A classic intrusion-detection system reads the network as a stream of packets and looks for known-bad patterns inside them. That works until the attacker's traffic looks ordinary at the packet level — encrypted, well-formed, riding on a port that's supposed to be open. The signal that something is wrong often isn't in the bytes; it's in the mismatch between what an application is supposed to do and what it's actually doing.
The grant US10862921B2, "Application-aware intrusion detection system" (issued December 8, 2020, assigned to Cisco Technology, Inc.), is built on that idea. Its CPC classifications — H04L 63/1441, H04L 63/1416, H04L 63/1425, plus H04L 43/04 for traffic analysis — describe a detection system that ties what it sees on the wire to the application context that gives it meaning.
“In one embodiment, activity of a plurality of applications in a computer network is monitored, and a plurality of individual business transactions occurring within the plurality of applications may be identified.”— U.S. Patent No. 10,862,921 source
The mechanism worth understanding is the added layer of context. If the system knows a given flow belongs to a database client, it can hold that flow to the behavior a database client should exhibit — and a database client suddenly exfiltrating gigabytes, or speaking to a host it has never contacted, becomes anomalous in a way a context-free sensor would never notice. The application identity turns ambiguous traffic into a clear signal.
For defenders reconstructing how a breach unfolded, this is the layer that often holds the answer. Many intrusions don't trip a packet signature; they show up as a known application behaving out of character. An IDS that records traffic against application context gives incident responders a far richer story than a flat packet log.
The trade-off is operational: application awareness requires the system to reliably attribute flows to applications, which is harder when traffic is encrypted or tunneled. The patent's contribution is in making that attribution useful for detection, and it reflects a broader industry move away from treating the network as undifferentiated traffic and toward treating it as a set of applications with expected behavior.