Application classification using packet size distribution and port association
Snort - Lightweight Intrusion Detection for Networks