A method comprising: receiving, at a network infrastructure device, a flow comprising a plurality of packets; determining, using the network infrastructure device and for a first subset of the plurality of packets, that the first subset corresponds to a first datagram and determining a first length of the first datagram, wherein the first subset comprises at least a first packet and a second packet, and using a sum of a first packet length of the first packet and a second packet length of the second packet as the first length of the first datagram; determining, using the network infrastructure device and for a second subset of the plurality of packets, that the second subset corresponds to a second datagram that was received after the first datagram, and determining a second length of the second datagram, the first datagram and the second datagram each corresponding to a single message carried by a transport protocol; determining, using the network infrastructure device, a duration value between a first arrival time of the first datagram and a second arrival time of the second datagram; sending, to a collector device that is separate from the network infrastructure device, the first length, the second length, and the duration value for analysis; receiving the first length, the second length, and the duration value at the collector device; determining, using the collector device, the first length, second length, and duration, an application identifier of an application that is associated with the first datagram and the second datagram; determining whether the application is identified as a malicious application in a stored set of identifiers of malicious applications; in response to determining that the application is a malicious application that is identified in the stored set of identifiers of malicious applications, sending an alert signal; wherein the method is executed using one or more computing devices. receiving, at a network infrastructure device, a flow comprising a plurality of packets; determining, using the network infrastructure device and for a first subset of the plurality of packets, that the first subset corresponds to a first datagram and determining a first length of the first datagram, wherein the first subset comprises at least a first packet and a second packet, and using a sum of a first packet length of the first packet and a second packet length of the second packet as the first length of the first datagram; determining, using the network infrastructure device and for a second subset of the plurality of packets, that the second subset corresponds to a second datagram that was received after the first datagram, and determining a second length of the second datagram, the first datagram and the second datagram each corresponding to a single message carried by a transport protocol; determining, using the network infrastructure device, a duration value between a first arrival time of the first datagram and a second arrival time of the second datagram; sending, to a collector device that is separate from the network infrastructure device, the first length, the second length, and the duration value for analysis; receiving the first length, the second length, and the duration value at the collector device; determining, using the collector device, the first length, second length, and duration, an application identifier of an application that is associated with the first datagram and the second datagram; determining whether the application is identified as a malicious application in a stored set of identifiers of malicious applications; in response to determining that the application is a malicious application that is identified in the stored set of identifiers of malicious applications, sending an alert signal; wherein the method is executed using one or more computing devices.