Client-side application-classifier gathering network-traffic statistics and application and user names using extensible-service provider plugin for policy-based network control

DETAILED DESCRIPTION A client-side application-classifier has an upper interface to a higher-level network-socket library.
The higher-level network-socket library provides high-level network functions to high-level user applications by generating a socket for connecting to a remote machine on a network.
A lower interface is to a network-transport layer that formats data for transmission over the network.
An interceptor is coupled between the upper and lower interfaces.
It intercepts network events.
An examiner is coupled to the interceptor.
It examines the network event intercepted and collects statistical information about the network event.
The statistical information includes: an application name of one of the high-level user applications that caused the network event; a timestamp for the network event; a byte count when the network event is a transfer of data over the network; Internet addresses and ports when the network event is a connection or a data transfer; and a process identifier of a running instance of the high-level user application.
A consolidator is coupled to the examiner.
It consolidates the statistical information into application-classifier tables.
The application-classifier tables include current tables for currently-running instances of applications, and historical tables that include closed applications.
A reporter is coupled to the consolidator.
It sends the statistical information from the application-classifier tables to a remote policy server on the network.
The statistical information includes the application name.
Thus the statistical information for network events is collected by the client-side application-classifier.
In further aspects of the invention the interceptor is an extensible service provider and the examiner is an application-classifier plugin to the extensible service provider.
The extensible service provider controls other plugins providing low-level network services.
In still further aspects the examiner generates an event object containing the statistical information