Patent ID: 7543052

Claim:
An apparatus facilitating the monitoring of network traffic, comprising: one or more network interfaces; a memory; a processor; and computer-executable program code stored in the memory and executable by the processor, the computer-executable program code comprising a traffic classification database module comprising computer-executable instructions configured, when executed, to cause the processor to store at least one traffic class including a traffic class identifier and at least one attribute defining the traffic class; compare attributes stored in association with traffic class identifiers to attributes of a data flow to match a traffic class that corresponds to the data flow; a traffic discovery module comprising computer-executable instructions configured, when executed, to cause the processor to discover new traffic classes associated with data flows for which the traffic classification database did not find a matching traffic class; add discovered traffic classes to the traffic classification database after a discovery threshold has been exceeded; dynamically adjust under one or more computer program controls the discovery threshold based on a comparison of a current rate at which the discovered traffic classes are added to the traffic classification database to a threshold rate.