14.1 Application Categories

To facilitate queries, reporting, and policy configuration, administrators can predefine categories in the system. Category management includes: application categories, website categories, removable storage categories, software installation package categories, software uninstall categories, time type categories, network address categories, network port categories, email categories, watermark template categories, and sensitive information category libraries.

Select Category Management → Applications to open the application category window. By default, the system defines two categories: System Applications and Uncategorized.

System Applications refers to programs related to the operating system. To prevent critical issues, these system programs are separated into this category. Administrators may also move other programs into this category as needed.

All applications are collected from client machines. If an application does not match any existing category, it is classified as Uncategorized. Administrators can create new categories and move relevant programs from Uncategorized into the new category, but applications cannot be manually added.

Applications can also be categorized using Application Identification Rules. These rules act like tags: any application that matches a rule is automatically assigned to the category associated with that rule.

Administrators organize applications with similar types into a single category. Available operations for managing categories include:

Operation Description
Create Category In the root directory of application categories, select Action → New or right-click New to add a new category and enter its name. Subcategories can also be added: select an existing category, right-click New, and a subcategory will be created under it.
Move Applications After creating a category, relevant applications need to be moved into it. Locate the applications, right-click Set Application Category or choose Action → Move To to transfer them to the target category, or drag them with the mouse to the desired category. A Set Identification Rule window will appear, allowing you to specify the target category and the type of identification rule. Multiple applications can be selected simultaneously by holding Ctrl or Shift.
Search Click the "search icon" on the toolbar or select "Action -> Search" to open the search window, which allows you to locate specific applications, their categories, or application recognition rules.
  • The application library search has two modes: Search by Recognition Rule and Search by Application Record:
  • 1. If the "Application Recognition Rules" column is displayed in the application library, the search box is in Recognition Rule Search mode. Enter your criteria and click search to find the corresponding recognition rules.
  • 2. If the "Application Recognition Rules" column is not displayed, the search box is in Application Record Search mode. Enter your criteria and click search to find the corresponding application records.
  • The search function can also speed up classification. For example, to move all QQ programs to the QQ category, enter "qq" in the search; all matching programs will appear and can be dragged to the QQ category, greatly simplifying the classification process.
Export Applications Select an application or an application category, then choose "Action -> Export" or right-click and select "Export" to export the selected applications.
Show Recognition Rules Click the Show Recognition Rules icon"Show Recognition Rules" on the toolbar to toggle the display of the application recognition rules panel. When enabled, the application classification view splits into two sections: recognition rules appear in the upper pane, and applications appear in the lower pane.
Create a New Recognition Rule: Click the New Recognition Rule icon "New Recognition Rules" on the toolbar, select Action → New Recognition Rule, or create it directly from an application record. The Set Recognition Rule window opens, allowing you to define a new rule based on Name, File Name, Company Name, Icon, or Application Category. Once the rule is selected, the applications that match it will appear in the application panel.
Import Recognition Rule Library Select Action → Import Recognition Rule Library to import a recognition rule library file. The file must be in .csv format.
Export Recognition Rule Library Select Action → Export Recognition Rule Library to export the recognition rules from the application library to a local file in .csv format.
Delete Recognition Rule Select a rule and choose Right-click → Delete to remove the recognition rule. The associated application records will not be deleted; they will attempt to match other recognition rules. If no match is found, they will automatically revert to the Unclassified category.

Note

  • The Unclassified and System Applications categories cannot be deleted and cannot have subcategories created under them.

Creating Identification Rules

The currently supported identification rules are as follows:

Identification Rule Description
File Name Recognition Identifies programs solely by their file name; programs with the same file name are classified together.
File Name + Company Name Recognition Identifies programs by both file name and company name; programs matching both are classified together.
Class Feature Recognition Uses an internal hash value of the program to identify it. This hash, calculated via a custom algorithm, ensures that different versions of the same software from the same company (e.g., Sohu News 1.6.0 and 1.7.3) are recognized as the same class. It also prevents evasion via simple file name changes.
Specific Program Feature Recognition Uses a unique program identifier for recognition. Only the selected program will match; other programs will not.

Note

  • The priority for applying identification rules is: Specific Program Feature Recognition > File Name + Company Name Recognition > File Name Recognition > Class Feature Recognition.

There are two ways to create identification rules: manual creation and creation via application records.

Steps for manual creation:

  • Click the Show Identification Rules icon "Show Identification Rules" on the toolbar to display the application identification rules pane.
  • Select an application category group, then click the New Identification Rule icon "New Identification Rules" on the toolbar or choose Action → New Identification Rule to open the identification rule settings window.
  • In the settings window, enter the Name and File Name, optionally select Company Name, choose the target category, add any remarks, and click OK.
  • The newly created rule will appear under the selected application category group. Selecting this rule will display all applications that match it in the application pane.

Note

  • 1. Manual creation can only produce File Name rules or File Name + Company Name rules.
  • 2. Selecting the Company Name option during creation will generate a File Name + Company Name rule.
  • 3. Leaving the Company Name option unchecked will generate a File Name rule.

Steps to Create an Identification Rule via an Application Record:

  • In the Applications panel, select an application record, then either right-click → Set Program Category or drag the record to a group in the left-hand category tree. The Set Identification Rule window will appear.
  • In the window, click the icon select icon button to select the target application group. If using drag-and-drop, the group defaults to the one where the record was dropped.
  • Choose the type of identification rule to create: File Name, File Name + Company Name, Feature of This Type of Application, or Feature of This Application.
  • Click OK. The new identification rule will appear under the selected group. Selecting this rule will show all applications in the panel that match it.

Note

  • Creating identification rules via application records does not require manually entering names or other details; all information is automatically extracted from the application record.