Protocol and Metadata Support
Industry-leading classification and metadata extraction
Qosmos technology typically recognizes over 97% of network traffic including regional applications, thanks to the worldwide deployment of equipment embedding our technology. Our continuously updated library of more than 2900 plugins and signatures, and over 4500 metadata, covers all categories of protocols and applications used over IP networks, both by human users and machines (IoT).
The Qosmos strategy puts particular emphasis on the following:
- Bandwidth-intensive protocols
- Content-based applications
- Top 100 applications per region
- Cyber security requirements
- Customer requests
Each signature is augmented with specific characteristics (such as family and tags) which are designed to enhance service awareness and enable highly accurate processing for QoS, blocking, throttling, metering, etc.
Example of signatures with additional info:
|Signature||Examples of characteristics & metadata|
|BitTorrent||Multiple client access, P2P service, File transfer workflow|
|YouTube||Video, URL, date, duration, frame rate, +30 other metadata|
|MSFT Lync||Service identification, IM, database|
|RTSP||Play/pause, streamed file, URL, video duration +40 other metadata|
|Skype||Service identification, VoIP service, IM|
|Program version, service identification, IM|
Constant changes in application protocols make it difficult for non-specialists to keep signatures up-to-date. We are world-class experts in this area: engineers at Qosmos Labs continuously monitor changes in protocols and applications and make appropriate updates to ensure that signatures stay fresh.
Qosmos monitors live traffic from all parts of the world and has developed proprietary productivity tools such as the Protocol Development Language (PDL) and protocol signatures in data format to speed up protocol plugin development while ensuring the highest standards of quality and reliability. Qosmos can also provide the tools for customers who want to develop specific signatures themselves.
Advanced inspection techniques
Beyond complex protocols which have to be tested in different configurations (e.g. throttling and blocking workflows), Qosmos experts have automated a whole series of tests which can detect false positives which could cause problems for solutions embedding Qosmos technology.
In order to handle more complex applications and increasing encryption, Qosmos Labs has added new approaches to identify protocols, based on a combination of advanced techniques: e.g. behavioral recognition, regexp, statistical analysis, flow correlation, and DNS matching.