Identifying network applications using images generated from payload data and time data

A non-transitory computer-readable medium storing instructions executable to by at least one processor to perform operations comprising:

• capturing target payload data and target time data from a target flow of network packets between a target client application and a target server application, the target payload data indicating lengths of payloads of the network packets in the target flow, the target time data indicating time periods between arrivals of the network packets in the target flow;
• generating a target image from the target payload data and the target time data by
• normalizing the target payload data,
• normalizing the target time data,
• combining the normalized target payload data with the normalized target time data into a set of combined data points,
• placing the set of combined data points in a matrix beginning at a center of the matrix and moving outward from the center of the matrix, and
• converting the matrix into the target image by converting each data point in the matrix into a pixel of the target image;
• and
• determining, based on the target image, an output including an extent to which the target image matches one of a plurality of predetermined images in order to determine a likelihood that the target client application and/or the target server application matches one of a plurality of predetermined client applications and/or one of a plurality of predetermined server applications.

A system comprising:

• at least one processor;
• and
• at least one memory storing instructions executable by the at least one processor to perform operations comprising:
• capturing target payload data and target time data from a target flow of network packets between a target client application and a target server application, the target payload data indicating lengths of payloads of the network packets in the target flow, the target time data indicating time periods between arrivals of the network packets in the target flow;
• generating a target image from the target payload data and the target time data by
• normalizing the target payload data,
• normalizing the target time data,
• combining the normalized target payload data with the normalized target time data into a set of combined data points,
• placing the set of combined data points in a matrix beginning at a center of the matrix and moving outward from the center of the matrix, and
• converting the matrix into the target image by converting each data point in the matrix into a pixel of the target image;
• and
• determining, based on the target image, an output including an extent to which the target image matches one of a plurality of predetermined images in order to determine a likelihood that the target client application and/or the target server application matches one of a plurality of predetermined client applications and/or one of a plurality of predetermined server applications.