Patent ID: 8843627

Claim:
A method for classifying network traffic in a network, comprising: generating, by a processor of a computer system during a training phase, a signature set, comprising: obtaining, from the network traffic and based on a pre-determined selection criterion, a plurality of seeding flows; obtaining, from the network traffic and based on a pre-determined seeding criterion, a plurality of seeded flow groups, each comprising a plurality of flows associated with at least a seeding flow of the plurality of seeding flows; detecting, from at least two seeded flow groups of the plurality of seeded flow groups, a persistent data pattern having a frequency of occurrence in each of the at least two seeded flow groups exceeding a pre-determined data pattern occurrence threshold; and including the persistent data pattern as a signature in the signature set; and classifying, by the processor during a classifying phase, a new flow obtained from the network traffic, comprising: generating a comparison result by comparing the new flow to the signature set; and classifying, in response to the comparison result meeting a pre-determined classifying criterion, the new flow as being generated by an application associated with the signature set.