System and method for classifying network traffic

A system for classifying network traffic comprising:

• a framework of models configured to classify network traffic;
• a packet processing engine configured to determine whether the network traffic flow is encrypted;
• the packet processing engine further configured to extract encrypted flow attributes associated with a network traffic flow and deriving further flow attributes based on the extracted encrypted flow attributes if the network flow is encrypted and configured to extract non-encrypted flow attributes if the traffic flow is not encrypted;
• a traffic classification engine comprising:
• a deep classification engine configured to determine at least one model of the framework of models based on the derived and extracted flow attributes, classify the traffic flow based on the at least one model and determine a confidence level of the classification of the traffic flow;
• and
• a signature classification engine configured to classify the traffic flow as a category of traffic based on the non-encrypted flow attributes.

A method for building a framework of models for classifying network traffic, the method comprising:

• for each type of traffic flow to be classified:
• create a traffic flow with data labels;
• extract flow attributes associated with the traffic flow;
• derive flow attributes based on the extracted flow attributes;
• compare extracted flow attributes and derived flow attributes with the data labels;
• and
• determine a model for the traffic flow based on the compared flow attributes and determine a confidence level of the classification of the traffic flow within the model.