Techniques to identify applications based on network traffic are described. In one embodiment, an apparatus may comprise a client record component, a traffic monitoring component, a profiling component, and a traffic analysis component. The client record component may be operative to store a client application map, the client application map to represent installations of a plurality of applications on a plurality of client devices. The traffic monitoring component may be operative to monitor training network traffic and additional network traffic on one or more network interfaces, the training network traffic generated by the plurality of client devices. The profiling component may be operative to generate a network profile map using machine learning based on the training network traffic and the client application map. The traffic analysis component may be operative to identify one or more application of the plurality of applications. Other embodiments are described and claimed.