Patent ID: 8577817

Claim:
A method for profiling network traffic of a network, comprising: identifying, using a processor of a computer system and based on a pre-determined criterion, a training set from a plurality of flows obtained from the network traffic, wherein the training set is associated with a network application and comprises a plurality of captured payloads corresponding to the plurality of flows; determining, using the processor and based on a first pre-determined algorithm, a set of signature terms from the training set, wherein the set of signature terms are selected from a plurality of substrings extracted from the plurality of captured payloads; representing a portion of the plurality of captured payloads as a plurality of regular expressions, each comprising a first sequence of one or more signature terms based on the set of signature terms; representing a first regular expression of the plurality of regular expressions as a first path of a plurality of paths in a term transition state machine (TTSM), the TTSM comprising a plurality of states coupled by a plurality of links comprising a first link, coupling first and second states of the plurality of states to form a portion of the first path, that is assigned a first signature term and a first transition probability, the first transition probability corresponding to a first signature term transition, transitioning to the first signature term, in the first regular expression; and analyzing, using the processor and based on the TTSM according to at least the first transition probability, a flow separate from the plurality of flows and associated with a server in the network to determine the server as executing the network application.