Controlling network access based on application detection

#This specification generally relates to controlling access of a device to a network based on the detection of a network application running on the device.

#In corporate and other networks, devices connected to the network may communicate with resources inside the network, such as internal servers, and with resources outside the network, such as external servers on the public Internet. The devices may also run various software applications that may access the network in various ways. These software applications may include Web browsers (e.g., Microsoft® Internet Explorer, Google Chrome™, etc.), data transfer applications (e.g., BitTorrent), anonymizing applications (e.g., The Onion Router (TOR)), security-avoidance applications (e.g., UltraSurf), as well as other software applications.

#In general, one aspect of the subject matter described in this specification may be embodied in systems, and methods performed by data processing apparatuses that include the actions of maintaining one or more application profiles, each application profile associated with one or more network activities in a network; detecting one or more network activities associated with a device connected to the network; determining that the one or more detected network activities associated with the device substantially match network activities associated with a predetermined application profile; and denying network access by the device to the network based upon the determination.

#FIG. 1 is a diagram of an example environment.

#FIG. 2 is a message flow diagram of an example interaction between the components of the example network to control network access based on application detection.

#FIG. 3 is a flow chart of an example process of controlling network access based on application detection.

#Like reference numbers and designations in the various drawings indicate like elements.

#Network owners often face the problem of software applications installed on devices connected to their network generating unwanted, malicious, or otherwise prohibited network traffic. For example, an employee running a BitTorrent client on a company computer could increase the network owner's bandwidth costs considerably, as well as introduce unwanted security risks. With the recent proliferation of mobile devices, many network owners have adopted a Bring Your Own Device (BYOD) approach in which users can access internal networks using personal devices. In such a network, it can be more difficult to identify prohibited software applications, as the network owner may not be in control of or have access to the individual devices so as to detect and handle the prohibited applications (e.g., remove or disable them).

#One approach to handling prohibited software applications includes detecting and blocking all application traffic associated with the prohibited application. For example, a solution may be configured to block all messages sent and received by a BitTorrent client, as BitTorrent uses a documented and well-defined network protocol. However, some applications, such as UltraSurf, attempt to thwart this strategy by communicating in many different ways, relying on a security solution not being able to block all the different communications. Such applications may also be updated regularly by developers with different communication behaviors, such that a security solution must be reconfigured to address each new version of the application.