signature to the other device based on whether the application signature is public.

### Claim 3 (depends on 1)

The network device of claim 1,
where the application signature is a first application signature; and
where the one or more processors are further to:
receive, from the other device, a second application signature;
determine whether the second application signature corresponds to the first application signature; and
selectively store both the first application signature and the second application signature when the second application signature does not correspond to the first application signature; or
when the second application signature corresponds to the first application signature,
selectively determine a higher priority one of the first application signature and the second application signature, and
selectively store the higher priority one of the first application signature and the second application signature.

### Claim 4 (depends on 3)

The network device of claim 3,
where the one or more processors are further to:
generate, before determining whether the second application signature corresponds to the first application signature, a first hash based on the first application signature and a second hash based on the second application signature; and
where the one or more processors, when determining whether the second application signature corresponds to the first application signature, are to:
determine whether the first hash matches the second hash.

### Claim 5 (depends on 1)

The network device of claim 1, where the one or more processors are further to:
send, to the other device, the contextual information.

### Claim 6 (depends on 1)

The network device of claim 1,
where the application layer protocol is hypertext transfer protocol (HTTP);
where the item of contextual information includes at least one of a server hostname or a uniform resource identifier (URI) that is being requested; and
where the application signature is based on at least one of the server hostname or the URI that is being requested.

### Claim 7 (depends on 1)

The network device of claim 1,
where the application layer protocol is a secure protocol;
where the item of contextual information includes at least one of a common name for a server certificate or a server name extension from a client hello message; and
where the application signature is based on at least one of the common name for the server certificate or the server name extension.

### Claim 8

A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
receive network traffic associated with an application;
determine, from the network traffic, an application layer protocol being used for the network traffic;
obtain, from the network traffic, an item of contextual information,
the item of contextual information being associated with the application layer protocol;
determine that the item of contextual information matches a stored item of contextual information;
determine that a threshold has been met with regard to the stored item of contextual information;
generate an application signature for the application based on the stored item of contextual information; and
send the application signature to another device to permit the other device to identify the application based on the application signature.

### Claim 9 (depends on 8)

The non-transitory computer-readable medium of claim 8,
where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
generate, before sending the application signature to the other device, a normalized application signature,
the normalized application signature including a hash generated based on the stored item of contextual information; and
where the one or more instructions, that cause the one or more processors to send the application signature to the other device, cause the one or more processors to:
send the normalized application signature to the other device.

### Claim 10 (depends on 8)

The non-transitory computer-readable medium of claim 8,
where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
determine, before sending the application signature to the other device, whether the application signature is public; and
where the one or more instructions, that cause the one or more processors to send the application signature to the other device, cause the one or more processors to:
selectively send the application signature to the other device based on whether the application signature is public.

### Claim 11 (depends on 8)

The non-transitory computer-readable medium of claim 8,
where the application signature is a first application signature; and
where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
store the first application signature;
receive a second application signature;
determine whether the second application signature corresponds to the first application signature; and
selectively store the second application signature when the second application signature does not correspond to the first application signature; or
when the second application signature corresponds to the first application signature,
selectively determine a higher priority one of the first application signature and the second application signature, and
selectively replace the first application signature with the second application signature when the higher priority one, of the first application signature and the second application signature, is the second application signature.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11,
where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
generate, before determining whether the second application signature corresponds to the first application signature, a first hash based on the first application signature and a second hash based on the second application signature; and
where the one or more instructions, that cause the one or more processors to determine whether the second application signature corresponds to the first application signature, cause the one or more processors to:
determine whether the first hash matches the second hash.

### Claim 13 (depends on 8)

The non-transitory computer-readable medium of claim 8,
where the application layer protocol is hypertext transfer protocol (HTTP);
where the stored item of contextual information includes at least one of a server hostname or a uniform resource identifier (URI) that is being requested; and
where the application signature is based on at least one of the server hostname or the URI that is being requested.

### Claim 14 (depends on 8)

The non-transitory computer-readable medium of claim 8,
where the application layer protocol is a secure protocol;
where the stored item of contextual information includes at least one of a common name for a server certificate or a server name extension from a client hello message; and
where the application signature is based on at least one of the common name for the server certificate or the server name extension.

### Claim 15

A method, comprising:
receiving, by a network device, network traffic,
the network traffic corresponding to an application;
identifying, by the network device, an application layer protocol being used for the network traffic;
obtaining, by the network device and from the network traffic, an item of contextual information,
the item of contextual information being selected based on the application layer protocol;
determining, by the network device, that the item of contextual information matches a stored item of contextual information;
determining, by the network device, that a threshold has been met with regard to the stored item of contextual information;
generating, by the network device and for the application, an application signature based on the item of contextual information; and
sending, by the network device, the application signature to another device to permit the other device to identify the application based on the application signature.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
determining, before sending the application signature to the other device, whether the application signature is public; and
where sending the application signature to the other device comprises:
selectively sending the application signature to the other device based on whether the application signature is public.

### Claim 17 (depends on 15)

The method of claim 15,
where the application signature is a first application signature; and
the method further comprises:
receiving a second application signature;
generating a first hash based on the first application signature and a second hash based on the second application signature;
determining whether the first hash matches the second hash; and
selectively storing both the first application signature and the second application signature when the first hash does not match the second hash; or
when the first hash matches the second hash,
selectively determining a higher priority one of the first application signature and the second application signature, and
selectively storing the higher priority one of the first application signature and the second application signature.

### Claim 18 (depends on 15)

The method of claim 15, further comprising:
generating, before sending the application signature to the other device, a normalized application signature,
the normalized application signature including a hash generated based on the item of contextual information; and
where sending the application signature to the other device comprises:
sending the normalized application signature to the other device.

### Claim 19 (depends on 15)

The method of claim 15,
where the application layer protocol is hypertext transfer protocol (HTTP);
where the item of contextual information includes at least one of a server hostname or a uniform resource identifier (URI) that is being requested; and
where the application signature is based on at least one of the server hostname or the URI that is being requested.

### Claim 20 (depends on 15)

The method of claim 15,
where the application layer protocol is a secure protocol;
where the item of contextual information includes at least one of a common name for a server certificate or a server name extension from a client hello message; and
where the application signature is based on at least one of the common name for the server certificate or the server name extension.