Abstract: A first device may include one or more processors. The first device may receive a network address request to obtain a network address that is associated with an application. The network address request may include application information that identifies the application. The first device may determine that the application is associated with a rule. The first device may store the application information and information identifying the network address request. The first device may obtain the network address based on the network address request. The first device may determine that the network address is associated with the rule. The first device may provide the network address, the rule, and/or the application information to a second device, to permit the second device to enforce the rule, based on determining that the application is associated with the rule and determining that the network address is associated with the rule.

Abstract: A network device may determine a plurality of reputation indicators that indicate a measure of reputation associated with the flow. A first reputation indicator, of the plurality of reputation indicators, may be determined based on applying a first reputation analysis technique in association with the flow. A second reputation indicator, of the plurality of reputation indicators, may be determined based on applying a second reputation analysis technique in association with the flow. The second reputation analysis technique may be different from the first reputation analysis technique. The network device may determine a reputation score for the flow based on the plurality of reputation indicators. The network device may prioritize the flow based on the reputation score.

Abstract: A device may determine that a received transmission control protocol (TCP) segment includes data for a hypertext transfer protocol (HTTP) version N stream, where N is greater than or equal to 2. The device may identify, from the received TCP segment, a stream identifier for the HTTP version N stream. The device may determine that a condition is satisfied for releasing one or more TCP segments, associated with the stream identifier, from a TCP reassembly queue. The device may release the one or more TCP segments from the TCP reassembly queue based on determining that the condition is satisfied.

Abstract: In general, techniques for sharing of network session data are described. The techniques may enable security devices to leverage application classification information in a federated manner. An example security device includes a memory and one or more processors. The processor(s) are configured to receive data representative of an application classification for a first packet flow from a second security device, to receive data of a second packet flow, and, when the second packet flow corresponds to the first packet flow, to monitor the data of the second packet flow based on the application classification for the first packet flow without determining an application classification for the second packet flow.

Abstract: A network device may determine a plurality of reputation indicators that indicate a measure of reputation associated with the flow. A first reputation indicator, of the plurality of reputation indicators, may be determined based on applying a first reputation analysis technique in association with the flow. A second reputation indicator, of the plurality of reputation indicators, may be determined based on applying a second reputation analysis technique in association with the flow. The second reputation analysis technique may be different from the first reputation analysis technique. The network device may determine a reputation score for the flow based on the plurality of reputation indicators. The network device may prioritize the flow based on the reputation score.

Abstract: In general, techniques for sharing of network session data are described. The techniques may enable security devices to leverage application classification information in a federated manner. An example security device includes a memory and one or more processors. The processor(s) are configured to receive data representative of an application classification for a first packet flow from a second security device, to receive data of a second packet flow, and, when the second packet flow corresponds to the first packet flow, to monitor the data of the second packet flow based on the application classification for the first packet flow without determining an application classification for the second packet flow.

Abstract: A method and system for providing high availability services to SCTP applications is disclosed. In one embodiment, a high availability (HA) server system includes an active server and a standby server with a primary redundancy module and a secondary redundancy module, respectively, which are operable for performing a method including forming a control channel between the active server and the standby server, forwarding IP addresses of the active server and the standby server to a client device when an association between the client device and the active server is established, synchronously mirroring a state of a SCTP stack and a state of an application of the active server to the standby server using the control channel, and servicing the client device using the standby server based on the state of the SCTP stack and the state of the application if a failure of the active server is detected.

Abstract: The processing of multi-streaming communication includes an association between a sender and a receiver established over a communications network. The processing also includes identifying each of more than one independent multi-streamed messages transferred over the association. Each of the multi-streamed messages are separated at the receiver, and each separated message is processed in parallel with the other messages on a corresponding unique processor at the receiver.

Abstract: A method and system for providing high availability services to SCTP applications is disclosed. In one embodiment, a high availability (HA) server system includes an active server and a standby server with a primary redundancy module and a secondary redundancy module, respectively, which are operable for performing a method including forming a control channel between the active server and the standby server, forwarding IP addresses of the active server and the standby server to a client device when an association between the client device and the active server is established, synchronously mirroring a state of a SCTP stack and a state of an application of the active server to the standby server using the control channel, and servicing the client device using the standby server based on the state of the SCTP stack and the state of the application if a failure of the active server is detected.