Patent ID: 11949658
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 8:
9. One or more non-transitory machine-readable media comprising program code for application-based classification of network traffic by a cybersecurity device, the program code to:
maintain a subset of a catalog of application classes maintained by a cloud-based service, wherein the catalog associates each application class with one or more network traffic based signatures for classifying network traffic into an application class;
detect network traffic of a first session;
determine whether the network traffic can be classified with the subset of the catalog;
based on a determination that the network traffic cannot be classified with the subset of the catalog maintained by the cybersecurity device, communicate one or more packets of the network traffic to the cloud-based service to be classified;
based on obtaining from the cloud-based service an indication of a first application class and a first signature associated with the communicated one or more packets, associate an indication of the first application class with an identifier of the first session, wherein the first application class was in the catalog but not included in the subset of the catalog;
apply a first security policy which indicates the first application class to the network traffic; and
update the subset of the catalog maintained by the cybersecurity device with the first application class and the first signature.