Patent ID: 9258329
Filing Date: 2016-02-09
CPC Classification: H04L

Claim Text:
1. A network security device comprising: an interface configured to receive a packet flow; a control unit configured to receive a security policy to control access by the packet flow to a network, wherein the security policy includes: a rules engine of the control unit configured to dynamically identify a type of layer seven application associated with the packet flow by inspecting application-layer data within payloads of packets of the packet flow and without basing the identification solely on a layer four port specified by headers within the packets, wherein the rules engine is further configured to determine whether the dynamically identified type of layer seven application associated with the packet flow matches the type of layer seven application of the security policy, wherein the rules engine is further configured to apply the security policy to determine whether the packet flow matches a layer four port in the static port list of the match criteria of the security policy, and wherein the rules engine is further configured to, upon determining that the packet flow matches a layer four port of the static port list and upon determining the dynamically identified type of layer seven application associated with the packet flow matches the type of layer seven application of the security policy, applies the actions of the security policy to the packet flow.