Patent ID: 7835348

Claim:
A method comprising: receiving network traffic which is subject to a selective switching; storing a set of one or more traffic selectors, each traffic selector in the set of one or more traffic selectors indicating a respective data flow; evaluating a set of data in the received network traffic based on a first traffic selector in the set of one or more traffic selectors, the evaluating to determine whether the set of data is to be inspected by a security service agent; in response to the evaluating, redirecting the set of data in the received network traffic to the security service agent; detecting that a network condition exceeds a threshold of a set of one or more policies; in response to the detecting, triggering an update of the set of one or more traffic selectors; receiving anomaly detection information; and based on the received anomaly detection information, modifying in the set of one or more policies a first policy according to which the set of one or more traffic selectors is to be updated, the modifying without interrupting the selective switching of the network traffic.