Abstract: A method and system for classifying a traffic flow. The method including: initializing a database with packet parameters; identifying a new flow; determining packet parameters associated with the new flow; determine whether the packet parameters match any previously stored packet parameters in the database; if the packet parameters match, determining an application classification for the traffic flow. The system including: a server profiling module configured to initialize a database; and an application module configured determine packet parameters associated with the new flow, determine whether the packet parameters match any previously stored packet parameters. A method and system for detecting a change in the classification of an application and/or content in a traffic flow. The method includes determining a change in the application behavior; detecting a change in a content category of the application, providing an updated traffic action based on the detected change.

Abstract: A method and system for detecting ruleset misconfiguration in a computer network. The method including: generating a set of sample data flows; evaluating each of the set of sample data flows against a predetermined definition to generate a flow descriptor for each of the set of sample data flows; evaluating each of the flow descriptors against a ruleset; and generating a summary of how each of the flow descriptors perform with respect to the ruleset. The system including: a data flow sample retrieval module configured to generate flows; a policy engine configured to store and retrieve a ruleset; a packet processing engine configured to evaluate each of the data flows against a predetermined definition to generate a flow descriptor for each flows, evaluate each of the flow descriptors against a ruleset; and generate a summary of how each of the flow descriptors perform with respect to the ruleset.