Network traffic event management at the client terminal level

A device of queuing network traffic events on a client terminal, comprising:

• A hardware processor executing a code comprising:
• code instructions for monitoring, in run time, a plurality of network traffic events triggered by a plurality of applications executed on a client terminal, each of said plurality of network traffic events requiring an opening of a data connection session between said client terminal and a network;
• code instructions for extracting, in run time, a plurality of network traffic event characteristics from each of said plurality of network traffic events and for classifying each one of said plurality of network traffic events according to a respective said plurality of network traffic event characteristics;
• code instructions for clustering said plurality of network traffic events in a plurality of clusters according to said classifying and for managing an opening of a plurality of common data connection sessions between said client terminal and said network such that a content of each cluster of said plurality of clusters is jointly transmitted in another one of said plurality of data connection sessions, each of said plurality of common data connection sessions having a single data connection session opening event.

A system of identifying one or more malicious threats, comprising:

• a plurality of hardware processors installed in a plurality of client terminals, each one of said plurality of hardware processors is executing a code comprising code instructions for monitoring, in run time, a plurality of network traffic events triggered by a plurality of applications executed on a respective said client terminal, each of said plurality of network traffic events requiring an opening of a data connection session between said respective client terminal and a network, and code instructions for extracting, in run time, a plurality of network traffic event characteristics of each of said plurality of network traffic events;
• a server which is installed on a network node and is executing a code comprising code instructions for calculating at least one classifier by analyzing said plurality of network traffic event characteristics of each of said plurality of network traffic events from each of said plurality of hardware processors;
• wherein said at least one classifier is forwarded from said network node to said plurality of hardware processors and used by each one of said plurality of hardware processors for classifying a plurality of new network traffic events and for managing an opening of a plurality of common data connection sessions with said network according to the outcome of said classifying.