Patent ID: 8565093

Claim:
A method comprising: receiving, by a processor of a network security device, a data packet; examining the data packet to initially classify the data packet including initially classifying the data packet using header information included in a header of the data packet and content included in a payload of the data packet; determining flow instructions for processing the data packet based on both the header information and the content including determining, using at least one of the header information or the content, whether the data packet is associated with a data flow that has previously been classified; if the data flow has previously been classified, performing at least one of content based protocol decoding, content based object extraction, or content based pattern matching; updating the initial classification based on a processing result of one or more of the content based protocol decoding, the content based object extraction, or the content based pattern matching; and associating a next data packet with the data flow, wherein the data flow is classified with the updated initial classification.