Patent Document ID: 8494985
Application ID: 13109675
Patent Flag: 1

Claim One:
1. A method for profiling network traffic of a network, comprising: identifying, using a processor of a computer system and based on a first pre-determined criterion, a training set from a plurality of flows obtained from the network traffic, wherein the training set is associated with a network application and comprises a plurality of captured payloads corresponding to the plurality of flows; determining, using the processor and based on a first pre-determined algorithm, a set of signature terms from the training set, wherein the set of signature terms are selected from a plurality of substrings extracted from the plurality of captured payloads; representing a portion of the plurality of captured payloads as a plurality of regular expressions, each comprising a first sequence of one or more signature terms based on the set of signature terms; generating a modified term transition state machine (MTTSM), comprising a plurality of states coupled by a plurality of links to form a plurality of paths, by: representing a first regular expression of the plurality of regular expressions by a first path, of the plurality of paths, comprising a first state and a second state, of the plurality of states, linked by a first link, of the plurality of links, that is assigned a first signature term in the first regular expression to represent a first state transition associated with the first signature term; and representing a second regular expression of the plurality of regular expressions by a second path, of the plurality of paths, comprising the first state and a third state, of the plurality of states, linked by a second link, of the plurality of links, that is assigned a second signature term in the second regular expression to represent a second state transition associated with the second signature term; analyzing, using the processor and based on the MTTSM, a flow separate from the plurality of flows and associated with a server in the network, comprising: extracting, from the flow and based on the set of signature terms, a second sequence of signature terms; determining the first signature term and the second signature term as contained in the second sequence of signature terms; comparing a first position and a second position of the first signature term and the second signature term, respectively, in the second sequence of signature terms to generate a comparison result; and traversing, in response to the comparison result indicating that the first position is ahead of the second position in the second sequence of signature terms, the first link to generate an analysis result; and determining, based on the analysis result, the server as executing the network application.