Patent ID: 8009566

Claim:
A method comprising: receiving, by a processor, a data packet; examining the data packet to initially classify the data packet including initially classifying the data packet using information included in an header and content; determining flow instructions for processing the data packet based on both the header and the content including determining, using at least one of the header or the content, whether the data packet is associated with a data flow that has previously been classified; if the data flow has previously been classified, performing at least one of content based protocol decoding, content based object extraction, or content based pattern matching; if the data flow has not previously been classified, processing the data packet based on whether the data flow is a known data flow; updating the initial classification based on a processing result of one or more of the content based protocol decoding, content based object extraction, or content based pattern matching; and using the updated classification to determine whether a next data flow has previously been classified.