Patent ID: 8578024

Claim:
A method for profiling network traffic of a network, comprising: obtaining, from the network traffic, a plurality of flows associated with a network application, wherein each of the plurality of flows comprises a sequence of data bits; defining a plurality of features for the plurality of flows based on a pre-determined criterion, wherein a feature of the plurality of features corresponds to a plurality of pre-determined bit positions in the sequence of data bits for selecting a pre-determined number of data bits from the sequence of data bits, and wherein the pre-determined number of data bits are selected from the sequence of data bits for the each of the plurality of flows to form a feature value assigned to the feature for the each of the plurality of flows; identifying, by a processor of a computer system, the feature as one of a plurality of deterministic features for the network application based on a frequency of occurrence of the feature value in the plurality of pre-determined bit positions for all of the plurality of flows exceeding a pre-determined frequency threshold, wherein the feature value is identified as one of a plurality of deterministic feature values corresponding to the plurality of deterministic features; extracting, by the processor, a plurality of paths from the plurality of flows, wherein each of the plurality of paths comprises at least two deterministic features and is extracted from a flow, of the plurality of flows, having at least two deterministic feature values for the at least two deterministic features, respectively; generating, by the processor, a state machine based on the plurality of paths, wherein a state in the state machine corresponds to a selected deterministic feature in the plurality of paths, wherein a state transition in the state machine corresponds to two sequential deterministic features selected from the plurality of paths, wherein the selected deterministic feature and the two sequential deterministic features are selected based on a pre-determined algorithm; and analyzing, by the processor and based on the state machine, a new flow separate from the plurality of flows and associated with a server in the network to determine the server as executing the network application.