A computer-implemented method for automated classification of application network activity, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: building a lexicon dictionary that comprises lexical keywords, wherein network streams whose headers contain a given lexical keyword represent communications of an activity type that is associated with the given lexical keyword in the lexicon dictionary, wherein building the lexicon dictionary comprises: executing a known application in a sandboxed environment ; causing the known application to generate a generated network stream by performing an action on the application; extracting at least one observed keyword from the header of the generated network stream; and associating, within the lexicon dictionary, the at least one observed keyword with the action that caused the known application to generate the generated network stream; identifying , at a network vantage point , a network stream that represents a communication between an application and a server ; extracting , through a lexical analysis that utilizes the lexicon dictionary, a set of keywords from one or more header fields of the network stream; assigning at least one activity type to the network stream based on activity types associated with each keyword in the set of keywords that were extracted from the header fields of the network stream; and providing the at least one activity type assigned to the network stream to a network management system that enforces a network traffic policy. building a lexicon dictionary that comprises lexical keywords, wherein network streams whose headers contain a given lexical keyword represent communications of an activity type that is associated with the given lexical keyword in the lexicon dictionary, wherein building the lexicon dictionary comprises: executing a known application in a sandboxed environment ; causing the known application to generate a generated network stream by performing an action on the application; extracting at least one observed keyword from the header of the generated network stream; and associating, within the lexicon dictionary, the at least one observed keyword with the action that caused the known application to generate the generated network stream; executing a known application in a sandboxed environment ; causing the known application to generate a generated network stream by performing an action on the application; extracting at least one observed keyword from the header of the generated network stream; and associating, within the lexicon dictionary, the at least one observed keyword with the action that caused the known application to generate the generated network stream; identifying , at a network vantage point , a network stream that represents a communication between an application and a server ; extracting , through a lexical analysis that utilizes the lexicon dictionary, a set of keywords from one or more header fields of the network stream; assigning at least one activity type to the network stream based on activity types associated with each keyword in the set of keywords that were extracted from the header fields of the network stream; and providing the at least one activity type assigned to the network stream to a network management system that enforces a network traffic policy. <EOS>