Patent ID: 11949658
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 15:
16. An apparatus comprising:
a processor; and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
detect network traffic of a first session;
determine if the network traffic can be classified with a subset of a catalog of application classes maintained locally,
wherein a cloud-based service maintains the catalog of application classes, wherein the catalog associates each application class with one or more network traffic based signatures for classifying network traffic into an application class;

based on a determination that the network traffic cannot be classified with the subset of the catalog, communicate one or more packets of the network traffic to the cloud-based service for classification;
based on obtaining from the cloud-based service an indication of a first application class and a first signature associated with the communicated one or more packets, associate an indication of the first application class with an identifier of the first session, wherein the first application class was in the catalog but not included in the subset of the catalog;
apply a first security policy which indicates the first application class to the network traffic; and
update the subset of the catalog maintained locally with the first application class and the first signature.