A computer-implemented method of dynamically provisioning a network function in a network, the method comprising: monitoring a network traffic flow, including at least one packet routed through the network, to determine whether the network traffic flow meets a first criterion of a first rule, the first rule specifying that, when the first criterion is met, a network function be used to analyze or process the network traffic flow; and when the network traffic flow is determined to meet the first criterion: determining a first route through the network to a network function provider that provides the network function; determining one or more routers (122a-e) along the first route; and configuring the one or more routers along the first route to forward the network traffic flow to the network function provider for analysis or processing, the method further comprising: while the network function is applied, monitoring the network traffic flow to determine the network traffic flow meets a second criterion of a second rule; and in response to the determination the network traffic flow meets the second criterion: determining a second route through the network such that the second route directs traffic to a destination of the network traffic flow without reaching the network function provider; determining one or more routers along the second route; and configuring the one or more routers along the second route to forward the network traffic flow. monitoring a network traffic flow, including at least one packet routed through the network, to determine whether the network traffic flow meets a first criterion of a first rule, the first rule specifying that, when the first criterion is met, a network function be used to analyze or process the network traffic flow; and when the network traffic flow is determined to meet the first criterion: determining a first route through the network to a network function provider that provides the network function; determining one or more routers (122a-e) along the first route; and configuring the one or more routers along the first route to forward the network traffic flow to the network function provider for analysis or processing, determining a first route through the network to a network function provider that provides the network function; determining one or more routers (122a-e) along the first route; and configuring the one or more routers along the first route to forward the network traffic flow to the network function provider for analysis or processing, while the network function is applied, monitoring the network traffic flow to determine the network traffic flow meets a second criterion of a second rule; and in response to the determination the network traffic flow meets the second criterion: determining a second route through the network such that the second route directs traffic to a destination of the network traffic flow without reaching the network function provider; determining one or more routers along the second route; and configuring the one or more routers along the second route to forward the network traffic flow. determining a second route through the network such that the second route directs traffic to a destination of the network traffic flow without reaching the network function provider; determining one or more routers along the second route; and configuring the one or more routers along the second route to forward the network traffic flow.