A method, comprising: receiving, by a network device, network traffic for an application; determining, by the network device, a first classification for the network traffic according to a first classification technique, wherein the first classification technique is a deep packet inspection, DPI, classification technique that identifies the network traffic as relating to either: a known application if a signature of the network traffic corresponds to an application signature known to the network device, or an unknown application if the signature of the network traffic does not correspond to an application signature known by the network device; characterised by determining, by the network device, a second classification for the network traffic according to a second classification technique, wherein the second classification technique is a machine learning classification technique that identifies the network traffic, classified by the DPI classification technique as relating to an unknown application, as relating to an unknown application of a particular type and identity, wherein the type corresponds to a type of traffic associated with the unknown application, and wherein the identity is based on features of the traffic that are characteristics of the unknown application and differentiates between unknown applications of the same type, wherein the features relate to a flow of the traffic or an encryption of the traffic; and processing the network traffic according to: a first security policy that allows or blocks traffic associated with the known application, when the first classification identifies the network traffic as relating to the known application, or a second security policy that allows or blocks traffic associated with the unknown application of the particular type and identity, when the first classification identifies the network traffic as relating to the unknown application. receiving, by a network device, network traffic for an application; determining, by the network device, a first classification for the network traffic according to a first classification technique, wherein the first classification technique is a deep packet inspection, DPI, classification technique that identifies the network traffic as relating to either: a known application if a signature of the network traffic corresponds to an application signature known to the network device, or an unknown application if the signature of the network traffic does not correspond to an application signature known by the network device; characterised by determining, by the network device, a second classification for the network traffic according to a second classification technique, wherein the second classification technique is a machine learning classification technique that identifies the network traffic, classified by the DPI classification technique as relating to an unknown application, as relating to an unknown application of a particular type and identity, wherein the type corresponds to a type of traffic associated with the unknown application, and wherein the identity is based on features of the traffic that are characteristics of the unknown application and differentiates between unknown applications of the same type, wherein the features relate to a flow of the traffic or an encryption of the traffic; and processing the network traffic according to: a first security policy that allows or blocks traffic associated with the known application, when the first classification identifies the network traffic as relating to the known application, or a second security policy that allows or blocks traffic associated with the unknown application of the particular type and identity, when the first classification identifies the network traffic as relating to the unknown application. a first security policy that allows or blocks traffic associated with the known application, when the first classification identifies the network traffic as relating to the known application, or a second security policy that allows or blocks traffic associated with the unknown application of the particular type and identity, when the first classification identifies the network traffic as relating to the unknown application.