Patent ID: 11949658
Assignee: PALO ALTO NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC G  H

Claim 0:
1. A method comprising:
maintaining, by a cybersecurity device, a subset of a catalog of application classes maintained by a cloud-based service, wherein the catalog associates each application class with one or more network traffic based signatures for classifying network traffic into an application class;
detecting, by the cybersecurity device, network traffic of a first session;
determining that the network traffic cannot be classified with the subset of the catalog;
communicating one or more packets of the network traffic to the cloud-based service to be classified;
based on obtaining from the cloud-based service an indication of a first application class and a first signature associated with the communicated one or more packets, associating an indication of the first application class with an identifier of the first session, wherein the first application class was in the catalog but not included in the subset of the catalog;
applying a first security policy which indicates the first application class to the network traffic; and
updating the subset of the catalog maintained by the cybersecurity device with the first application class and the first signature.