Systems and methods for application identification

A computer-readable medium having a plurality of computer-executable components for identifying a network application, said computer-executable components comprising:

• a signature monitor operable for identifying said network application based on a first packet transmitted by said network application and for generating monitoring data indicative of a state of said first packet;
• a rule generator operable for generating a rule according to said monitoring data and a state machine, wherein said state machine is indicative of a state transition between said first packet and a second packet transmitted by said network application;
• and
• a packet access controller operable for identifying said network application if said network application transmits said second packet containing contents matched to said rule.

A method for identifying a network application, said method comprising:

• generating monitoring data indicative of a state of a first packet transmitted by said network application;
• generating a rule according to said monitoring data and according to a state machine indicative of a state transition between said first packet and a second packet transmitted by said network application;
• receiving said second packet;
• and
• identifying said network application if said second packet contains contents matched to said rule.