Encryption broke deep-packet inspection. TLS 1.3, QUIC, and DNS-over-HTTPS hide everything DPI used to rely on. Axon's classifier investigates the packet payload, fingerprints other parts of the flow, and combines those signals into a custom heuristic that runs on a lightweight model (on the edge device) in real time.
The result: applications are identified within the first handful of packets, encrypted or not, without sending raw traffic to the cloud.
Classical deep packet inspection works by reading domain names out of cleartext metadata. In a modern network, almost none of that metadata is cleartext anymore. Most "network management" appliances quietly fall back to guessing.
We look at the parts of the packet payload that remain informative under encryption, and combine them with other observable behaviour to triangulate the application.
We fingerprint other parts of each flow: characteristics that don't change when the payload is encrypted. These survive QUIC, TLS 1.3, and most circumvention techniques.
Signals feed a lightweight AI model that runs directly on the Axon Agent. Classification is real-time, in-line, and doesn't send raw traffic anywhere.
When a new site comes online, the global classifier identifies the traffic using pre-trained models. As Axon observes more traffic at your site, any flows are resolved into generic buckets are marked and sent to the cloud for model retraining. The same flow that was "QUIC" in week one is "Instagram" or "Google API" by week three.
The top-applications chart is dominated by a single QUIC bar. The global classifier knows what protocol it is, but not yet which apps your users are running over it.
You are able to see the top domains for the traffic that is resolved into generic buckets ensuring that you are able to block the traffic to the domains that are not allowed from day one.
The on-device model gets better over time because we retrain it on the telemetry your own fleet produces. Retraining happens in the cloud (on our infrastructure) over the same private Axon VPN that every site is already connected to. Updated models are pushed back to the edge as signed deltas.
Once flows are classified into applications, Axon aggregates them into categories (Web, Social, Cloud, Streaming, Updates, and more) so policy can be written at the level operators actually think in. "Block social during school hours" is one rule, not fifty.
Custom categories let you split or merge those buckets per site. Tag a flow once, and the next retraining cycle teaches the model your site-specific taxonomy.
