1. A machine-implemented method comprising: a) obtaining network packets; b) grouping the collected network packets into a plurality of flows; c) for each of the plurality of flows, i) determining a content characteristic by characterizing content of the flow using bit-stream level statistics, and ii) determining at least one of (A) content-independent flow characteristics, (B) port-independent flow characteristics, and (C) application header-independent flow characteristics; and d) enforcing a policy on at least one of the flows using both (1) the determined content characteristic and the (2) determined at least one of (A) content-independent flow characteristics, (B) port-independent flow characteristics, and (C) application header-independent flow characteristics.