Patent ID: 8572717

Claim:
A network security appliance comprising: an interface configured to receive a packet flow; a control unit configured to support definition of a first security policy and a second security policy to control access by the packet flow to a network, wherein the first security policy specifies: (a) first match criteria that include a type of layer seven network application and a first static port list of one or more layer four ports for a transport-layer protocol, and (b) first actions to be applied to packet flows that match the first match criteria, and wherein the second security policy specifies: (a) second match criteria that include the type of layer seven network application and a second static port list of one or more layer four ports for a transport-layer protocol, wherein the second static port list is different than the first static port list, and (b) second actions to be applied to packet flows that match the second match criteria, wherein the second actions are different than the first actions; a rules engine configured to dynamically identify a type of layer seven network application associated with the received packet flow based on inspection of application-layer data within payloads of packets of the packet flow, wherein the rules engine is configured to apply the first security policy to the packet flow, wherein the control unit applies the first actions to the packet flow when the rules engine determines the identified type of layer seven network application is the type of layer seven network application and further determines the packet flow matches a port in the first static port list, and wherein the rules engine is configured to apply the second security policy to the packet flow, wherein the control unit applies the second actions to the packet flow when the rules engine determines the identified type of layer seven network application is the type of layer seven network application and further determines the packet flow matches a port in the second static port list.