A computer implemented method for determining the identity of an Over-the Top, OTT, application or service being accessed over the Internet, comprising the steps: receiving a connection request in a network monitoring device including determining if a transport layer protocol is TCP and the destination TCP port in the connection request matches known ports to carry HTTP, HTTPS or QUIC requests, and 1 inspecting IP packets in the received connection request; generating a 5-tuple consisting of: IP source and destination addresses; a layer 4 transport protocol, in particular TCP or UDP, and a transport protocol source and destination ports contained in the received connection request, wherein the generated 5-tuple is compared with entries in a connection table to determine if the received connection request is a new or existing connection request, whereby if there is no existing entry, then a new entry is created matching the generated 5-tuple associated with the received connection request; determining if one or more entries are present in the received connection request have an IP address that matches a known server IP address; determining if the received connection request is a HTTP connection request; determining if the received connection request is a HTTPS or QUIC connection request; determining if a subject field in the received connection request is available if no determination is made as to whether if the received connection request is either a HTTP, HTTPS or QUIC connection request; determining if a candidate domain name is available from IP cache created from one or more of the above steps if no determination is made as to whether the received connection request is either a HTTP, HTTPS or QUIC connection request and no subject field is available in the received connection request; and identifying and categorizing OTT applications associated with the received connection request if it is determined: the connection is either a HTTP, HTTPS or QUIC connection type; a subject field is available; or a candidate domain name is available utilizing a lookup table that is periodically updated with new OTT applications. receiving a connection request in a network monitoring device including determining if a transport layer protocol is TCP and the destination TCP port in the connection request matches known ports to carry HTTP, HTTPS or QUIC requests, and 1 inspecting IP packets in the received connection request; determining if one or more entries are present in the received connection request have an IP address that matches a known server IP address; determining if the received connection request is a HTTP connection request; determining if the received connection request is a HTTPS or QUIC connection request; determining if a subject field in the received connection request is available if no determination is made as to whether if the received connection request is either a HTTP, HTTPS or QUIC connection request; determining if a candidate domain name is available from IP cache created from one or more of the above steps if no determination is made as to whether the received connection request is either a HTTP, HTTPS or QUIC connection request and no subject field is available in the received connection request; and identifying and categorizing OTT applications associated with the received connection request if it is determined: the connection is either a HTTP, HTTPS or QUIC connection type; a subject field is available; or a candidate domain name is available utilizing a lookup table that is periodically updated with new OTT applications.