System and method for identifying services with which encrypted traffic is exchanged

A system, comprising:

• a memory;
• and
• a processor, configured to:
• receive respective copies of communication packets exchanged, over a network, with respective communication endpoints belonging to respective servers,
• the packets containing respective endpoint identifiers, each of which includes a respective Internet Protocol (IP) address and port number identifying the communication endpoint with which the packet containing the endpoint identifier was exchanged,
• compute respective signature vectors for the communication endpoints, each of the signature vectors representing statistical properties of those of the packets that were exchanged with a different respective one of the communication endpoints,
• based on a predefined measure of vector similarity between the signature vectors, cluster the communication endpoints into multiple clusters,
• by communicating investigative traffic over the network, ascertain respective services that use the communication endpoints, and
• in response to ascertaining the services, store an association between the communication endpoints and the services, respectively, in the memory, wherein the processor is configured to store the association by associating each of the clusters, in the memory, with each of the services ascertained to use any one of the communication endpoints in the cluster.