Method for providing authoritative application-based routing and an improved application firewall

A method for providing an improved application firewall, the method comprising the steps of:

• receiving, at one or more first computing devices, from a second computing device, a hash of an application requesting network access, along with associated information associated with the second computing device executing the application;
• determining, at the one or more first computing devices, an application identifier for the application using the received hash and the received associated information;
• communicating, at the one or more first computing devices, the application identifier to the second computing device and a third computing device executing the firewall to increase efficiency in validation and lookup processes of the firewall by correlating multiple disparate flows originating from the second computing device to an associated single application executing thereon identified by a given application identifier tagged to a given packet, wherein, for each packet having a given application identifier received at the firewall, the third computing device executing the firewall:
• references a network information database with the received application identifier to limit a comparison, by a policy engine associated with the firewall, of the received packet to a reduced set of application network behavior information of a plurality of application network behavior information stored on the network information database, wherein a set of application network behavior information, collectively defines a normal or abnormal traffic associated with a given application;
• and
• signals termination of the received packet or further inspection of the received packet if the referenced one or more behavior information associated with the received application identifier match one or more abnormal flow patterns.