Abstract: A system and method for classifying application and content in a computer network. The method including: determining an application associated with a traffic flow; determining at least one type of content category associated with the application; reviewing packet parameters to determine the content category of the traffic flow; and monitoring the traffic flow for any changes to the packet parameters that would indicate a change in the content category of the traffic flow. The system including: an application module configured to determine an application associated with a traffic flow; a signature module, a heuristic module and a machine learning module configured to review packet parameters to determine a content category associated with the traffic flow and any changes to the content category associated with the traffic flow. A system and method for determining a confidence level of a classification of an application and content category of a traffic flow.