Utilizing service tagging for encrypted flow classification

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive domain name system (DNS) information for a domain, wherein the DNS information includes one or more service tags indicative of one or more services offered by the domain;
• detect an encrypted traffic flow associated with the domain;
• identify a service associated with the encrypted traffic flow based on the one or more service tags;
• and
• prioritize the encrypted traffic flow based on the identified service associated with the encrypted traffic flow.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• receiving, at the device, domain name system (DNS) information for a domain, wherein the DNS information includes one or more service tags indicative of one or more services offered by the domain;
• detecting, by the device, an encrypted traffic flow associated with the domain;
• identifying, by the device, a service associated with the encrypted traffic flow based on the one or more service tags;
• and
• prioritizing, by the device, the encrypted traffic flow based on the identified service associated with the encrypted traffic flow.