Disclosed herein are systems and methods for multi-level classification of data traffic flows. In exemplary embodiments of the present disclosure, flows can be classified based on information in a first packet. The classification is based on an inference that can be made by a network appliance from a learning algorithm regarding an application name and/or one or more application characteristic tags. Based on the inference, the network appliance can select an appropriate network path for the flow.