Systems and methods for first packet application classification

Abstract

Described embodiments provide for low-latency classification of flows, via an intelligent learning-based system. In one implementation, a packet processor may utilize destination internet protocol (IP) addresses and domains identified in first packets of flows to determine if a similar flow has been previously received, directed to the same address and domain, or apply default routing and policy rules if not. The packet processor may subsequently fully classify the flow; generate a record in an association database for the combination of application, address, and domain, and a starting confidence level; and apply proper routing and policy rules. A subsequent flow for the same application and destination IP address may then be classified as the same as the prior flow, with corresponding routing and policy rules applied. The packet processor may continue to fully classify the flow, and upon full classification, the database entry may be updated and the confidence level adjusted.