Encryption broke deep-packet inspection. TLS 1.3, QUIC, and DNS-over-HTTPS hide everything DPI used to rely on. Axon's classifier investigates the packet payload, fingerprints other parts of the flow, and combines those signals into a custom heuristic that runs on a lightweight model (on the edge device) in real time.
The result: applications are identified within the first handful of packets, encrypted or not, without sending raw traffic to the cloud.
Classical deep packet inspection works by reading domain names out of cleartext metadata. In a modern network, almost none of that metadata is cleartext anymore. Most "network management" appliances quietly fall back to guessing.
We look at the parts of the packet payload that remain informative under encryption, and combine them with other observable behaviour to triangulate the application.
We fingerprint other parts of each flow: characteristics that don't change when the payload is encrypted. These survive QUIC, TLS 1.3, and most circumvention techniques.
Signals feed a lightweight AI model that runs directly on the Axon Agent. Classification is real-time, in-line, and doesn't send raw traffic anywhere.
When a new site comes online, the global classifier identifies traffic using pre-trained models. As Axon observes more of your site's traffic, any flow that only resolves to a generic bucket is flagged and sent to the cloud for retraining. The same flow that was "QUIC" in week one is "Instagram" or "Google API" by week three.
The top-applications chart is dominated by a single QUIC bar. The global classifier knows what protocol it is, but not yet which apps your users are running over it.
Even before retraining, a flow resolves to a named app so you can see the top domains inside each generic bucket. This means you can block traffic to domains you don't allow from day one.
The on-device model gets better over time because we retrain it on the telemetry your own fleet produces. Retraining happens in the cloud (on our infrastructure) over the same private Axon VPN that every site is already connected to. Updated models are pushed back to the edge as signed deltas.
Once flows are classified into applications, Axon aggregates them into categories (Web, Social, Cloud, Streaming, Updates, and more) so policy can be written at the level operators actually think in. "Block social during school hours" is one rule, not fifty.
Custom categories let you split or merge those buckets per site. Tag a flow once, and the next retraining cycle teaches the model your site-specific taxonomy.
