US 12,413,512 B2
Application traffic flow prediction based on multi-stage network traffic flow scanning
Daphne Sang, Los Altos, CA (US); and Harish Patil, Fremont, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Jul. 12, 2024, as Appl. No. 18/772,081.
Application 18/772,081 is a continuation of application No. 17/819,708, filed on Aug. 15, 2022, granted, now 12,068,950.
Claims priority of provisional application 63/367,029, filed on Jun. 24, 2022.
Prior Publication US 2024/0372801 A1, Nov. 7, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 45/00 (2022.01); H04L 41/0894 (2022.01); H04L 43/026 (2022.01); H04L 45/745 (2022.01); H04L 47/10 (2022.01); H04L 47/20 (2022.01); H04L 47/2483 (2022.01)
CPC H04L 45/38 (2013.01) [H04L 41/0894 (2022.05); H04L 43/026 (2013.01); H04L 45/745 (2013.01); H04L 47/10 (2013.01); H04L 47/20 (2013.01); H04L 47/2483 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
identifying a data protocol or application for a second network traffic flow expected to be subsequent to a first network traffic flow, wherein identifying the data protocol or application comprises,
based on identifying a first application level protocol for the first network traffic flow, selecting a pattern database of the first application level protocol;
based on matching a pattern in the first network traffic flow with an entry in the pattern database while scanning the first network traffic flow, extracting first traffic flow identifying information from the first network traffic flow according to the matching entry, wherein the matching entry indicates how to locate flow identifying information based on the matched pattern; and
associating an identifier of the first application level protocol with the first traffic flow identifying information; and
applying a policy indicated for the first application level protocol to the second network traffic flow based on the second network traffic flow being identified by the first traffic flow identifying information.