Patent ID: 11888874
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. An apparatus comprising:
a processor; and
a non-transitory computer-readable medium having program code stored thereon that is executable by the processor to cause the apparatus to,
cluster a first plurality of token weight vectors to generate a first plurality of clusters of token weight vectors, wherein the first plurality of token weight vectors were generated based, at least in part, on a first plurality of token vectors generated from captured network traffic of a session;
refine the first plurality of clusters to a refined set of one or more clusters, wherein the program code to refine the first plurality of clusters comprises program code to,
determine, a proximity score based, at least in part, on similarity of the token vectors that correspond to centers of the cluster, wherein the proximity scores indicate similarity of token vectors in the first plurality of token vectors corresponding to centers of respective clusters to a set of one or more application tokens for a target application;
discard n of the clusters with the n lowest proximity scores or those of the clusters with a proximity score below a proximity score threshold or those of the clusters with a proximity score below a proximity score threshold; and
re-cluster token weight vectors in clusters that remain; and

generate a network-level application signature for the target application based, at least in part, on those of the first plurality of token vectors that correspond to the refined set of one or more clusters of the token weight vectors that remain.