Patent Document ID: 7944822
Application ID: 12501383
Patent Flag: 1

Claim One:
1. A method for profiling network traffic of a network, comprising: obtaining a first plurality of packet header records from a plurality of flows in the network traffic; extracting a first plurality of statistical features for each flow from the first plurality of packet header records to form a first server feature matrix of a first server associated with the first plurality of packet header records; determining, using a computer, a plurality of principal components of the first server feature matrix by factorizing the first server feature matrix; forming an application space based on the plurality of principal components, wherein the plurality of principal components are orthogonal unit vectors in the application space; identifying, using the computer, a signature of the first server based on a pattern of the first plurality of packet header records in the application space, wherein the signature is associated with a network application running on the first server; and determining, using the computer, a second server in the network as running the network application by: extracting a second plurality of statistical features from a second plurality of packet header records associated with the second server in the network traffic; placing the second plurality of statistical features in the application space for comparing to the signature to generate a matching level; and determining the second server as running the network application when the matching level exceeds a pre-determined criterion.