Patent ID: 8125908
Filing Date: 2012-02-28
Classification: H04L

Abstract:
1. A computer-implemented method, comprising: a first computer system receiving first data over a network, wherein the first data comprises a plurality of packets from each of a plurality of connections, wherein the plurality of connections are between a corresponding first endpoint and a corresponding second endpoint, wherein the first computer system does not participate in communication between the first and second endpoints; the first computer system automatically classifying at least one connection according to an application protocol, wherein said classifying is based on the first data and uses one or more classification rules to produce classified data; after said classifying, the first computer system automatically determining if the classified data of the at least one connection conforms to an application protocol specification of the application protocol; if the classified data does not conform to the application protocol specification, the first computer system automatically modifying the one or more classification rules such that later data with identifying characteristics similar to that of the at least one connection are not classified in the same manner.