Patent ID: 11888874
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 8:
9. A non-transitory, machine-readable medium having instructions stored thereon that are executable by a computing device to perform operations comprising:
generating a first plurality of tokenized packets from network traffic, wherein each tokenized packet comprises one or more tokens that identify an application or describe a packet attribute;
associating weights with the tokens;
creating a first plurality of tokenized packet clusters based, at least in part, on the associated weights;
refining the first plurality of clusters to a refined set of one or more clusters, wherein refining the first plurality of clusters comprises,
determining a proximity score based, at least in part, on similarity of the tokenized packets that correspond to centers of the cluster, wherein the proximity scores indicate similarity of tokens of the tokenized packets corresponding to centers of respective clusters to a set of one or more application tokens for a target application;
discarding n of the clusters with the n lowest proximity scores or those of the clusters with a proximity score below a proximity score threshold; and
re-clustering the remaining tokenized packets; and

generating program code that indicates a pattern of the tokens in those of the first plurality of tokenized packets that correspond to a refined set of one or more clusters of the token weight vectors that remain, wherein the pattern represents network behavior of the target application.