A method to identify content within a data stream, comprising: capturing a data stream, analyzing and filtering the data stream by isolating a test stream of the data stream and disabling the other sub-streams, applying the test stream to the application so as to produce an output, applying the output to a comparator, the comparator receiving a reference and determining by the comparator a distance between the application output and the reference, if the distance is below a predefined level, repeating the isolating step with a new test stream selected among the previous test stream, the new test stream being a subset of the previous test stream, if that the distance is above or equal a second predefined level, repeating the isolating step by selecting a different test stream from the data stream not already applied to the application.