Transaction based network application signatures for text based protocols

A system for profiling network traffic of a network, comprising:

• a data collector configured to obtain, from the network traffic, a plurality of bi-directional flows;
• a cell group generator executing on a processor of a computer system and configured to:
• identify, from the plurality of bi-directional flows, a training set comprising a plurality of captured payloads corresponding to the plurality of bi-directional flows;
• extract, based on a first pre-determined algorithm, a plurality of cells from the plurality of captured payloads, wherein each cell comprises a consecutive portion of the sequence of captured payloads, wherein the consecutive portion comprises at least one direction reversal in a corresponding bi-directional flow;
• analyze, based on a second pre-determined algorithm, a portion of the plurality of cells to calculate a similarity measure representing similarity among cells in the portion of the plurality of cells;
• and
• generate, in response to the similarity measure exceeding a pre-determined threshold, a cell group comprising the portion of the plurality of cells;
• a profiler executing on the processor and configured to identify the training set as associated with a network application;
• a signature generator executing on the processor and configured to analyze, based on a third pre-determined algorithm, the cell group to generate a signature of the network application;
• a classifier executing on the processor and configured to classify, based on the signature of the network application, a new bi-directional flow, separate from the plurality of bi-directional flows, as being generated by the network application;
• and
• a repository configured to store the plurality of cells and the signature of the network application.

A non-transitory computer readable medium embodying instructions for profiling network traffic of a network, the instructions when executed by a processor comprising functionality for:

• identifying, based on a pre-determined criterion, a training set from a plurality of bi-directional flows obtained from the network traffic, wherein the training set is associated with a network application, wherein each bi-directional flow comprises a sequence of captured payloads exchanged between a server and a client of the network;
• extracting, based on a first pre-determined algorithm, a plurality of cells from the plurality of captured payloads, wherein each cell comprises a consecutive portion of the sequence of captured payloads, wherein the consecutive portion comprises at least one direction reversal in a corresponding bi-directional flow;
• analyzing, based on a second pre-determined algorithm, a portion of the plurality of cells to calculate a similarity measure representing similarity among cells in the portion of the plurality of cells;
• generating, in response to the similarity measure exceeding a pre-determined threshold, a cell group comprising the portion of the plurality of cells;
• analyzing, based on a third pre-determined algorithm, the cell group to generate a signature of the network application;
• and
• classifying, based on the signature of the network application, a new bi-directional flow, separate from the plurality of bi-directional flows, as being generated by the network application.