Patent Document ID: 9614773
Application ID: 14210313
Patent Status: 1

Claim One:
1. A computer-implemented method for automatically correcting classification signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying at least one classification signature used to classify network traffic; detecting at least one unknown flow of network traffic; determining that the unknown flow of network traffic and the classification signature exceed a threshold level of similarity by comparing the unknown flow with the classification signature by: identifying a plurality of features of the classification signature; identifying a plurality of attributes of the unknown flow of network traffic; determining the number of attributes of the unknown flow that match the features of the classification signature; determining, based at least in part on the number of attributes of the unknown flow that match the features of the classification signature, that the unknown flow of network traffic and the classification signature exceed the threshold level of similarity; in response to determining that the unknown flow and the classification signature exceed the threshold level of similarity: identifying at least one attribute of the unknown flow that differs from the classification signature; modifying the classification signature based at least in part on the attribute of the unknown flow.