Patent ID: 11888874
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 5:
6. The method of claim 1 further comprising:
clustering a second plurality of token weight vectors to generate a second plurality of clusters of token weight vectors, wherein the second plurality of token weight vectors were generated based, at least in part, on a second plurality of token vectors generated from captured network traffic of a second session;
refining the second plurality of clusters to a second refined set of one or more clusters, wherein refining the second plurality of clusters comprises,
determining a proximity score based, at least in part, on similarity of the token vectors that correspond to centers of the cluster, wherein the proximity scores indicate similarity of token vectors in the second plurality of token vectors corresponding to centers of respective clusters to the set of one or more application tokens for the target application;
discarding n of the clusters with the n lowest proximity scores or those of the clusters with a proximity score below a proximity score threshold; and
re-clustering the remaining ones of the token weight vectors; and

generating a second network-level application signature for the target application based, at least in part, on those of the second plurality of token vectors that correspond to the second refined set of one or more clusters of the token weight vectors that remain.