Application signature generation and distribution

A network device, comprising:

• one or more memories;
• and
• one or more processors communicatively coupled to the one or more memories, configured to:
• generate an application signature according to a rule base that specifies content and format of the application signature,
• the rule base being for an application layer protocol;
• normalize, based on the application layer protocol, the application signature to obtain a normalized generated application signature;
• add the normalized generated application signature to a signature database;
• identify a normalized new application signature;
• determine that the normalized new application signature matches the normalized generated application signature;
• and
• replace the normalized generated application signature, in the signature database, with the normalized new application signature after determining that the normalized new application signature matches the normalized generated application signature.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• generate an application signature according to a rule base that specifies content and format of the application signature,
• the rule base being for an application layer protocol;
• normalize, based on the application layer protocol, the application signature to obtain a normalized generated application signature;
• determine that a different normalized application signature matches the normalized generated application signature;
• and
• replace the normalized generated application signature with the different normalized application signature after determining that the different normalized application signature matches the normalized generated application signature.