Patent Document ID: 9479405
Application ID: 13724779
Patent Flag: 1

Claim One:
1. A method for profiling network traffic of a network, comprising: identifying, by a processor of a computer system and based on a pre-determined criterion, a training set from a plurality of bi-directional flows obtained from the network traffic, wherein the training set is associated with a network application, wherein each bi-directional flow comprises a sequence of captured payloads exchanged between a server and a client of the network; extracting, by the processor and based on a first pre-determined algorithm, a plurality of cells from the plurality of captured payloads, wherein each cell comprises a consecutive portion of the sequence of captured payloads, wherein the consecutive portion comprises at least one direction reversal in a corresponding bi-directional flow; analyzing, by the processor and based on a second pre-determined algorithm, a portion of the plurality of cells to calculate a similarity measure representing similarity among cells in the portion of the plurality of cells; generating, in response to the similarity measure exceeding a pre-determined threshold, a cell group comprising the portion of the plurality of cells; analyzing, by the processor and based on a third pre-determined algorithm, the cell group to generate a signature of the network application; and classifying, by the processor and based on the signature of the network application, a new bi-directional flow, separate from the plurality of bi-directional flows, as being generated by the network application.