Aspects of the disclosure provide a method for packet classification. The method includes storing, in a computer memory of a network device, characteristic signatures of packet flows for network applications. The characteristic signature includes a pattern of two or more packet attributes of packets in packet flows for a network application. Then, the method includes receiving a stream of network packets at the network device, identifying one or more packet flows in the stream of network packets, processing the packets, at a packet processor, to obtain packet attributes of packets in the respective packet flows, and identifying a packet flow as being associated with a given network application when the packet attributes of packets in the packet flow match the characteristic signature of the given network application.