How Does Application Visibility and Control Work? The application identification (App ID) classification engine and application signature pattern-matching engine operate at Layer 7 and inspect the actual content of the payload for identifying applications. App ID performs a deep packet inspection (DPI) of traffic on the network and on every packet in the flow that passes through the application identification engine until the application is identified. Application findings such as IP addresses, hostnames, and port ranges are saved in the application system cache (ASC) to expedite future identification. -- Juniper
AVC uses stateful deep packet inspection (DPI) to classify more than 1400 applications. It can also combine DPI with techniques such as statistical classification, socket caching, service discovery, auto learning, and DNS-AS. Custom applications can detect native apps. -- Cisco AVC
The inspection of thousands of traffic patterns over several years led Meraki to create a database of traffic signatures that can be used to recognize network traffic at the application level. -- Meraki (Cisco)
AppRF performs deep packet inspection (DPI) of local traffic and detects over 1500 applications on the network. AppRF allows you to configure both application and application category policies within a given user role. WebCC uses a cloud-based service to dynamically determine the types of websites being visited, and their safety -- Aruba (HP)
Different vendors of NG Firewalls perform application control but the technique used isn't documented. All vendors do a quick explanation of how it works but no details are given.
I'm asking if someone knows what happens in the background when no SSL interception is used on the firewall and all traffic is transferred via HTTPS (TLS 1.2) [URL is hidden too].
How does the NGFW identify and see inside Google, Facebook, etc. traffic separating (videos, games, chat, etc.)? One way should be identifying IPs if they use different ranges dedicated to specific services but this technique doesn't offer much granularity. The most interesting part is "traffic patterns". How are they built and what's the fault positive risk to block a valid application that has a "similar" pattern to a famous app?